Reference
Showing 40 of 285 terms.
A vendor-run program that pays external researchers for responsibly disclosed vulnerabilities, usually through a platform such as HackerOne. Many critical fixes, including GitLab's September 2026 patch release, originate from bug bounty reports.
A sophisticated scam targeting businesses that conduct wire transfers, where attackers compromise or impersonate executive email accounts to authorize fraudulent payments.
Control and Provisioning of Wireless Access Points, a standard protocol that lets a controller manage remote wireless access points. On FortiOS the cw_acd daemon speaks CAPWAP, and enabling the Security Fabric service makes an interface listen for it on UDP ports 5246 to 5249.
A legacy mechanism where a web server runs an external program to handle a request and returns its output as the response. Embedded devices such as switches and routers still use CGI programs for their web management interfaces, making them a frequent source of pre-authentication bugs.
An automated sequence of build, test, and deployment jobs triggered by changes to a code repository. Pipelines run with stored credentials to registries, cloud accounts, and servers, which makes the platform that orchestrates them a high-value target.
The U.S. federal agency responsible for cybersecurity and infrastructure protection, which maintains the Known Exploited Vulnerabilities catalog.
The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines.
A standardized identifier for publicly known security vulnerabilities, maintained by MITRE Corporation.
A numerical score (0-10) indicating vulnerability severity, where higher scores represent more critical security risks.
A hybrid social engineering attack where phishing emails instruct victims to call a phone number, leading to vishing attacks that bypass email security controls.
An attack that records a valid authentication exchange and re-sends it to gain access, exploiting the fact that the captured token is not bound to a single session or destination. Classified as CWE-294.
A fingerprint of a TLS session attached to an authentication token so the server can confirm the token arrived over the same channel it was issued on. It is the mechanism Extended Protection uses to stop relay.
A social engineering technique that tricks users into running commands or completing actions on their computers, typically disguised as fixing an error or completing a verification step.
A Cloudflare service in which a lightweight client on a host opens an outbound connection to Cloudflare's edge so the host can be reached from the internet without inbound firewall rules. Legitimate for publishing internal services, it is also abused by intruders as a persistent backdoor that survives console cleanup, as seen in the N-central intrusions.
A security vulnerability that allows attackers to execute arbitrary operating system commands on the host system through a vulnerable application.
A security measure applied in place of a primary control that cannot be implemented yet, such as network restriction while a patch is unavailable. It reduces risk to an acceptable level without fixing the underlying flaw.
A Microsoft Entra ID feature that evaluates signals about users, devices, and locations to make real-time access decisions.
The unauthorized extraction and theft of system configuration files, which can expose sensitive information including network architecture, security policies, and credentials.
A social engineering attack where victims are tricked into granting malicious applications OAuth permissions, giving attackers persistent access to their accounts.
A PowerShell operating mode that restricts access to sensitive language features such as arbitrary .NET type instantiation and Win32 API calls, blocking common in-memory attack tradecraft while allowing most legitimate administrative scripting to continue.
An HTTP response header (or meta tag) that tells the browser which origins may supply scripts, styles and other resources for a page, with optional violation reporting. CSP restricts where code loads from; it cannot detect a script that was modified at an allowed origin.
A Microsoft security feature that enables near real-time token revocation and policy enforcement, reducing the window of exposure when user risk changes or sessions are terminated.
A security measure that restricts access to your credit report, preventing creditors from viewing it and effectively blocking the opening of new credit accounts in your name.
A service that pools cryptocurrency from multiple users and redistributes it to break the on-chain transaction trail, providing privacy but often used for money laundering.
A mathematical scheme that uses public key cryptography to verify the authenticity and integrity of digital data, ensuring the content has not been altered and was created by the claimed sender.
Unauthorized use of a compromised system's CPU or GPU to mine cryptocurrency for the attacker. Typically delivered by an automated dropper after an exploit, it is usually detected through sustained high CPU load rather than through data loss.
Protocol that automatically assigns IP addresses to devices on a network.
An attack technique that places a malicious DLL alongside a legitimate signed executable so the Windows loader resolves and loads the attacker's library instead of the real one, running malicious code under the trust of the signed program.
A network segment that sits between an internal network and the internet, hosting public-facing services while protecting the internal network from direct exposure.
The internet's phonebook—translates domain names (google.com) to IP addresses.
When your DNS queries bypass the VPN tunnel, potentially exposing your browsing activity.
The unauthorized transfer of data from a computer or network, often performed by attackers before deploying ransomware to enable double extortion.
Financial services built on blockchain technology that operate without traditional intermediaries like banks, using smart contracts to automate lending, trading, and other transactions.
Passwords, keys, or secrets that ship with software or are silently generated when an operator does not set them. Deployments that never replace these values are open to anyone who reads the documentation or derives the fallback — one of the oldest persistent authentication failure classes.
A security strategy using multiple layers of protection so that if one layer fails, other layers continue to provide security.
The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data.
An OAuth 2.0 flow designed for devices with limited input capabilities, where users authenticate on a separate device by entering a code displayed on the target device.
The state of a device meeting organizational security requirements such as encryption, up-to-date OS, and PIN configuration.
A MikroTik RouterOS feature that limits which functions a device may use and can inspect the configuration at boot. From RouterOS 7.23.4 it raises a flagged state on signs of unauthorized access, disabling suspect configuration and blocking new scheduler, proxy and tunnel entries until an administrator audits and clears it.
An Exchange ActiveSync technology that maintains a persistent HTTPS connection for real-time email delivery.