Dennis Academy

Simple explanation

A vulnerability is a weakness that COULD be exploited — distinct from a threat (who might exploit it) or a risk (the likelihood and impact if they do). This lesson catalogs where vulnerabilities tend to live: in applications, operating systems, hardware, virtualization, the cloud, the supply chain, cryptography, configuration, and mobile devices.

Technical explanation

Application vulnerabilities: memory injection (inserting malicious code into a running process's memory space), buffer overflow (writing more data than a buffer can hold, overwriting adjacent memory), race conditions — specifically TOCTOU (Time-Of-Check to Time-Of-Use: a value is checked, then changes before it's actually used, exploiting the gap), malicious update (a legitimate update mechanism delivering compromised code).
OS-based vulnerabilities: unpatched kernel flaws, insecure default configurations.
Web-based vulnerabilities: SQL injection (SQLi — malicious input alters a database query), Cross-Site Scripting (XSS — malicious script runs in another user's browser session).
Hardware vulnerabilities: firmware flaws, physical tampering, side-channel attacks (extracting secrets by observing physical characteristics like power draw or timing).
Virtualization vulnerabilities: VM escape (breaking out of a virtual machine to affect the host or other VMs), resource reuse (data leaking between VMs sharing physical hardware, if memory/storage isn't properly wiped between uses).
Cloud-specific vulnerabilities: misconfigured storage buckets, overly permissive IAM roles, shared responsibility gaps.
Supply chain vulnerabilities: service provider, hardware provider, or software provider compromise flowing downstream to every customer.
Cryptographic vulnerabilities: weak/deprecated algorithms (MD5, SHA-1, DES), improper key management.
Misconfiguration: default settings left in place, unnecessary services running, overly permissive access.
Mobile device vulnerabilities: side loading (installing apps outside the official app store, bypassing vetting), jailbreaking (removing manufacturer restrictions, disabling built-in security controls).
Zero-day: a vulnerability unknown to the vendor (no patch exists yet) — the most dangerous category simply because there's no fix available at time of exploitation.

Synonyms / related terms

| Term | Means | |---|---| | SQLi | SQL injection | | XSS | Cross-Site Scripting | | TOCTOU | Time-Of-Check to Time-Of-Use race condition | | 0-day | Zero-day |

Concept Check

"An attacker checks that a file isn't currently in use, and in the split second before the application actually opens it, swaps it for a malicious file. What vulnerability class is this?" Not a buffer overflow (no memory boundary was violated), not misconfiguration — this is a textbook race condition / TOCTOU: exploiting the gap between checking a condition and acting on it.

Interview-style Q&A

Q: Why is a zero-day considered more dangerous than a known, unpatched CVE? A: "With a known CVE, defenders at least have the option to patch, apply a compensating control, or watch for known indicators. A zero-day means the vendor doesn't even know the flaw exists yet — there's no patch to apply and often no signature to detect it by, so defense has to rely on more general behavioral monitoring rather than a specific fix."

Memory trick