Web/App Based Vulnerabilities Definitions

SQL Injection (SQLi)

• Injecting SQL commands into queries via user input.

• A method to optimize SQL queries for performance.

• A technique to secure databases from unauthorized access.

• A process of converting SQL queries into NoSQL format.

Resource Reuse

• Using leftover memory/data that wasn't cleared between users.

• Allocating new memory for each user session.

• Clearing all memory after each user session.

• Using shared resources without any restrictions.

Misconfiguration

• Weak or insecure default settings in software.

• Strong security protocols implemented in software.

• Regular updates and patches applied to software.

• Comprehensive user training on software usage.

Directory Traversal

• Accessing files/folders outside the web root.

• Accessing files within the web root only.

• Accessing files in the system's temporary directory.

• Accessing files through a secure connection.

Replay Attack

• Reusing valid data (like login tokens) to repeat actions.

• A method to enhance data encryption.

• A technique to bypass firewalls.

• A strategy for improving network speed.

Cross-site Scripting (XSS)

• Injecting scripts into websites that run in others' browsers.

• A method to secure websites from attacks.

• A technique for optimizing website performance.

• A type of web design framework.

VM Escape

• Accessing the virtual machine from the host.

• Breaking out of a virtual machine to access the host.

• Creating a new virtual machine on the host.

• Transferring files between virtual machines.

Cross-site Request Forgery (CSRF/XSRF)

• Trick a logged-in user into submitting a request.

• Prevent unauthorized access to user accounts.

• Encrypt user data during transmission.

• Authenticate users through a secure token.

Buffer Overflow

• Overflowing memory by writing more data than expected.

• A method to increase memory capacity.

• A technique to optimize data storage.

• A type of data encryption.

Privilege Escalation

• Gaining higher access rights than intended.

• Gaining lower access rights than intended.

• Accessing data without permission.

• Disabling security protocols.