Tech Glossary — Page 6

A long-lived credential used to obtain new access tokens without requiring the user to re-authenticate, enabling persistent application access.

Malware that gives an attacker persistent, interactive control of a compromised host, typically including a shell, file transfer, and network tunneling. RATs on network appliances often harvest and decrypt the device's stored credentials.

An MDM capability that allows administrators to erase data from a lost or stolen mobile device remotely.

The sandboxed browser process that parses HTML, runs page JavaScript and paints content. It has no direct file, network or process-creation rights and reaches them only through IPC to the browser process, so code execution inside it is contained until an attacker also escapes the sandbox.

An exploitation technique that chains together small fragments of a program's existing code, called gadgets, to perform arbitrary actions. It sidesteps protections that block injected shellcode by reusing code the program already contains.

A server that sits in front of one or more backend services, terminating client connections and forwarding requests to the backend. It is the standard place to add authentication, TLS and access control to a service that lacks its own, without modifying the application.

A remote-access technique where a compromised host initiates an outbound connection back to the attacker and hands over a command shell. Because the connection originates inside the network, it often slips past firewalls that block inbound traffic.

A connection initiated from inside a network outward to an attacker-controlled server, allowing that server to route traffic back through the compromised host to reach internal systems. Because the connection originates internally, it evades controls focused on inbound traffic.

A device that directs data packets between your local network and the internet.

An XML-based open standard for exchanging authentication and authorization data between an identity provider and a service provider, enabling single sign-on (SSO) across different systems.

An XML document issued by an identity provider containing statements about a user's identity, attributes, and authentication status, used to grant access to service providers in SSO systems.

A protocol for monitoring and managing network devices and services. Agents expose status data and can send notifications (traps) to a management system. SNMP integrations in application servers are frequently optional components that process untrusted data.

A vulnerability where untrusted input is concatenated into a database query so an attacker can alter what the query does. Consequences range from reading or modifying data to executing operating-system commands when the database engine runs with high privilege and exposes file or program features.

A protocol for secure remote login and command execution over an untrusted network. It is layered: a transport layer sets up encryption and host-key verification, an authentication service proves the user's identity, and only then does a connection service open channels for commands and file transfer.

Key re-exchange, a normal SSH feature that lets either side refresh the session's encryption keys mid-connection without disconnecting. Because it is a transport-level operation that can occur during authentication, flawed state handling around a rekey can let an attacker reach the post-authentication phase early, as in CVE-2026-67279.

Cryptographic protocols that secure data transmitted between your browser and websites (the lock icon in HTTPS).

An authentication method that allows users to log in once with a single set of credentials and gain access to multiple related but independent software systems without re-authenticating.

A second-stage exploit that breaks out of a restricted process, such as a browser renderer, into the more privileged browser process or the operating system. In-the-wild browser attacks usually chain a JavaScript-engine bug with a sandbox escape, which is why a renderer-only bug is rated as scope unchanged in CVSS.

An appliance or hosted service that sits in the inbound and outbound mail path to filter spam, malware, and policy violations. Because it must accept and parse SMTP traffic from any sender on the internet, its parsing code is unauthenticated attack surface by design.

A set of basic identity security settings in Microsoft Entra ID that enable MFA, block legacy authentication, and protect privileged accounts—recommended for organizations without premium licenses.

Cisco's qualitative severity label for a vulnerability, ranging from Low to Critical, assigned alongside the numeric CVSS score. A flaw can carry a modest CVSS score yet a high SIR when it chains readily with other bugs to cause greater harm.

A physical hardware device used for authentication, providing stronger protection than SMS or app-based 2FA.

A vulnerability in which an attacker makes a server send requests to destinations of the attacker's choosing, borrowing the server's network position to reach internal or loopback-only services that are not directly exposed. Classified as CWE-918; the entry point of both 2026 SonicWall SMA1000 zero-day chains.

A vulnerability in which attacker-controlled input reaches a template engine as template syntax rather than as a bound value, letting the attacker write expressions the engine evaluates. Because template engines can reach runtime objects, SSTI commonly escalates to remote code execution, as in the 2026 StyleSmuggler attacks on Magento.

A non-human operating system or application account under which a service runs. Its permissions define the blast radius of any exploit against that service, since attacker code executes with the service account's access to files, secrets, and the network.

In federated authentication, an application or service that relies on an identity provider to authenticate users rather than managing credentials directly, accepting SAML assertions or other tokens as proof of identity.

An attack where the attacker knows or sets a victim's session identifier in advance, then rides that session to gain access once it becomes privileged. It works when a program uses predictable session IDs or fails to regenerate them after login.

An attack where an adversary takes over a legitimate user session by stealing or predicting session tokens, gaining unauthorized access to systems or data.

An executable with the set-user-ID bit, which runs with the privileges of the file's owner (often root) rather than the user who launched it. Setuid programs are a classic target for privilege escalation because any input they trust becomes a path to elevated code execution.

A URL that carries a cryptographic signature over its parameters, granting the holder a specific, time-limited action without a login session. The server recomputes the signature to verify the request is authentic and unmodified.

A mechanism using proxy patterns that allows the logic of a deployed smart contract to be modified while preserving its address, storage, and assets.

A mid-tier network switch that offers a web management interface, VLANs, SNMP and admin credentials without the full CLI and support ecosystem of enterprise gear. Common in small offices and branch sites, where its management plane is often exposed and its firmware rarely updated.

SMS phishing—a social engineering attack using text messages to trick recipients into clicking malicious links or providing personal information.

The psychological manipulation of people into performing actions or divulging confidential information, exploiting human trust rather than technical vulnerabilities.

A formal, machine-readable inventory of the components and dependencies that make up a piece of software or a deployed system. An accurate SBOM lets an organization quickly answer whether it runs an affected component when a vulnerability is disclosed.

A targeted phishing attack directed at specific individuals or organizations, using personalized information to appear more legitimate and increase success rates.

A VPN feature allowing some traffic through the VPN while other traffic uses your regular connection.

A memory-safety bug where input larger than a fixed-size buffer on the call stack overwrites adjacent stack data, including saved return addresses. Attackers use it to redirect execution and run arbitrary code, often without authentication when it sits in a request parser.

A malware analysis technique that examines code without executing it, using disassemblers and decompilers to understand program behavior and identify threats.

A username and password baked into software and identical on every installation, also called hardcoded credentials. Because the secret is the same everywhere, once it leaks it works against every device, and no customer-side password policy can mitigate it.