Vulnerability Types

• A vulnerability is the weakness itself, not the attack on it
• Buffer overflow writes past a buffer into adjacent memory
• Memory injection writes attacker code into a running process
• A race condition / TOCTOU exploits the gap between check and use
• A malicious update rides in through the trusted patch channel
• OS-based weaknesses are unpatched flaws or insecure defaults
• SQLi runs server-side on the database; XSS runs in the victim's browser
• Parameterized queries are the primary SQLi defense
• Firmware flaws sit below the OS and survive a reinstall
• End-of-life means no future patches, so replace it
• Legacy systems you can't yet retire get isolated and compensated
• VM escape breaks guest isolation through to the hypervisor
• Resource reuse leaks residual data from unsanitized memory or storage
• Cloud-specific weaknesses usually land on the customer's side of the line
• Supply-chain flaws are inherited from a trusted vendor's product
• Cryptographic weakness: weak algorithm, key, or randomness
• Misconfiguration is a wrong setting, not a defect in the code
• Sideloading and jailbreaking both strip a mobile device's protections
• A zero-day has no patch or signature yet
• The deeper in the stack a flaw sits, the bigger its blast radius
• Match each vulnerability class to its owner and fix
• Container escape stems from the shared host kernel

Unlock with Premium — includes all practice exams and the complete study guide.