MAC-then-encrypt
The construction of computing a MAC over the plaintext and then encrypting both together, an ordering that proved fragile.
TLS 1.0 through 1.2 used this ordering with CBC ciphers. In 2002 Vaudenay showed that CBC padding checks can leak information, and in 2013 Lucky Thirteen showed that even timing differences in MAC verification are enough to exploit it. The trouble is that the receiver must process padding and MAC in the right order, and any observable difference between the two error paths becomes an oracle.
In 2000 Bellare and Namprempre showed that encrypt-then-MAC is the sounder ordering. Today the recommendation is an AEAD mode such as AES-GCM, which avoids the trap entirely.