Reference
Showing 40 of 508 terms.
An attack or fault that makes a system, service, or network unavailable to its intended users, typically by crashing a process, exhausting resources, or flooding it with traffic. Memory-corruption crashes rated as DoS can sometimes be developed into code execution.
A group of devices or users that receives a software update at a defined stage of a staged rollout, such as pilot, early adopters, then broad deployment. Rings limit the blast radius of a bad update but also lengthen the time the last ring stays exposed to a known vulnerability.
The process of converting stored or transmitted data back into an object. Insecure deserialization can allow attackers to execute code by manipulating serialized data.
An OAuth 2.0 flow designed for devices with limited input capabilities, where users authenticate on a separate device by entering a code displayed on the target device.
The state of a device meeting organizational security requirements such as encryption, up-to-date OS, and PIN configuration.
A MikroTik RouterOS feature that limits which functions a device may use and can inspect the configuration at boot. From RouterOS 7.23.4 it raises a flagged state on signs of unauthorized access, disabling suspect configuration and blocking new scheduler, proxy and tunnel entries until an administrator audits and clears it.
An Exchange ActiveSync technology that maintains a persistent HTTPS connection for real-time email delivery.
A ransomware model in which attackers steal data before encrypting systems, then demand payment both to restore access and to withhold publication of the stolen files on a leak site.
A double free is a memory bug where a program releases the same block of heap memory twice. It can corrupt the allocator's internal data and, with attacker-controlled input, lead to code execution.
Routing traffic through two VPN servers for an extra layer of encryption.
A data-driven model that estimates the probability a vulnerability will be exploited in the wild within the next 30 days, expressed as a percentage. EPSS complements CVSS severity by indicating likelihood of attack rather than potential impact.
VMware's bare-metal hypervisor, installed directly on server hardware to run virtual machines. Each ESXi host is administered through vCenter, and its management interface controls the host's accounts, storage, and the workloads it runs, which makes that interface high-value attack surface.
A network appliance that sits on the boundary between the internet and an internal network, such as a VPN gateway, firewall, or secure-access appliance. Edge devices are internet-facing, hold credentials, and broker connections inward, which makes them high-value and frequently repeated targets for zero-day exploitation.
Serverless code, such as a Cloudflare Worker, that runs on a CDN's edge network in front of the origin server and can inspect or rewrite requests and responses in flight. Because the origin is never modified, a malicious edge worker is invisible to origin-side integrity checks.
Restricting the outbound connections a system may make to an explicit list of required destinations, enforced at the network layer or through an egress proxy. It breaks payload downloads, mining-pool connections and callback channels, and turns an attacker's success signal into a detection event.
Encapsulating Security Payload is the IPsec protocol that encrypts and authenticates packet contents between two endpoints. On Linux it is provided by the esp4 and esp6 kernel modules.
The process of converting data into a coded format that can only be read with the correct decryption key.
End of maintenance is the point after which a vendor stops producing fixes for a software release, including security fixes. Devices on such a release should be treated as vulnerable to any later flaw.
Software that its vendor no longer supports with security updates. Vulnerabilities discovered after the end-of-life date are never patched, so running EOL software is a permanent and growing exposure.
Encryption where only the sender and recipient can read the message—not even the service provider.
An attack that discovers valid identifiers, accounts or records by submitting many candidate values to a service and observing which ones it confirms. Structured identifiers such as national ID numbers make the candidate space small enough to walk by script.
Envoy Proxy is an open source edge and service proxy used for load balancing, TLS termination and traffic filtering. It runs as the sidecar in service meshes such as Istio, so an Envoy fix must reach every sidecar.
A Microsoft synchronization protocol that enables mobile devices to access email, calendar, contacts, and tasks from an Exchange server over HTTPS.
Microsoft's cloud-based email and calendaring service, part of Microsoft 365, that hosts mailboxes in Microsoft's data centers.
A Microsoft API that lets applications read and send mail, calendar and contact data in Exchange and Microsoft 365. Attackers abuse it to harvest mailboxes programmatically using stolen credentials.
A PowerShell security feature that determines the conditions under which PowerShell loads configuration files and runs scripts, ranging from Restricted (no scripts) to Bypass (no restrictions).
Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access.
Two or more vulnerabilities used in sequence so that each one supplies the access the next one requires, for example an unauthenticated SSRF that reaches a command injection which alone would need administrator credentials. Chains let attackers turn moderate individual flaws into unauthenticated remote code execution.
Exploit Maturity is a CVSS 4.0 threat metric that records whether a vulnerability is being exploited. A value of Attacked means exploitation has been reported, which should outrank the base score in patch triage.
A Windows security feature that binds an authentication token to the TLS channel it was issued on, so a token replayed on a different channel is rejected. It is the primary defense against NTLM relay.
A design flaw in which a control that cannot complete its check grants access instead of denying it. In authentication, a missing key or failed lookup that results in access being allowed turns a security check into a rubber stamp.
Identifying a web application by computing a hash, commonly MurmurHash3, of its favicon image and matching it against known values. Used by asset-discovery tools to find instances of a product across a network or the internet.
The US Federal Risk and Authorization Management Program, a standardized process for assessing and authorizing cloud services used by federal agencies. Products or modules sold to FedRAMP-bound customers often serve a small, specialized user base, which can mean less real-world security scrutiny than a vendor's core offering.
Field-level authorization is an access control that decides whether a user may read or change an individual property of an object, such as its price, owner or status, after object access has been granted.
A control that records a trusted baseline of files and configuration, then detects any later change from it. Its value depends on storing the baseline and evidence somewhere the monitored system cannot silently alter, so findings remain trustworthy even if that system is compromised.
Security system that monitors and controls network traffic based on predetermined rules.
A firewall manager is a central platform that stores the configurations of many firewalls and pushes policy, firmware and settings to them, so it holds the credentials and keys for every device it manages.
Permanent software programmed into a device's hardware that controls its basic functions.
A firmware release train is a branch of a product's software, such as AOS-8.10, that a vendor maintains with its own patch builds for a set period. Moving between trains is a larger upgrade than patching within one.
Forceful browsing is an attack technique in which a client requests a route or resource directly instead of following the links an application offers, reaching functions that lack proper authorization checks.