The most important security vulnerability that HSTS can fix is SSL-stripping man-in-the-middle attacks, first publicly introduced by Moxie Marlinspike in his 2009 BlackHat Federal talk "New Tricks For Defeating SSL In Practice" [REF].
Because HSTS is time limited, it is sensitive to attacks involving shifting the victim's computer time e.g. using false NTP packets [REF].