Reference
Showing 40 of 285 terms.
The practice of hiding data inside another file, such as embedding an executable payload within the pixel data of an image, so the malicious content moves as an ordinary file and evades inspection that looks for executable downloads.
A browser feature in which a script or stylesheet tag carries an integrity attribute holding a cryptographic hash of the expected file; the browser refuses to execute the resource if its hash does not match. It pins one exact version, so it breaks when the vendor updates the file.
A cyberattack that targets an organization by compromising a third-party vendor, supplier, or partner that has access to the target's systems or data.
A Cisco-originated protocol for device administration that authenticates engineers logging into network equipment and authorizes each command they run, with per-session accounting. It is typically served by the same policy server as RADIUS, making that server the authority over who can configure the network.
A minimal UDP-based file transfer protocol with no authentication or encryption, used for firmware and configuration transfers on network devices. Attackers abuse it as a second-stage download channel because embedded systems ship with a TFTP client and rarely block outbound use.
A temporary code generated by authenticator apps that changes every 30 seconds.
A physical social engineering technique where an unauthorized person follows an authorized individual into a restricted area, exploiting social courtesy.
A social-engineering attack in which a fake support interaction, such as a phony help-desk call, refund form, or Quick Assist request, tricks a victim into granting remote access or running attacker-supplied software. It is a common initial-access vector for remote-access tool abuse.
The property of a multi-tenant SaaS platform that keeps each customer organization's data and sessions confined to that organization. An isolation failure, such as an SSO login being granted access to every organization a user belongs to, lets one tenant reach into another.
The potential security threats that arise from an organization's relationships with external vendors, suppliers, and partners who have access to systems or data.
A low-power mesh networking protocol designed for IoT devices, used alongside Matter.
Actual amount of data successfully transferred over a connection, often lower than bandwidth.
A class of race-condition flaw where a program validates a resource, then acts on it a moment later, and an attacker changes the resource in the gap between the two steps. Link-following privilege-escalation bugs such as CVE-2026-81963 exploit this window.
Security measures that bind OAuth tokens to specific devices or sessions, preventing stolen tokens from being replayed on attacker-controlled systems.
A security method requiring two different forms of verification to access an account.
A memory-safety bug (CWE-843) in which code accesses a resource using an incompatible type, such as reading a pointer as an integer. In JavaScript engines it typically arises when optimized code trusts an assumption about an object's shape that a callback has since invalidated, as in CVE-2026-85046.
Registering domain names that closely resemble legitimate ones, relying on misspellings or visual similarity to deceive victims or evade scrutiny. Beyond phishing, attackers use typosquatted infrastructure for command-and-control, as StyleSmuggler did with fake time-service domains like time.microsft.run.
A technique that circumvents Windows User Account Control, the prompt that asks a user to approve elevated actions, so that code can gain administrative privileges without the expected consent dialog. Malware loaders often attempt a UAC bypass to escalate from a user-level foothold.
Allows devices to automatically configure port forwarding—convenient but a security risk.
A centralized logging system in Microsoft 365 that records user and admin activities across Exchange, SharePoint, Teams, and other services for security monitoring and compliance.
A memory-safety bug in which a program keeps using a pointer to memory that has already been released. In the kernel, a use-after-free is a common starting point for privilege-escalation exploits because the freed memory can be reclaimed with attacker-controlled data.
A logical network segment that separates devices even when physically connected to the same network.
The clustered file system VMware ESXi uses to store virtual machine files, such as .vmdk virtual disks, on shared datastores. Because many virtual machines' disks live on one datastore, an attacker with host access can encrypt or destroy them all at the storage layer at once.
A service that encrypts your internet connection and masks your IP address by routing traffic through secure servers.
Voice phishing—a social engineering attack conducted via phone calls where attackers impersonate trusted entities to extract sensitive information or payments.
A per-project or per-group setting on platforms like GitLab that controls who can see it: public (anyone, including anonymous users), internal (any signed-in user), or private (explicit members only). Public projects expose API endpoints to unauthenticated callers.
A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm.
A Windows feature that enables running Linux distributions natively on Windows without traditional virtual machines or dual-boot setups.
A malicious script placed in a web server's content directory that lets an attacker execute commands through HTTP requests. Web shells are a common persistence mechanism after remote code execution and are detected by looking for unexpected files in webapp directories.
An HTTP extension that lets clients read, write, move, and delete files on a remote web server. File-sync and file-sharing platforms commonly expose a WebDAV API for programmatic file access.
Microsoft's control for embedding Chromium-based web content inside Windows applications. The Evergreen runtime updates alongside Microsoft Edge, while a Fixed Version runtime is bundled by the application vendor and receives Chromium security fixes only when the vendor ships a new package.
A highly targeted phishing attack aimed at senior executives or high-value targets, often involving significant research and sophisticated impersonation.
A modern, lightweight VPN protocol known for high speeds and strong security.
The coordination of multi-step processes across services, where an engine schedules tasks, handles retries and passes data between steps. Orchestration engines often sit at the center of an environment with broad reach, which makes a compromised one especially damaging.
A file or directory whose permission bits allow any user on the system to modify it. When a privileged process reads, executes, or trusts content at such a location, an unprivileged user can replace that content and run code with the process's privileges.
Malware that spreads on its own from one system to the next without a user launching it each time, typically by abusing a network service, shared credential, or trusted management channel. A worm's self-propagation is what makes containment, not cleanup, the first response priority.
A vulnerability that can be exploited to spread automatically from system to system without user interaction, similar to how biological worms spread.
Cryptocurrency tokens pegged 1:1 to another asset (like WETH for Ethereum) that enable the underlying asset to be used on different blockchains or in DeFi protocols.
The standard format for public-key certificates used by TLS, IPsec, and code signing. It binds a public key to an identity, is signed by a certificate authority, and is encoded in ASN.1, which is why parsing it safely is a recurring security problem.
An attack technique against XML-based protocols like SAML where attackers move a signed portion of a document while inserting malicious unsigned content, exploiting differences between signature verification and document processing.