Reference
Showing 40 of 508 terms.
A connection initiated from inside a network outward to an attacker-controlled server, allowing that server to route traffic back through the compromised host to reach internal systems. Because the connection originates internally, it evades controls focused on inbound traffic.
An authorization model that grants permissions to named roles rather than to individual users, so access is determined by the role a principal holds. On many network appliances a built-in administrator role such as netadmin carries full control, which is why bypassing authentication to reach that role is equivalent to total compromise.
A device that directs data packets between your local network and the internet.
An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider, enabling single sign-on (SSO) across different systems.
An XML document issued by an identity provider containing statements about a user's identity, attributes, and authentication status, used to grant access to service providers in SSO systems.
The XML authentication request a SAML service provider sends, via the user's browser, to an identity provider to ask it to authenticate the user. The identity provider must parse this unauthenticated XML before it can verify who sent it.
A SAPI is the layer that connects the PHP interpreter to what feeds it requests, such as mod_php, PHP-FPM, CGI or the command line. Each SAPI handles request startup and shutdown differently.
A networking approach that manages wide-area connectivity in software, centrally defining routing and security policy and pushing it to edge devices from a controller. The central manager administers many downstream devices at once, which makes it a high-value target whose compromise can affect an entire fabric.
An SD-WAN orchestrator is the central management server that stores configuration, policy and credentials for every edge device in a software-defined WAN and pushes changes to them. Compromising it gives control over every connected site.
SIMATIC IoT2050 is a Siemens industrial IoT gateway that runs Siemens Industrial OS and can optionally host Node-RED for data integration.
A protocol for monitoring and managing network devices and services. Agents expose status data and can send notifications (traps) to a management system. SNMP integrations in application servers are frequently optional components that process untrusted data.
A SOCKS5 proxy is a relay that forwards arbitrary TCP and UDP traffic for a client. Attackers plant one on a compromised server to tunnel their own traffic into the internal network.
A vulnerability where untrusted input is concatenated into a database query so an attacker can alter what the query does. Consequences range from reading or modifying data to executing operating-system commands when the database engine runs with high privilege and exposes file or program features.
A protocol for secure remote login and command execution over an untrusted network. It is layered: a transport layer sets up encryption and host-key verification, an authentication service proves the user's identity, and only then does a connection service open channels for commands and file transfer.
Key re-exchange, a normal SSH feature that lets either side refresh the session's encryption keys mid-connection without disconnecting. Because it is a transport-level operation that can occur during authentication, flawed state handling around a rekey can let an attacker reach the post-authentication phase early, as in CVE-2026-67279.
An SSL VPN is a remote access VPN that carries user traffic over TLS, usually through a portal or client on an internet-facing appliance. Its login page makes it a frequent target for credential attacks.
Cryptographic protocols that secure data transmitted between your browser and websites (the lock icon in HTTPS).
An authentication method that allows users to log in once with a single set of credentials and gain access to multiple related but independent software systems without re-authenticating.
A SharePoint allowlist that specifies which server-side controls a page is permitted to load, meant to stop arbitrary .NET types from being instantiated through web-part markup. Bypassing it, as CVE-2026-65660 does, lets an attacker load a control the platform never validated.
A second-stage exploit that breaks out of a restricted process, such as a browser renderer, into the more privileged browser process or the operating system. In-the-wild browser attacks usually chain a JavaScript-engine bug with a sandbox escape, which is why a renderer-only bug is rated as scope unchanged in CVSS.
A CVSS metric (S:C) indicating that exploiting the vulnerable component affects resources beyond its own security authority, such as a flaw in an update tool that compromises the whole operating system. Scope-changed scores are weighted higher than same-scope ones.
A group of Splunk search heads that replicate configuration and knowledge objects among themselves so any member can serve users and the group survives a node failure. Members communicate over several management interfaces, which widens each node's attack surface relative to a standalone search head.
The practice of replacing credentials, keys and tokens with new values and invalidating the old ones, either on a schedule or after a suspected exposure. Rotation limits how long a leaked secret stays useful to an attacker.
An automated check that searches code and commit history for credential-shaped strings. Push protection extends it by blocking commits that contain a detected secret before they reach the repository.
A credential, key or token stored on disk or in configuration rather than held only in memory. Application config files commonly hold secrets at rest in plaintext so the program can use them, which makes them a high-value target for any file-read vulnerability.
An appliance or hosted service that sits in the inbound and outbound mail path to filter spam, malware, and policy violations. Because it must accept and parse SMTP traffic from any sender on the internet, its parsing code is unauthenticated attack surface by design.
A set of basic identity security settings in Microsoft Entra ID that enable MFA, block legacy authentication, and protect privileged accounts—recommended for organizations without premium licenses.
A security feature bypass is a vulnerability class that lets an attacker get around a protection such as a warning prompt, allowlist or signature check. It rarely runs code by itself but lets a separate payload through.
Cisco's qualitative severity label for a vulnerability, ranging from Low to Critical, assigned alongside the numeric CVSS score. A flaw can carry a modest CVSS score yet a high SIR when it chains readily with other bugs to cause greater harm.
A physical hardware device used for authentication, providing stronger protection than SMS or app-based 2FA.
A vulnerability in which an attacker makes a server send requests to destinations of the attacker's choosing, borrowing the server's network position to reach internal or loopback-only services that are not directly exposed. Classified as CWE-918; the entry point of both 2026 SonicWall SMA1000 zero-day chains.
A vulnerability in which attacker-controlled input reaches a template engine as template syntax rather than as a bound value, letting the attacker write expressions the engine evaluates. Because template engines can reach runtime objects, SSTI commonly escalates to remote code execution, as in the 2026 StyleSmuggler attacks on Magento.
A non-human operating system or application account under which a service runs. Its permissions define the blast radius of any exploit against that service, since attacker code executes with the service account's access to files, secrets, and the network.
In federated authentication, an application or service that relies on an identity provider to authenticate users rather than managing credentials directly, accepting SAML assertions or other tokens as proof of identity.
An attack where the attacker knows or sets a victim's session identifier in advance, then rides that session to gain access once it becomes privileged. It works when a program uses predictable session IDs or fails to regenerate them after login.
An attack where an adversary takes over a legitimate user session by stealing or predicting session tokens, gaining unauthorized access to systems or data.
Session upload progress is a PHP feature, on by default since PHP 5.4.0, that records how much of a file upload has arrived in the user's session. It is controlled by session.upload_progress.enabled.
An authentication scheme in which a user submits credentials to a login endpoint, the server establishes a session, and subsequent requests are tied to that session. The dedicated login path these schemes expose is a frequent target for authorization-bypass bugs, since reaching it or impersonating its result can grant authenticated access.
An executable with the set-user-ID bit, which runs with the privileges of the file's owner (often root) rather than the user who launched it. Setuid programs are a classic target for privilege escalation because any input they trust becomes a path to elevated code execution.
The shadow password file, /etc/shadow, is the Linux file that stores password hashes and aging data for accounts. Only privileged users can read it, and its password field decides whether a password can work.