Information Security Threats and Vulnerabilities

A unique identifier for publicly known information security vulnerabilities.

Indicates that a vulnerability is under review for inclusion in the CVE list.

Indicates that a vulnerability has been accepted to the CVE list.

A software flaw allowing an attacker to gain unauthorized access or control.

Vulnerabilities directly allow attacks, while exposures provide a path but not direct access.

A configuration issue, or software flaw, that indirectly allows access/activities, but doesn't immediately let attackers take control of something.

The structured way CVE vulnerabilities are identified (e.g., CVE-2023-4242).

Flaws in software that are always present and might not be immediately noticeable

An attack that exploits vulnerabilities unknown to the software vendor or the general public. There's no patch available.

The process of reporting new vulnerabilities to the software vendor. It's crucial for fixing security issues.

A process where vulnerabilities are described to the vendor, who fixes the issue, updates are released and made public, and clients (users) apply the updates.

Using tools to find security weaknesses based on known patterns, like buffer overflows or SQL injection.

Vendors are responsible for tracking vulnerabilities and patching them for their customers.

Clients are responsible for applying updates to fix vulnerabilities.

Taking steps to reduce the impact of a vulnerability, even if a complete fix isn't possible.

An insider who uses their authorized access or understanding of an organization to harm that organization. This includes disgruntled, subverted, or malicious collaborators, as well as suppliers or contractors, sometimes referred to as supply chain attacks.

Attacks targeting vulnerabilities in the suppliers or contractors of an organization or system, potentially resulting in extensive damage.

Exploiting a vulnerability to insert malicious code into a program or query, which is later executed on a server or other clients. This can impact databases, web applications, or binary applications.

A type of injection attack that specifically targets database queries. Attackers exploit vulnerabilities in data handling to inject malicious SQL statements.

A specific injection technique where attackers introduce malicious code to run on a system remotely.

Weaknesses in a system that attackers can exploit to gain unauthorized access or disrupt operations.

A security model focused on securing the outer boundaries, or perimeter, of a network or system. Weakness in such a model may allow attackers to exploit vulnerabilities within the network.