What do identity spoofing, privilege escalation, and malformed input attacks have in common?

Question $2$ options:

They are the result of being able to access an application's data outside of the application.

Each is preventable.

They all compromise access control lists $($ACLs$).$

They are the result of allowing direct object access.