Explain various types of vulnerabilities
Application, OS, web, hardware, cloud, virtualization, supply chain, cryptographic, and zero-day vulnerabilities.
- Reading time
- 26 min read
- Flashcards
- 18 cards
- Practice questions
- 10 questions · 2 PBQs
A long list of vulnerability types. Rather than memorising all of it flat, group by where the weakness lives — application, operating system, hardware, cloud, virtualisation, supply chain, cryptographic, or the user.
Application vulnerabilities
Memory injection
Writing data into a process's memory space to alter its behaviour.
Buffer overflow
Writing more data than a buffer holds, spilling into adjacent memory. Classically used to overwrite a return address and redirect execution.
Race condition
Behaviour depending on the timing of two operations. The exam's specific case is TOC/TOU — time-of-check to time-of-use, where something is validated and then changes before it is used.
Malicious update
An update that carries an attack. Links to the supply chain vector in 2.2.
Check yourself
A program checks that a file is owned by the user, and then opens it. Between those two steps an attacker replaces the file with a symlink to a system file. What vulnerability class is this?
Web-based vulnerabilities
Two the exam always covers:
SQL injection (SQLi)
- Untrusted input becomes part of a database query
- Attacks the SERVER and its data
- Fix: parameterised queries
Cross-site scripting (XSS)
- Untrusted input becomes script in a page
- Attacks OTHER USERS of the site
- Fix: output encoding, CSP, HttpOnly cookies
The tellSQLi steals the database. XSS steals from the visitor. Both come from trusting input, but they hit different victims.
Operating system vulnerabilities
Flaws in the OS itself. The recurring theme is unpatched and end-of-life systems — no patch exists, so the vulnerability is permanent.
Hardware vulnerabilities
Firmware
Software embedded in hardware. Rarely updated, often forgotten, and it sits below the operating system, so compromise there survives a reinstall.
End-of-life / legacy
No longer sold or no longer supported. Same permanent-vulnerability problem, in physical form.
Virtualisation vulnerabilities
VM escape
Breaking out of a virtual machine to reach the hypervisor or other VMs. The most serious virtualisation flaw, because isolation between tenants is the entire security promise.
Resource reuse
Memory or storage released by one VM being allocated to another without being cleared, exposing residual data.
Cloud-specific vulnerabilities
Misconfiguration dominates — publicly readable storage buckets, over-permissive IAM roles, unrestricted security groups. The systems are rarely broken; they are usually configured wrongly.
Supply chain vulnerabilities
Service providers, hardware providers and software providers — the same three routes as 2.2, viewed as weaknesses rather than as vectors.
Cryptographic vulnerabilities
Weak or outdated algorithms (MD5, SHA-1, DES, WEP), poor key management, insufficient key length, and improper implementation. Cross-reference 1.4 — the reflex wrong answers there are the vulnerabilities here.
Misconfiguration
The most common cause of real breaches, and it appears everywhere: default credentials, unnecessary open ports, permissions granted too broadly, logging disabled, security features left off.
Mobile device vulnerabilities
Jailbreaking / rooting
Removing manufacturer restrictions. It disables the platform's security model, so app sandboxing and update integrity no longer hold.
Sideloading
Installing apps from outside the official store, bypassing whatever vetting the store performs.
Zero-day
A vulnerability unknown to the vendor, so no patch exists and signature-based detection has nothing to match.
Check yourself
A vulnerability is being actively exploited and the vendor has not yet released a patch. Which control is most likely to detect the exploitation?