Security knowledge base
Cybersecurity glossary.
Clear, practical definitions for the security concepts behind modern applications, internet-facing assets, vulnerabilities, domain protection, and continuous attack surface management.
618 terms
_
__Host- Cookie Prefix
The __Host- cookie prefix is a reserved cookie-name prefix that browsers accept only when the cookie is set with the Secure attribute, Path=/, and without a Domain attribute—binding the cookie tightly to the exact host that set it.
__Secure- Cookie Prefix
The __Secure- cookie prefix is a reserved cookie-name prefix that browsers accept only when the cookie is marked Secure and set from a secure context, ensuring cookies using that name cannot be established over insecure HTTP configurations.
A
A Record
An A record (Address record) is a DNS resource record that maps a domain name or hostname to one or more IPv4 addresses so clients know which host to contact.
AAAA Record
An AAAA record is a DNS resource record that maps a domain name or hostname to one or more IPv6 addresses so dual-stack and IPv6-only clients can reach the correct host.
Access Token
An access token is a credential issued by an authorization server that a client presents to a resource server to access protected APIs, conveying authorization context such as subject, scopes, and lifetime without exposing the resource owner’s primary password.
Account Enumeration
Account enumeration is a vulnerability pattern in which differences in application responses, timing, or behavior allow an attacker to determine whether a username, email, or other identifier is registered in the system.
Adaptive Authentication
Adaptive authentication is an identity approach that adjusts authentication requirements dynamically based on contextual risk signals—such as device, location, behavior, and threat intelligence—so low-risk access stays friction-light while high-risk access faces stronger verification.
Advanced Encryption Standard (AES)
The Advanced Encryption Standard (AES) is a symmetric block cipher standardized by NIST that encrypts 128-bit blocks with 128-, 192-, or 256-bit keys and underpins most modern disk, database, and TLS record encryption.
Agentic AI Security
Agentic AI security is the practice of protecting systems in which models plan, remember, and act through tools over multiple steps. It covers identity, authorization, untrusted observations, tool integrity, human approval, and monitoring—because a hijacked or mistaken agent can change tickets, code, money, or infrastructure, not only text.
AI Supply Chain
The AI supply chain is the set of upstream artifacts and services an AI system depends on—base models, fine-tunes, datasets, embeddings, prompts, evaluation harnesses, MCP servers, and vendors—so a compromise or substitution in any of those inputs can alter behavior, leak data, or insert a backdoor.
Alert Fatigue
Alert fatigue is the degradation of human detection performance that occurs when analysts are flooded with low-value, redundant, or poorly explained alerts—leading to slower triage, skipped investigations, and a higher chance that a true incident is dismissed.
Anomaly Detection
Anomaly detection is the practice of identifying activity that deviates from an established baseline of normal behavior—across users, hosts, networks, or applications—so defenders can investigate potentially malicious or erroneous events that no static signature described in advance.
Anycast DNS
Anycast DNS is a network design in which multiple DNS servers in different locations advertise the same service IP address, allowing internet routing to send each query toward an available route selected by the network.
API abuse
API abuse is the use of an application programming interface in a harmful, unauthorized, or unintended way, often by automating legitimate functions, misusing valid credentials, or exploiting gaps in business rules, access controls, and resource limits.
API Deprecation
API deprecation is the controlled process of marking an API, endpoint, or version as scheduled for retirement—communicating timelines to consumers, supporting migration, and ultimately disabling the old interface so it no longer remains reachable attack surface.
API Discovery
API discovery is the process of identifying APIs and endpoints across an organization—using source code, gateway configurations, client artifacts, cloud inventories, and runtime traffic—so security and platform teams can build an accurate catalog of exposure.
API Endpoint
An API endpoint is a specific addressable operation in an application programming interface—typically an HTTP URI combined with a method such as GET or POST, or a GraphQL field/RPC procedure—that clients call to retrieve or change data under the server’s authentication and authorization rules.
API Enumeration
API enumeration is the systematic probing of an application programming interface to identify valid endpoints, parameters, object identifiers, error behaviors, and access boundaries—reconnaissance that maps the attack surface before targeted exploitation.
API Gateway
An API gateway is an entry-point service that sits in front of backend APIs to handle cross-cutting concerns such as routing, authentication and authorization checks, rate limiting, TLS termination, request transformation, and centralized telemetry for client traffic.
API Key
An API key is a secret identifier issued to a client application so a service can recognize the caller, apply quotas or permissions, and attribute usage—commonly sent in a header or query parameter and treated as a long-lived credential that must be protected like a password.
API Rate-Limit Bypass
API rate-limit bypass is any technique that lets a client exceed intended request or cost quotas—by rotating identities, spoofing headers, distributing load, abusing batching, or exploiting misconfigured limiters—so brute force, scraping, or resource exhaustion continues despite rate limiting.
API Response Filtering
API response filtering is the server-side practice of shaping outbound API payloads so each caller receives only the fields and nested objects they are authorized and intended to see—enforcing least privilege on responses rather than relying on clients to ignore sensitive data.
API Schema
An API schema is a machine-readable description of an API’s contract—endpoints, parameters, authentication, and request/response data shapes—used to document, generate clients, validate traffic, and test that implementations match the intended interface.
API Security Testing
API security testing is the practice of assessing application programming interfaces for authentication, authorization, validation, business-logic, and abuse weaknesses—using automated scanners, fuzzers, and manual techniques mapped to the real endpoint inventory.
API Versioning
API versioning is the practice of explicitly evolving an API contract across incompatible or significant changes so clients can adopt new behavior on a controlled timeline while older versions remain supported, monitored, and eventually retired.
Application Layer
The application layer is the top layer of the OSI and Internet protocol models where end-user network services and protocols—such as HTTP, DNS, SMTP, and many APIs—define how applications exchange meaningful data over a network.
Application Security (AppSec)
Application Security (AppSec) is the discipline of building, verifying, and operating software so that security controls are designed into applications and their supporting pipelines—covering threat modeling, secure coding, testing, dependency hygiene, and runtime defenses across the software lifecycle.
Argon2
Argon2 is a memory-hard password-hashing and key-derivation function that won the Password Hashing Competition; its Argon2id variant is widely recommended for storing passwords because it resists both side-channel leakage patterns and massively parallel GPU/ASIC cracking.
Argument Injection
Argument Injection is a vulnerability in which untrusted input is passed as arguments to an external program or interpreter in a way that changes how that program parses its options—typically by injecting extra flags, option terminators, or unexpected positional values—without necessarily injecting a full shell command.
Artifact Signing
Artifact signing is the cryptographic signing of software supply chain outputs such as packages, container images, binaries, SBOMs, provenance, and attestations so consumers can verify origin and integrity.
Asymmetric Cryptography
Asymmetric cryptography (public-key cryptography) uses mathematically related key pairs—a public key that can be shared and a private key that must stay secret—to perform encryption, digital signatures, and authenticated key exchange without pre-sharing a single secret.
Attack Path
An attack path is a sequence of steps—techniques, trust relationships, misconfigurations, and vulnerabilities—that an adversary can follow from an initial foothold to a valuable objective such as domain admin, sensitive data, or destructive impact.
Attack Primitive
An attack primitive is a reusable, relatively atomic adversary capability—such as an information leak, write-what-where, credential dump, or token theft—that can be combined with other primitives to construct reliable exploits, privilege escalations, or broader attack paths.
Attack Surface
An attack surface is the complete set of points where an unauthorized actor can try to enter, alter, extract data from, or disrupt a system—including network services, APIs, identities, dependencies, devices, and human processes that can be abused.
Attack Vector
An attack vector is the path or method an adversary uses to gain unauthorized access to a system, network, or user—such as a phishing email, exposed service, malicious USB, or compromised dependency—through which payloads and follow-on actions can be delivered.
Attribute-Based Access Control (ABAC)
Attribute-Based Access Control (ABAC) is an authorization model that grants or denies access by evaluating attributes of the requester, the resource, the action, and the surrounding environment against machine-enforceable policies.
Audience Claim (aud)
The audience claim (aud) is a registered JWT claim that identifies the recipients—usually resource servers or APIs—for which the token is intended; verifiers must reject tokens whose audience does not include their own identifier.
Audit Log
An audit log is a time-ordered, attributable record of security-relevant actions—who did what, to which object, with what outcome—designed for investigation, accountability, and compliance rather than routine troubleshooting.
Authenticated Encryption with Associated Data (AEAD)
Authenticated Encryption with Associated Data (AEAD) is a cryptographic construction that provides confidentiality for plaintext and integrity for both the ciphertext and additional associated data, typically returning an authentication tag that must verify before decryption succeeds.
Authentication
Authentication is the process of verifying that a claimed identity is genuine by validating one or more authenticators—such as passwords, cryptographic keys, biometrics, or federation assertions—before granting a session or access token.
Authentication Failures
Authentication Failures is an OWASP Top 10 category (A07:2021 Identification and Authentication Failures) covering weaknesses in proving and maintaining user identity—weak passwords, credential stuffing exposure, broken session handling, missing MFA, and related flaws that enable account takeover.
Authentication, Authorization and Accounting (AAA)
Authentication, Authorization and Accounting (AAA) is a security framework that verifies identity, decides what that identity may access, and records activity for audit, billing, or compliance—commonly used in network access control and broader identity systems.
Authoritative DNS Server
An authoritative DNS server is a name server that holds and serves the official DNS data for one or more zones, answering queries with records it is configured to publish rather than by recursively discovering answers elsewhere.
Authorization
Authorization is the process of deciding whether an authenticated (or anonymous) subject is allowed to perform a specific action on a resource, based on policies, roles, attributes, ownership, or other access-control rules.
Authorization Code
An authorization code is a short-lived, one-time credential issued by an OAuth 2.0 authorization server to a client after a resource owner grants consent; the client redeems it at the token endpoint for access tokens (and optionally refresh or ID tokens).
Automated Certificate Management Environment (ACME)
Automated Certificate Management Environment (ACME) is a protocol for automating certificate issuance and renewal—popularized by Let’s Encrypt—where a client proves control of identifiers such as domain names to a CA and receives X.509 certificates without manual CSR ticket workflows.
B
Backend
A backend is the server-side part of a software system that implements business logic, data storage, authentication, and APIs—typically unseen by end users except through the responses it returns to clients.
bcrypt
bcrypt is an adaptive password-hashing function based on the Blowfish cipher that stores a salt and work factor with each hash so password verification can become slower as hardware improves.
Bearer Token
A bearer token is an access credential that grants authority to any party who possesses it; the resource server typically does not require additional cryptographic proof that the presenter is the legitimate client that received the token.
BEAST (CVE-2011-3389)
BEAST (Browser Exploit Against SSL/TLS), tracked as CVE-2011-3389, is a practical chosen-plaintext attack against TLS 1.0 and earlier when using CBC-mode ciphers, exploiting predictable initialization vectors to decrypt HTTPS traffic byte by byte.
Biometric Authentication
Biometric authentication verifies identity by measuring biological or behavioral traits—such as fingerprints, face geometry, iris patterns, or voice—and comparing them to enrolled templates instead of relying only on passwords or possession factors.
Birthday Attack
A birthday attack is a cryptographic technique that finds collisions in a hash function or related structure by exploiting the birthday paradox: after roughly 2^(n/2) random inputs for an n-bit output, the probability of two inputs sharing the same digest becomes significant, which can undermine integrity, uniqueness, or signature schemes that assume collision resistance.
Bitsquatting
Bitsquatting is a domain-abuse technique in which an attacker registers names that differ from a trusted target by a single bit so that hardware or transmission errors can redirect traffic to the attacker without any human typo.
Black-Box Testing
Black-box testing is an evaluation approach where testers assess a system without internal knowledge of its implementation—no source code, architecture diagrams, or privileged design docs—simulating an external attacker who sees only exposed interfaces and public information.
Bleichenbacher Attack
The Bleichenbacher attack is an adaptive chosen-ciphertext attack against RSA encryption that uses PKCS#1 v1.5 padding: by observing whether a decrypting party accepts crafted ciphertexts as correctly padded, an attacker can iteratively recover plaintexts such as TLS premaster secrets—or otherwise abuse the RSA private key’s decrypt operation.
Blind SQL Injection
Blind SQL injection is a SQL injection technique in which the application does not return query results or database errors in the response, so attackers infer data by observing true/false behavior, timing differences, or other side channels.
Blue Team
A blue team is the defensive security function responsible for protecting an organization by monitoring for threats, detecting intrusions, responding to incidents, and continuously hardening controls based on telemetry, intelligence, and exercise lessons.
Brand Indicators for Message Identification (BIMI)
Brand Indicators for Message Identification (BIMI) is a standard that lets a domain publish branding information, typically including a logo reference, so supporting mailbox providers can display a visual brand indicator for authenticated email.
BREACH
BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) is a practical side-channel attack that recovers secrets reflected in HTTP responses by combining attacker-controlled input with server-side compression and observing the resulting TLS ciphertext lengths—without breaking the TLS encryption itself.
Broken Access Control
Broken Access Control is an OWASP Top 10 category (A01:2021) covering failures that let users act outside their intended permissions—viewing or changing other users’ data, elevating privileges, or invoking admin functions without proper authorization checks.
Broken Authentication
Broken authentication is a class of security weaknesses in which flaws in login, session handling, credential recovery, or authenticator lifecycle allow attackers to impersonate users or bypass identity checks.
Broken Function-Level Authorization (BFLA)
Broken Function-Level Authorization (BFLA) is an API security weakness where the server fails to enforce whether the authenticated caller is allowed to invoke a specific function or endpoint—such as admin, moderation, or batch operations—allowing horizontal or vertical privilege escalation through otherwise valid requests.
Broken Object Property-Level Authorization (BOPLA)
Broken Object Property-Level Authorization (BOPLA) is an API weakness where the server fails to enforce which object properties a caller may read or write—leading to overshared responses, unauthorized field updates such as role flags, or both.
Broken Object-Level Authorization (BOLA)
Broken Object-Level Authorization (BOLA) is an API vulnerability where the server fails to verify that the authenticated caller is allowed to access or modify a specific object referenced by an identifier—enabling attackers to read or change other users’ resources by substituting object IDs.
Browser Fingerprinting
Browser fingerprinting is the practice of collecting many device and browser attributes—such as user agent, fonts, canvas rendering, timezone, and hardware hints—and combining them into an identifier that can recognize a client over time, often without relying on stored cookies.
Brute-Force Attack
A brute-force attack is a trial-and-error method in which an attacker systematically tries many candidate secrets—such as passwords, PINs, one-time codes, or cryptographic keys—until the correct value is found or the attempt space is exhausted.
Buffer Overflow
A buffer overflow is a memory safety flaw in which a program writes more data into a fixed-size buffer than the buffer can hold, overwriting adjacent memory and potentially corrupting data, control flow, or security-critical state.
Bug Bounty
A bug bounty is a program in which an organization invites independent security researchers to find and report vulnerabilities in defined assets—usually in exchange for recognition or monetary rewards scaled to impact—under published rules of engagement.
Build Pipeline
A build pipeline is an automated sequence of steps that transforms source code and dependencies into verified artifacts—typically compiling or packaging, running tests, applying security checks, and publishing outputs for deployment.
Build Provenance
Build provenance is verifiable metadata that describes how a software artifact was produced, including source inputs, builder identity, build steps, parameters, and the artifact digest.
Business Email Compromise (BEC)
Business email compromise (BEC) is a targeted social-engineering attack in which adversaries impersonate executives, vendors, attorneys, or employees—often through spoofed, lookalike, or already-compromised mailboxes—to trick staff into sending money, changing payment details, or releasing sensitive business data.
Business Logic Flaws
Business logic flaws are security weaknesses that arise when an application’s workflows, rules, or state transitions can be misused in unintended ways—even if individual inputs are syntactically valid and no classic injection bug is present.
C
CAA Record
A CAA (Certification Authority Authorization) record is a DNS resource record that declares which certificate authorities are permitted to issue TLS certificates for a domain, helping reduce unauthorized issuance.
Cache Key
A cache key is the identifier an HTTP cache uses to decide whether a stored response matches a new request, typically derived from the request method, target URI, and selected headers named in Vary, so that different representations are not served from the same slot.
Cache Poisoning
Cache poisoning is a class of attacks and failures where a cache stores a harmful, incorrect, or attacker-controlled entry under a key that honest clients later reuse, causing them to receive the wrong data without contacting the origin again.
Cache Revalidation
Cache revalidation is the process where an HTTP cache checks with the origin whether a stored response remains usable, typically by sending a conditional request with validators such as ETag or Last-Modified and receiving either a 304 Not Modified or a full replacement response.
Cache-Control
Cache-Control is an HTTP header that tells browsers, proxies, and CDNs whether a response may be stored, how long it may be reused, and under which privacy constraints, using directives such as max-age, no-store, private, and must-revalidate.
Canary Token
A canary token is a planted, uniquely identifiable decoy artifact—such as a fake credential, document, URL, or DNS name—that no legitimate workflow should use, so any access, authentication, or resolution becomes a high-fidelity alert.
CAPTCHA
CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge-response control that presents a task intended to be easy for humans and difficult for automated clients, helping reduce bot-driven abuse.
Certificate Authentication
Certificate authentication is an identity verification method in which a party proves possession of the private key corresponding to a trusted X.509 certificate, commonly used for mutual TLS (mTLS), device identity, and passwordless client access.
Certificate Authority (CA)
A Certificate Authority (CA) is a trusted entity that issues and digitally signs X.509 certificates, binding public keys to identities so relying parties can validate authenticity within a public key infrastructure (PKI).
Certificate Chain
A certificate chain is an ordered set of X.509 certificates that lets a relying party validate a presented certificate by following digital signatures from a leaf certificate, through one or more intermediate certificates, to a trusted root certificate.
Certificate Pinning
Certificate pinning is a client-side TLS control that restricts which certificate, public key, or issuing key material a client will accept for a service, reducing reliance on the full public CA ecosystem but adding serious operational risk if pins are wrong or cannot rotate.
Certificate Revocation (CRL/OCSP)
Certificate revocation is the process of invalidating an issued X.509 certificate before its expiration date, commonly communicated to relying parties through Certificate Revocation Lists (CRLs) and the Online Certificate Status Protocol (OCSP).
Certificate Signing Request (CSR)
A Certificate Signing Request (CSR) is a signed message that contains a public key and identity fields, sent to a Certificate Authority so the CA can validate the applicant and issue an X.509 certificate for that key.
Certificate Transparency
Certificate Transparency (CT) is an open framework of append-only public logs that record issued TLS certificates, enabling domain owners and the ecosystem to detect mis-issuance and improve accountability of publicly trusted Certificate Authorities.
ChaCha20-Poly1305
ChaCha20-Poly1305 is an authenticated encryption with associated data (AEAD) algorithm that encrypts plaintext with the ChaCha20 stream cipher and authenticates the ciphertext and associated data with a one-time Poly1305 message authentication code.
CI/CD Pipeline
A CI/CD pipeline is an automated workflow that continuously integrates code changes, verifies them with tests and checks, and delivers or deploys approved artifacts to target environments with minimal manual release friction.
Cipher Suite
A cipher suite is a named set of cryptographic algorithms a TLS client and server negotiate for a connection; in TLS 1.2 and earlier it commonly identifies key exchange, authentication, bulk encryption, and message authentication choices, while TLS 1.3 reduces the suite name to the AEAD cipher and hash.
Claim
In identity and access security, a claim is an assertion made by an identity provider or authorization server about a subject—such as an identifier, role, group membership, or authentication strength—that relying parties may use after validating the issuer and integrity of the assertion.
Clickjacking
Clickjacking is a UI redressing attack in which an adversary overlays or embeds a legitimate page so that a victim’s clicks or taps are hijacked to perform unintended actions on a trusted site while the user believes they are interacting with something else.
Client Credentials Grant
The client credentials grant is an OAuth 2.0 flow in which a confidential client authenticates to the authorization server with its own credentials and receives an access token for resources it controls or is permitted to access—without a human resource-owner login.
Client-Side Prototype Pollution
Client-Side Prototype Pollution is a browser JavaScript vulnerability in which untrusted input (URL parameters, JSON, postMessage data, or stored state) modifies Object.prototype so that client-side gadgets inherit attacker-controlled properties, often escalating to DOM-based XSS or unauthorized UI privileges.
Cloud IAM
Cloud IAM is the identity and authorization control plane of a public cloud: principals (users, groups, roles, and workloads) are authenticated, then evaluated against identity-based and resource-based policies that decide which APIs and data they may use.
Cloud Misconfiguration
Cloud misconfiguration is an insecure, incomplete, or drifted setting in a cloud control plane—identity policies, storage ACLs, network exposure, encryption, logging, or tenant isolation—that leaves resources reachable or over-privileged without requiring a software exploit.
Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) is the continuous discovery, assessment, and prioritization of cloud configuration risk—identities, networks, storage, encryption, and logging—against policy baselines so teams can close misconfigurations before they are exploited.
CNAME Record
A CNAME (Canonical Name) record is a DNS resource record that aliases one hostname to another canonical hostname, so clients follow the alias chain to reach the final address or service data.
Code Injection
Code Injection is a vulnerability in which untrusted input is interpreted or compiled as executable application code—via eval, dynamic imports, template engines, expression languages, or similar mechanisms—allowing attackers to run logic with the privileges of the hosting process.
Code Review
Code review is a quality and security practice where peers examine proposed changes before merge—assessing correctness, maintainability, and abuse potential so defects are fixed while context is fresh and blast radius is small.
Code Signing
Code signing is the cryptographic practice of attaching a digital signature to software so verifiers can confirm the artifact came from an expected publisher and was not altered after signing.
Combosquatting
Combosquatting is the registration of a domain that combines a trusted brand or keyword with additional words such as login, support, billing, or secure in order to create a convincing but fraudulent domain name.
Command Injection
Command Injection is a vulnerability in which untrusted input is incorporated into an operating-system command or shell invocation so that attackers can alter command structure—running additional commands, changing pipelines, or abusing shell metacharacters with the privileges of the application process.
Common Name (CN)
The Common Name (CN) is an X.509 distinguished-name attribute historically used to identify the certificate subject—often a hostname for TLS—but modern public TLS validation relies on the Subject Alternative Name (SAN) extension rather than CN alone.
Common Vulnerabilities and Exposures (CVE)
Common Vulnerabilities and Exposures (CVE) is a public catalog of uniquely numbered security flaws. Each CVE ID (for example CVE-2024-12345) identifies one distinct vulnerability so vendors, scanners, and defenders can refer to the same issue without ambiguity.
Common Vulnerability Scoring System (CVSS)
The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities as numeric scores and vector strings, typically published with CVE records so organizations can compare relative severity in a consistent way.
Common Weakness Enumeration (CWE)
Common Weakness Enumeration (CWE) is a community-developed catalog of software and hardware weakness types—reusable categories such as SQL injection or buffer overflow—that explain *why* vulnerabilities happen, independent of any single product instance.
Compensating Control
A compensating control is an alternate security safeguard put in place when a primary required control cannot be implemented as specified—providing comparable risk reduction through different technical, physical, or procedural means, usually with formal documentation and review.
Conditional Request
A conditional request is an HTTP request that includes preconditions in headers such as If-None-Match, If-Match, If-Modified-Since, or If-Unmodified-Since, so the server can return a short 304 or 412 response instead of a full body when the resource state does not meet the condition.
Container Escape
Container escape is a privilege-escalation path in which code running inside a container breaks the isolation boundary and executes, reads, or controls resources on the host—or on other containers sharing that host.
Container Image
A container image is an immutable, layered filesystem snapshot plus metadata (entrypoint, environment, user, architecture) that a runtime unpacks to create a container. It is identified by a content digest, not by a moving tag.
Container Image Scanning
Container image scanning is the automated inspection of image layers, package inventories, and sometimes file contents to detect known vulnerabilities, malware, secrets, and policy violations before or after an image is deployed.
Container Runtime
A container runtime is the node software that pulls images, creates isolated processes (namespaces, cgroups, filesystems), and starts containers on behalf of an orchestrator—typically through the Kubernetes Container Runtime Interface (CRI).
Content Delivery Network (CDN)
A Content Delivery Network (CDN) is a geographically distributed set of edge servers that cache and serve web content closer to users, reducing latency and origin load while often providing TLS termination, traffic filtering, and availability controls.
Content Negotiation
Content negotiation is the process where a server chooses among multiple representations of the same resource—such as JSON versus HTML, gzip versus identity, or different languages—based on request headers like Accept, Accept-Language, and Accept-Encoding, optionally advertising choices via Alternates.
Content Security Policy (CSP)
Content Security Policy (CSP) is an HTTP response security mechanism that tells browsers which sources of scripts, styles, images, frames, and other content are allowed to load or execute for a page, reducing the impact of injection attacks such as cross-site scripting.
Cookie
A cookie is a small piece of data that a website asks a browser to store and then automatically include on later requests to matching URLs, enabling session continuity, preferences, and other stateful behavior across otherwise stateless HTTP interactions.
Cookie Bomb
A cookie bomb is an attack or failure mode in which an attacker causes a browser to store excessively large or numerous cookies for a site so that subsequent requests become too large for servers, proxies, or application parsers—often resulting in errors, lockouts, or denial of service for the victim.
Cookie Prefix
A cookie prefix is a special name prefix—most notably __Host- and __Secure-—that browsers enforce with extra security requirements when a cookie is set, rejecting the cookie if mandatory attributes such as Secure or a strict Path/Domain combination are missing.
Cookie Tossing
Cookie tossing is an attack technique in which an adversary sets or overwrites cookies for a target site from a related context—often a sibling subdomain or parent domain they control—so the victim application receives attacker-controlled cookie values it may trust.
Coordinated Vulnerability Disclosure (CVD)
Coordinated Vulnerability Disclosure (CVD) is a process where security researchers and vendors share vulnerability details privately long enough to develop and distribute fixes—then disclose publicly in a way that minimizes user harm while enabling defensive action.
Credential Stuffing
Credential stuffing is an automated attack in which adversaries test large lists of stolen username and password pairs against login endpoints, exploiting password reuse to take over accounts that share credentials with breached services.
CRIME
CRIME (Compression Ratio Info-leak Made Easy) is a compression side-channel attack against HTTPS that recovers secret values such as session cookies by injecting attacker-controlled data into requests that are compressed together with those secrets, then observing resulting TLS ciphertext lengths.
CRLF Injection
CRLF Injection is a vulnerability in which untrusted input containing carriage return (CR, \r) and/or line feed (LF, \n) characters is written into structured text protocols or logs, allowing attackers to insert new lines, forge headers, split responses, or manipulate downstream parsers.
Cross-Origin Embedder Policy (COEP)
Cross-Origin Embedder Policy (COEP) is an HTTP response header that instructs the browser to block the page from loading cross-origin resources unless those resources explicitly opt in via CORS or Cross-Origin-Resource-Policy, enabling stronger cross-origin isolation.
Cross-Origin Information Leak
A cross-origin information leak is any unintended disclosure of data about one origin’s content or user state to a different origin—often through side channels such as timing, error behavior, frame load outcomes, or other browser APIs—rather than through a direct same-origin read.
Cross-Origin Isolation
Cross-origin isolation is a browser security state where a document runs in a separate process-like boundary from untrusted origins, achieved when Cross-Origin Opener Policy and Cross-Origin Embedder Policy are enforced together, exposing window.crossOriginIsolated and unlocking gated APIs.
Cross-Origin Opener Policy (COOP)
Cross-Origin Opener Policy (COOP) is an HTTP response header that controls whether a document can share a browsing context group with cross-origin opener windows, helping isolate pages from untrusted openers and enabling cross-origin isolation with COEP.
Cross-Origin Resource Policy (CORP)
Cross-Origin Resource Policy (CORP) is an HTTP response header that declares whether a resource may be loaded by documents from other origins, helping browsers block unintended cross-origin inclusion and enabling opt-in for pages using Cross-Origin Embedder Policy.
Cross-Origin Resource Sharing (CORS)
Cross-Origin Resource Sharing (CORS) is a browser mechanism that allows servers to opt in to controlled cross-origin reads by web applications, using HTTP response headers to relax the default same-origin restrictions on reading responses.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) is an attack that tricks a victim’s browser into sending an authenticated request to a trusted site, causing a state-changing action without the user’s intent by abusing ambient credentials such as session cookies.
Cross-Site Script Inclusion (XSSI)
Cross-Site Script Inclusion (XSSI) is an attack in which a malicious page includes another site’s sensitive URL as a script resource so the browser fetches authenticated or confidential content and interprets it as JavaScript—often enabling data theft from JSON or script-like responses.
Cross-Site Scripting (XSS)
Cross-Site Scripting (XSS) is a web security vulnerability in which untrusted data is interpreted as active content—usually JavaScript—in a victim’s browser, allowing attackers to run code in the security context of a trusted site.
Cryptographic Failures
Cryptographic Failures is an OWASP Top 10 category (A02:2021, formerly Sensitive Data Exposure) covering weaknesses in protecting data through cryptography—missing encryption, weak algorithms, poor key management, and incorrect use of crypto that leaves sensitive data recoverable by attackers.
Cryptographically Secure Pseudorandom Number Generator (CSPRNG)
A Cryptographically Secure Pseudorandom Number Generator (CSPRNG) is a random-bit generator designed so that its outputs are unpredictable to attackers who do not know the internal state, making it suitable for keys, nonces, tokens, and other secret cryptographic material.
CSP frame-ancestors
CSP frame-ancestors is a Content-Security-Policy directive that specifies which parent origins may embed a page in a frame, iframe, embed, or object—providing the modern browser control used to prevent unwanted framing and clickjacking.
CSP Hash
A CSP hash is a cryptographic digest of an inline script or style block listed in a Content-Security-Policy source list (for example 'sha256-...') so the browser allows that exact inline content without permitting arbitrary unsafe-inline execution.
CSP Nonce
A CSP nonce is a cryptographically strong, per-response random value included in a Content-Security-Policy script-src (or style-src) directive and mirrored on trusted script or style tags so browsers allow only those specifically marked inline resources.
CSP Report-Only
CSP Report-Only is a deployment mode using the Content-Security-Policy-Report-Only header that evaluates a Content Security Policy and emits violation reports without blocking resources—allowing teams to discover breakages before enforcing the policy.
CSP strict-dynamic
CSP strict-dynamic is a script-src keyword that tells supporting browsers to trust scripts dynamically created by already-trusted scripts—typically those allowed via a nonce or hash—while ignoring most static host allowlists for script loading in that policy.
CSV Injection
CSV Injection is a vulnerability in which untrusted data written into CSV or spreadsheet exports begins with formula markers (=, +, -, @, and related prefixes), so that spreadsheet applications interpret the cell as a formula or command when a user opens the file.
Cybersquatting
Cybersquatting is the bad-faith registration, use, or trafficking of a domain name that is identical or confusingly similar to a trademark or protected name in order to profit from the legitimate owner’s reputation or rights.
D
Dangling DNS Record
A dangling DNS record is a live DNS entry that still points to a resource that has been deleted, released, or is no longer under the owner's control, creating a risk that someone else can claim the destination.
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is a set of policies and controls that identify sensitive information in documents, messages, and channels, then monitor, alert, encrypt, or block its movement so confidential data is less likely to leave approved boundaries.
Debug Endpoint Exposure
Debug Endpoint Exposure is a security misconfiguration in which diagnostic, actuator, profiler, or framework debug HTTP routes remain reachable in production—revealing configuration, environment variables, heap dumps, health internals, or even remote management capabilities to unauthenticated or under-authenticated callers.
Decompression Bomb
A decompression bomb is any crafted compressed or encoded payload—ZIP is only one case—whose decode expands into far more data than the input size, exhausting memory, disk, or CPU in gzip, xz, brotli, image, or similar decoders.
Default Credentials
Default Credentials are factory-set or documentation-published usernames and passwords (or API tokens) that remain active after deployment—allowing anyone who knows or looks up the vendor defaults to authenticate as an administrator or service account.
Defense in Depth
Defense in depth is a security strategy that layers multiple, complementary controls across people, process, and technology so that if one safeguard fails or is bypassed, additional barriers still reduce the likelihood of successful compromise and limit blast radius.
Demonstrating Proof of Possession (DPoP)
Demonstrating Proof of Possession (DPoP) is an OAuth 2.0 application-layer mechanism where a client proves control of a public/private key pair by sending signed DPoP proof JWTs with token requests and API calls, enabling sender-constrained access tokens bound to that key.
Denial of Service (DoS)
Denial of Service (DoS) is a category of attack that intentionally impairs the availability of a system, service, or network resource so legitimate users cannot use it when needed—whether by crashing a host, exhausting capacity, or otherwise disrupting normal operation.
Dependency Confusion
Dependency confusion is a software supply-chain attack technique where an adversary publishes a public package that shares the name of an internal dependency, tricking build tools into installing the attacker-controlled package instead of the intended private one.
Dependency Pinning
Dependency pinning is the practice of constraining software dependencies to exact versions—and often exact artifact digests—so builds repeatedly resolve the same components instead of silently floating to newer releases.
Dependency Scanning
Dependency scanning is the automated analysis of application dependency manifests, lockfiles, and installed package graphs to identify known vulnerabilities, risky versions, and remediation paths.
Deserialization Attack
A deserialization attack exploits insecure unmarshalling of untrusted data so that reconstructing objects, structures, or executable graphs from serialized input produces unintended behavior—often remote code execution, authentication bypass, or tampering.
Detection Engineering
Detection engineering is the practice of designing, implementing, testing, and maintaining security detections as durable products—mapping attacker behavior to telemetry, writing analytics with clear hypotheses, and continuously tuning them so analysts receive actionable alerts.
Device Authorization Grant
The device authorization grant (device code flow) is an OAuth 2.0 extension that lets input-constrained devices obtain user-authorized tokens by showing a user code and verification URL that the user completes on a separate browser-capable device.
Directory Traversal
Directory traversal, also called path traversal, is a vulnerability in which attackers manipulate file path parameters to escape a restricted directory and access files or directories outside the intended scope using sequences such as ../ or absolute paths.
Distributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) is a denial-of-service attack launched from many compromised or coordinated sources at once, overwhelming a target’s bandwidth, network gear, or application capacity so legitimate traffic cannot get through.
DNS Amplification Attack
A DNS amplification attack is a reflected denial-of-service technique in which attackers send small spoofed DNS queries to servers that return much larger responses to a victim’s IP address, multiplying attack bandwidth.
DNS over HTTPS (DoH)
DNS over HTTPS (DoH) is a protocol that transports DNS queries and responses inside HTTPS, encrypting resolution traffic between a client and a DoH-compatible resolver to improve confidentiality on the path.
DNS over QUIC (DoQ)
DNS over QUIC (DoQ) is a protocol that carries DNS messages over the QUIC transport, providing encrypted, multiplexed client-to-resolver communication with TLS 1.3 security properties built into QUIC.
DNS over TLS (DoT)
DNS over TLS (DoT) is a protocol that encrypts DNS queries and responses between a client and a resolver using TLS, typically on port 853, protecting the resolution path from eavesdropping and on-path tampering.
DNS Rebinding
DNS rebinding is an attack technique in which a malicious hostname initially resolves to an attacker-controlled address and later resolves to a different address—often an internal or loopback IP—so a victim’s browser treats interactions with that target as same-origin with the attacker’s site.
DNS Resolver
A DNS resolver is software or a service that answers DNS lookups for clients—ranging from a simple stub that asks another server, to a full recursive resolver that discovers answers across the DNS hierarchy and caches results.
DNS Spoofing / Cache Poisoning
DNS spoofing and cache poisoning are attacks that inject forged Domain Name System answers so resolvers or clients cache incorrect mappings from names to addresses, steering traffic toward attacker-controlled infrastructure.
DNS Tunneling
DNS tunneling is a technique that encodes application data inside Domain Name System queries and responses, creating a covert communication channel that can bypass traditional firewalls and exfiltrate information or deliver command-and-control traffic.
DNS Zone
A DNS zone is an administrative portion of the DNS namespace for which a particular organization or DNS service is authoritative, containing the resource records and delegation points it publishes.
DNS-Based Authentication of Named Entities (DANE)
DANE, or DNS-Based Authentication of Named Entities, is a mechanism that uses DNSSEC-protected TLSA records to bind TLS services to specific certificates, public keys, or issuing constraints.
DNSSEC (Domain Name System Security Extensions)
DNSSEC (Domain Name System Security Extensions) is a suite of DNS extensions that adds cryptographic signatures to DNS data so validating resolvers can verify that answers are authentic and unmodified within a chain of trust.
DOM Clobbering
DOM clobbering is a browser quirk-driven technique where attacker-controlled HTML elements with certain id or name attributes overwrite or shadow global JavaScript properties, causing application code to trust attacker-controlled objects instead of built-in APIs or expected values.
DOM-Based XSS
DOM-based XSS is a cross-site scripting vulnerability in which client-side JavaScript takes untrusted data from a source such as the URL and writes it into an unsafe sink in the Document Object Model, causing attacker-controlled script to run in the victim’s browser.
Domain Fronting
Domain fronting is a technique that makes TLS connections appear to target a popular front domain—often via SNI—while the HTTP request Host header routes traffic to a different backend domain on the same CDN or multi-tenant infrastructure, obscuring the true destination.
Domain Generation Algorithm (DGA)
A domain generation algorithm (DGA) is malware logic that creates large numbers of candidate domain names so infected systems can find command-and-control infrastructure even after individual domains are blocked or seized.
Domain Hijacking
Domain hijacking is the unauthorized takeover of a domain name’s registration or DNS control, allowing attackers to change name servers, records, or ownership details and redirect or intercept services that depend on that domain.
Domain Name System (DNS)
The Domain Name System (DNS) is the Internet’s distributed naming system that translates human-readable domain names into data such as IP addresses, mail routers, and service locations so applications can connect to the correct hosts.
Domain Shadowing
Domain shadowing is the abuse of a legitimate domain after attackers compromise its management account and quietly create malicious subdomains under the real domain without taking over the entire site.
Domain-Based Message Authentication, Reporting and Conformance (DMARC)
Domain-Based Message Authentication, Reporting and Conformance (DMARC) is an email-authentication policy layer that checks whether SPF or DKIM aligns with the visible From domain and tells receivers how to handle failing messages while providing reporting to domain owners.
DomainKeys Identified Mail (DKIM)
DomainKeys Identified Mail (DKIM) is an email-authentication method in which a sending system signs selected message headers and content with a private key, while receivers verify the signature using a public key published in DNS.
Double Free
A double free is a memory management flaw in which the same allocated memory block is passed to a deallocator more than once, corrupting allocator metadata and potentially enabling crashes, arbitrary writes, or code execution.
Downgrade Attack
A downgrade attack is an active attack that interferes with security negotiation or fallback logic so communicating parties agree on an older protocol version, weaker cipher, reduced authentication mode, or otherwise lowered protection level that the attacker can more easily exploit—while victims often still believe a ‘secure’ session was established.
Drive-By Download
A drive-by download is malware delivery that occurs while a user is visiting a web page, with little or no intentional consent—either through a browser or plugin exploit that fetches a payload automatically, or through a deceptive one-click control that the visitor does not understand as an installer.
DROWN (CVE-2016-0800)
DROWN (Decrypting RSA with Obsolete and Weakened eNcryption), tracked as CVE-2016-0800, is a cross-protocol attack that uses a server’s SSLv2 RSA implementation as an oracle to decrypt TLS connections that reuse the same RSA private key—even when those TLS connections never negotiate SSLv2 themselves.
Dynamic Application Security Testing (DAST)
Dynamic Application Security Testing (DAST) is black-box security testing that probes a running application or API from the outside to find exploitable runtime vulnerabilities.
E
Edge Computing
Edge computing is an architecture pattern that places computation and data processing closer to users or devices—at regional PoPs, on-prem gateways, or device-adjacent nodes—to reduce latency, save bandwidth, and keep some processing local.
EDNS
EDNS is a set of DNS extension mechanisms that lets clients and servers advertise larger UDP message sizes, signal extra capabilities, and carry DNS options without replacing the core DNS protocol.
Elliptic-Curve Cryptography (ECC)
Elliptic-Curve Cryptography (ECC) is a family of public-key algorithms that rely on the difficulty of the elliptic-curve discrete logarithm problem, enabling signatures and key agreement with smaller keys and often better performance than comparable RSA parameters.
Elliptic-Curve Diffie–Hellman Ephemeral (ECDHE)
Elliptic-Curve Diffie–Hellman Ephemeral (ECDHE) is a key-agreement method in which each party generates a short-lived elliptic-curve key pair, exchanges public shares, and derives a shared secret used to protect a session—providing forward secrecy when ephemeral keys are discarded after use.
Email Header Injection
Email Header Injection is a vulnerability in which untrusted input containing newline or header-delimiting characters is inserted into email headers, allowing attackers to add recipients (Bcc/Cc), alter subjects, or inject additional MIME headers that change how messages are routed or rendered.
Email Spoofing
Email spoofing is the falsification or misleading presentation of sender identity in an email message so that the message appears to come from a trusted person, domain, or organization when it does not.
Embedding
An embedding is a dense numeric vector that represents a piece of content—text, code, an image, or a user—in a geometric space where similar items lie close together. Applications use embeddings for search, clustering, recommendations, and RAG retrieval.
Encryption at Rest
Encryption at rest protects stored data by converting files, blocks, records, or application fields into ciphertext while they sit on disks, volumes, snapshots, backups, object stores, and databases, with security depending heavily on key custody and operational controls.
Encryption in Transit
Encryption in transit is the protection of data while it moves between systems, users, services, or networks, usually by using protocols such as TLS, HTTPS, mTLS, SSH, or VPN tunnels to provide confidentiality, integrity, and endpoint authentication across untrusted paths.
Endpoint Detection and Response (EDR)
Endpoint Detection and Response (EDR) is a security capability that continuously records endpoint activity—processes, files, network connections, and identity context—then detects suspicious behavior, supports investigation, and enables response actions such as isolating a host or killing a process.
Entropy
In cryptography, entropy is the amount of unpredictability in secret or random data; high-entropy sources make keys, nonces, salts, and CSPRNG seeds infeasible for attackers to guess.
ETag
ETag is an HTTP response header that carries an entity tag—a validator representing a specific version of a resource—so clients and caches can issue conditional requests with If-None-Match and receive 304 Not Modified when the representation is unchanged.
Evil Twin
An evil twin is a rogue wireless access point that impersonates a legitimate network’s name (SSID)—and often its login portal—so nearby users connect to an attacker-controlled hotspot instead of the real hotel, café, airport, or office Wi-Fi.
Excessive Agency
Excessive agency is an LLM application design flaw in which the model can invoke tools, write data, or take external actions with more power than the user’s task requires—so prompt injection, mistakes, or jailbreaks produce real-world side effects instead of a wrong sentence.
Excessive Data Exposure
Excessive data exposure is an API design and authorization failure where endpoints return more object properties than a client needs—or than a caller is allowed to see—relying on the client to ignore sensitive fields that attackers can harvest directly from responses.
Expect-CT
Expect-CT was an HTTP response header that asked browsers to enforce Certificate Transparency requirements for a site’s certificates and optionally report CT failures, a role largely superseded when browsers began requiring CT by default for publicly trusted certificates.
Expiration Claim (exp)
The expiration claim (exp) is a registered JWT claim containing a NumericDate after which the token must not be accepted for processing, providing a mandatory lifetime bound that limits the usefulness of stolen or leaked credentials.
Exploit Chain
An exploit chain is a sequence of techniques and vulnerabilities used together so that the combined effect achieves an attacker objective—such as remote code execution, privilege escalation, or data theft—that any single step alone might not accomplish.
Exploit Prediction Scoring System (EPSS)
The Exploit Prediction Scoring System (EPSS) is a data-driven scoring model from FIRST that estimates the probability a software vulnerability will be exploited in the wild within a defined near-term window, helping defenders prioritize remediation beyond severity alone.
Exploitability
Exploitability is the degree to which a vulnerability can be successfully abused under realistic conditions—considering required access, complexity, available exploit code, environmental obstacles, and attacker skill—rather than merely whether a theoretical weakness exists.
Extended Detection and Response (XDR)
Extended Detection and Response (XDR) is a detection and investigation approach that correlates telemetry across multiple security domains—typically endpoint, identity, email, network, and cloud—into unified incidents, then supports coordinated response across those same layers.
Extended Validation (EV) Certificate
An Extended Validation (EV) certificate is a publicly trusted TLS server certificate issued only after a Certificate Authority completes a standardized, higher-assurance identity verification of the requesting organization, beyond domain control checks alone.
F
False Negative
A false negative is a failure to report a real vulnerability, intrusion, or policy violation that should have been detected—leaving risk invisible to operators until exploitation, audit, or manual review reveals it.
False Positive
A false positive is an incorrect alert or finding that reports a vulnerability, intrusion, or policy violation when the issue is not actually present—or not applicable—in the tested context, consuming investigative effort without corresponding risk.
Fast-Flux DNS
Fast-flux DNS is a technique that rapidly changes DNS records—especially address and name server records—so malicious hostnames resolve to a rotating pool of compromised systems, increasing resilience against takedown and blacklisting.
Fetch Metadata
Fetch Metadata is a set of browser-generated HTTP request headers—such as Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, and Sec-Fetch-User—that describe how a request relates to the initiating document, helping servers apply context-aware security policies.
FIDO2
FIDO2 is an open authentication standard suite—primarily W3C WebAuthn plus FIDO Client to Authenticator Protocol (CTAP)—that enables phishing-resistant, public-key authentication using platform passkeys or roaming authenticators instead of shared passwords.
File Upload Vulnerability
A File Upload Vulnerability is a weakness in how an application accepts, stores, or serves user-supplied files—such as missing validation, unsafe storage paths, or executable content delivery—that attackers exploit to plant malware, overwrite assets, or achieve remote code execution.
First-Party Cookie
A first-party cookie is a cookie associated with the site the user is actively visiting—set by that site’s origin (or treated as same-site in browser privacy models)—and typically used for sessions, preferences, and other functional state for that site.
Forced Browsing
Forced Browsing is an attack technique in which adversaries request unlinked or “hidden” URLs, files, and administrative paths directly—relying on guessable names, backups, or wordlists—to reach resources the UI never exposes and that often lack proper access control.
Forensic Analysis
Forensic analysis is the methodical collection, preservation, and examination of digital evidence—hosts, memory, logs, cloud artifacts, and communications—to reconstruct what happened, attribute actions where possible, and support incident response, legal, or disciplinary outcomes.
Format String Vulnerability
A format string vulnerability occurs when untrusted input is used as the format argument to functions like printf, sprintf, or logging APIs that interpret format specifiers—allowing attackers to read stack memory, crash the process, or write to chosen addresses via %n and related conversions.
Formula Injection
Formula Injection is a vulnerability in which untrusted input is interpreted as a formula or expression by a spreadsheet engine, calculation feature, or similar evaluator—causing unintended computation, external calls, or—on misconfigured clients—command execution when the formula runs.
Forward Proxy
A forward proxy is an intermediary that sits in front of clients and forwards their outbound requests to destination servers—often for access control, caching, filtering, anonymity, or centralized egress logging.
Forward Secrecy
Forward secrecy is a key-exchange property where compromising a server's long-term private key later does not decrypt previously recorded sessions because each connection used fresh ephemeral secrets that were not retained.
FREAK (CVE-2015-0204)
FREAK (Factoring RSA Export Keys), tracked as CVE-2015-0204, is a TLS vulnerability class in which a man-in-the-middle can downgrade a connection to export-grade RSA cipher suites with weak keys that can be factored, allowing decryption of supposedly secure sessions.
Frontend
A frontend is the client-facing layer of an application—typically a web UI, mobile app, or desktop interface—that presents information and captures user actions while relying on backends for authoritative business logic and data.
Fuzzing
Fuzzing is an automated testing technique that feeds large volumes of unexpected, malformed, or randomly generated inputs into software to uncover crashes, hangs, memory errors, and security-relevant edge cases.
G
Glue Record
A glue record is parent-zone address data, typically A or AAAA, published alongside a delegation so resolvers can reach in-bailiwick authoritative name servers without circular dependency.
GraphQL
GraphQL is a query language and runtime for APIs that lets clients request exactly the fields they need from a typed schema, typically over HTTP, with a single endpoint resolving nested data through server-defined resolvers.
GraphQL Batching Attack
A GraphQL batching attack abuses the ability to send many operations or aliased fields in a single HTTP request—via batch endpoints or query aliases—so attackers multiply brute-force attempts, bypass naive per-request rate limits, or extract large volumes of data cheaply.
GraphQL Introspection
GraphQL introspection is a built-in query capability that lets clients ask a GraphQL server for metadata about its schema—types, fields, arguments, and directives—enabling tooling and autocompletion, but also revealing the full attack surface when left unrestricted in production.
GraphQL Query Complexity
GraphQL query complexity is a measure of how expensive a query is to execute—usually estimated from selected fields, multipliers, and list sizes—so servers can reject or throttle operations that would consume disproportionate CPU, memory, or downstream calls.
GraphQL Query Depth
GraphQL query depth is the maximum nesting level of fields in a query selection set; without depth limits, clients can send recursively nested queries that force excessive resolver chains, circular relationship walks, and denial-of-service conditions.
Gray-Box Testing
Gray-box testing is a security evaluation approach where testers receive partial internal knowledge—such as user roles, API documentation, or high-level architecture—without full source access, balancing outsider realism with enough context to test deeper authorization and business logic.
gRPC
gRPC is a high-performance remote procedure call (RPC) framework that typically uses Protocol Buffers for interface contracts and HTTP/2 for transport, enabling efficient unary and streaming calls between services and clients.
Guardrail
A guardrail is a control that constrains an LLM application’s inputs, outputs, or actions—classifiers, allowlists, policy engines, rate limits, and sandboxes—so the system stays within safety, privacy, and business rules even when the model would not.
H
Hardware Security Key
A hardware security key is a dedicated physical authenticator—typically USB, NFC, or Bluetooth—that stores cryptographic credentials and performs FIDO2/WebAuthn or OTP operations to prove possession during authentication.
Hardware Security Module (HSM)
A Hardware Security Module (HSM) is a hardened cryptographic appliance or managed service that generates, stores, and uses private keys inside a tamper-resistant boundary so sensitive signing, decryption, and key-wrapping operations can happen without exposing raw key material to application hosts.
Hash-Based Message Authentication Code (HMAC)
Hash-Based Message Authentication Code (HMAC) is a symmetric message authentication code that combines a secret key with a cryptographic hash function to prove that data came from someone with the key and was not modified.
Hash-Based One-Time Password (HOTP)
Hash-Based One-Time Password (HOTP) is an algorithm that generates one-time numeric codes from a shared secret and an incrementing counter using an HMAC-based computation, defined in RFC 4226 and widely used in hardware tokens and some authenticator apps.
Heap Overflow
A heap overflow is a buffer overflow in dynamically allocated (heap) memory where a write exceeds an allocated block’s size, corrupting adjacent heap objects, allocator metadata, or application data structures and potentially enabling arbitrary writes or code execution.
Heartbleed (CVE-2014-0160)
Heartbleed, tracked as CVE-2014-0160, is a critical memory disclosure vulnerability in certain OpenSSL versions where a malformed TLS heartbeat request could cause the server (or client) to return up to 64 kilobytes of process memory, potentially exposing private keys, passwords, and session material.
Hidden Field Manipulation
Hidden Field Manipulation is an attack in which adversaries modify HTML form fields of type hidden (or similarly concealed client-side values) before submission—altering prices, identifiers, discounts, or flags that the application incorrectly treats as immutable server-controlled data.
Homograph Attack
A homograph attack is a deception technique in which an attacker uses characters that look like trusted letters or words—often across different scripts in an internationalized domain name—to make a malicious identifier appear legitimate to a human viewer.
Honeypot
A honeypot is a decoy system, service, or environment that has no legitimate production purpose—so any interaction is treated as suspicious—used to detect attackers, delay them, and collect intelligence on their tools and techniques.
Host Header Injection
Host Header Injection is a vulnerability in which an application trusts the HTTP Host header (or spoofable equivalents such as X-Forwarded-Host) to build links, reset URLs, cache keys, or security decisions—allowing attackers to poison those values and redirect users or corrupt application behavior.
HTTP Header Injection
HTTP Header Injection is a vulnerability in which untrusted input containing carriage return and line feed characters is written into HTTP headers, allowing attackers to insert new headers, split responses, or otherwise manipulate the HTTP message structure.
HTTP Keep-Alive
HTTP Keep-Alive is the practice of keeping a TCP (or TLS) connection open so multiple HTTP requests and responses can reuse it, avoiding repeated handshakes and reducing latency for subsequent requests on the same connection.
HTTP Method
An HTTP method (also called an HTTP verb) is the request semantic that tells a server what action the client wants to perform on the target resource—such as retrieve (GET), create or process (POST), replace (PUT), partially update (PATCH), or delete (DELETE).
HTTP Parameter Pollution (HPP)
HTTP Parameter Pollution (HPP) is an attack technique that submits duplicate or split HTTP parameters—often in the query string or form body—to exploit inconsistent parsing between proxies, frameworks, and backends, bypassing filters or altering application logic.
HTTP Request Smuggling
HTTP request smuggling is an attack in which inconsistent HTTP/1.1 message-boundary parsing between a frontend (proxy, CDN, WAF) and a backend causes one TCP stream to be interpreted as multiple requests, enabling cache poisoning, credential theft, and security bypass.
HTTP Request Splitting
HTTP request splitting is an attack technique in which crafted input causes a client, proxy, or server to interpret one network stream as multiple HTTP requests, enabling request smuggling-style desynchronization, cache poisoning, or unauthorized backend actions.
HTTP Response Smuggling
HTTP response smuggling is an attack in which inconsistent parsing of HTTP response message boundaries between a server, proxy, CDN, and client causes one connection to deliver multiple responses or misaligned bodies, enabling cache poisoning, request hijacking, and cross-user data leakage.
HTTP Response Splitting
HTTP response splitting is an attack in which untrusted input injected into HTTP response headers introduces CRLF sequences that terminate the current response early and start a second attacker-controlled response, enabling XSS, session fixation, and cache poisoning.
HTTP Status Code
An HTTP status code is a three-digit number in an HTTP response that indicates whether a request succeeded, was redirected, failed due to a client error, or failed due to a server error—guiding clients, caches, and operators on what to do next.
HTTP Strict Transport Security (HSTS)
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that instructs browsers to interact with a host only over HTTPS for a defined period, reducing the risk of protocol downgrade and cookie hijacking on cleartext HTTP.
HTTP/1.1
HTTP/1.1 is a widely deployed version of the Hypertext Transfer Protocol that uses textual request/response messages, persistent connections by default, and host-based virtual hosting—forming the baseline semantics still shared by later HTTP versions.
HTTP/2
HTTP/2 is a major revision of the Hypertext Transfer Protocol that uses a binary, multiplexed framing layer so many requests and responses can share one connection efficiently, typically negotiated over TLS for web browsing.
HTTP/2 Rapid Reset (CVE-2023-44487)
HTTP/2 Rapid Reset, tracked as CVE-2023-44487, is a denial-of-service technique that opens and immediately cancels many HTTP/2 streams (typically via RST_STREAM) so servers and proxies spend work creating stream state that is torn down before useful responses complete—allowing a single connection to generate extreme request rates that overwhelm targets.
HTTP/3
HTTP/3 is the third major version of HTTP that maps HTTP semantics onto QUIC, a UDP-based multiplexed transport with integrated TLS 1.3, reducing connection latency and avoiding TCP head-of-line blocking.
HttpOnly Cookie
An HttpOnly cookie is a cookie marked with the HttpOnly attribute so that browsers withhold it from non-HTTP APIs such as document.cookie, preventing page JavaScript from reading or writing that cookie directly.
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is HTTP communicated over a TLS-encrypted channel so browsers and servers can exchange web data with confidentiality, integrity, and cryptographic authentication of the server’s identity via certificates.
Human-in-the-Loop
Human-in-the-loop (HITL) is a design pattern in which a person must review, approve, or correct an AI system’s output or proposed action before it takes effect—used as a control for irreversible, high-impact, or uncertain decisions that should not be left to the model alone.
I
IaC Security Scanning
IaC security scanning is the automated review of infrastructure-as-code files and plans to detect insecure cloud, container, Kubernetes, network, identity, and data-service configurations before they are deployed.
ID Token
An ID token is a security token—typically a signed JWT—issued by an OpenID Connect provider to a client to assert that a user has authenticated, including subject and authentication metadata the client can verify.
Idempotency
Idempotency is the property that performing the same operation multiple times produces the same effect on server state as performing it once—so retries, timeouts, and duplicate submissions do not create unintended extra side effects.
Idempotency Key
An idempotency key is a client-generated unique token sent with an API request—usually in a header—so the server can recognize retries of the same intended operation and return the original result instead of applying the side effect again.
Identity and Access Management (IAM)
Identity and Access Management (IAM) is the discipline and technology set that creates, maintains, authenticates, authorizes, audits, and eventually retires digital identities for people, devices, and workloads across an organization’s systems.
Identity Provider (IdP)
An Identity Provider (IdP) is a service that authenticates users (and sometimes devices or workloads) and issues security assertions or tokens that relying applications trust for single sign-on and federated identity.
Iframe Sandbox
The iframe sandbox attribute applies a set of extra restrictions to an embedded browsing context—blocking scripts, form submission, top navigation, and same-origin access by default—until specific allow-* tokens re-enable only the capabilities the embed needs.
Image Registry
An image registry is a service that stores, authenticates, and distributes OCI container images (manifests, indexes, and layers) so build systems can push artifacts and runtimes can pull them by tag or digest.
Immutable Infrastructure
Immutable infrastructure is the practice of never changing running servers or containers in place: new versions are built as images or artifacts, deployed as replacements, and old instances are destroyed so production matches a known, versioned build rather than a history of SSH patches.
Improper API Inventory Management
Improper API inventory management is a security failure where an organization lacks an accurate, current catalog of all APIs—including versions, owners, auth requirements, and data sensitivity—leaving undocumented, deprecated, or forgotten endpoints exposed without monitoring or patching.
Incident Response
Incident response is the coordinated process of detecting, triaging, containing, eradicating, and recovering from a cybersecurity incident, then capturing lessons so the same path is harder to reuse.
Indicator of Compromise (IOC)
An Indicator of Compromise (IOC) is an observable artifact associated with malicious activity—such as a file hash, IP address, domain, URL, or certificate—that defenders can search for, block, or alert on to find related intrusions.
Indirect Prompt Injection
Indirect prompt injection is a prompt injection delivered through content the application fetches or retrieves—web pages, emails, tickets, PDFs, or tool output—rather than through the user’s own chat message, so the model follows hidden instructions while the user asked an ordinary question.
Information Disclosure
Information Disclosure is a vulnerability category in which an application, API, or infrastructure component unintentionally reveals sensitive data—credentials, PII, internals, or business secrets—to unauthorized parties through responses, errors, debug endpoints, backups, or other channels.
Infrastructure as Code (IaC)
Infrastructure as Code (IaC) is the practice of defining, provisioning, and changing infrastructure through version-controlled machine-readable configuration instead of manual console or ticket-driven changes.
Initialization Vector (IV)
An initialization vector (IV) is a per-message input used with an encryption key and mode of operation to start encryption in a fresh state; it is usually public, must follow the mode's randomness or uniqueness rules, and must never be confused with the secret key.
Insecure Design
Insecure Design is an OWASP Top 10 category (A04:2021) covering weaknesses that originate from missing or ineffective security design—flawed threat models, absent controls, and architectures that cannot enforce required protections even when implementation is otherwise careful.
Insecure Direct Object Reference (IDOR)
Insecure Direct Object Reference (IDOR) is an access-control weakness in which an application exposes internal object identifiers and fails to verify that the authenticated requester is authorized to access the corresponding object, allowing attackers to read or modify other users’ data by changing IDs.
Insecure Output Handling
Insecure output handling is the failure to treat LLM completions as untrusted data. When applications render, execute, or forward model output without encoding, validation, or policy checks, attackers who influence the prompt can reach browsers, shells, SQL, emails, or workflows.
Insecure Temporary File
An Insecure Temporary File flaw occurs when applications create temporary files or directories with predictable names, insecure permissions, or unsafe create semantics—allowing local attackers to race, replace, read, or hijack those files (commonly tracked as CWE-377 and CWE-379).
Instance Metadata Service (IMDS)
Instance Metadata Service (IMDS) is the virtual-machine metadata API—reached at a link-local address such as 169.254.169.254—that provides instance identity, user data, and temporary credentials for the role attached to that VM.
Integer Overflow
An integer overflow occurs when an arithmetic operation produces a value larger than the destination integer type can represent, causing wraparound (or other undefined behavior) that can break length checks, allocations, and security-critical logic.
Integer Underflow
An integer underflow (in the security sense) occurs when an arithmetic operation produces a value smaller than the destination integer type can represent—commonly via subtraction—causing wraparound to a large value that can break bounds checks, lengths, or security-critical counters.
Interactive Application Security Testing (IAST)
Interactive Application Security Testing (IAST) is application security testing that instruments a running application during normal or automated tests to identify vulnerabilities with runtime and code-path context.
Intermediate Certificate
An intermediate certificate is an X.509 CA certificate signed by a root CA or another intermediate CA that is authorized to issue certificates below it, usually leaf TLS certificates, while keeping the root key protected and offline.
Internationalized Domain Name (IDN)
An internationalized domain name (IDN) is a domain name that uses characters beyond basic ASCII, allowing labels in scripts such as Arabic, Cyrillic, Chinese, or accented Latin to be represented through the IDNA standard.
Issued At Claim (iat)
The issued-at claim (iat) is a registered JWT claim containing a NumericDate that indicates when the token was created, enabling verifiers to evaluate token age, detect anomalous future issuance times, and apply freshness policies beyond simple expiration.
Issuer Claim (iss)
The issuer claim (iss) is a registered JWT claim that identifies the principal that issued the token—typically an authorization server or OpenID provider URL—so verifiers can decide whether the assertion comes from a trusted authority.
J
Jailbreak
A jailbreak in LLM security is a technique that causes a model to ignore its safety alignment or product guardrails and produce disallowed or higher-risk behavior—such as prohibited content, dangerous instructions, or policy-violating tool use—while remaining fluent and cooperative.
JSON Web Encryption (JWE)
JSON Web Encryption (JWE) is a JOSE standard for encrypting content—often JWT claims—so that only intended recipients with the correct keys can recover the plaintext, providing confidentiality in addition to (or instead of) a standalone signature.
JSON Web Key (JWK)
A JSON Web Key (JWK) is a JSON data structure that represents a cryptographic key—public, private, or symmetric—using standardized parameters so applications can publish, discover, and use keys for signing, verifying, encrypting, or decrypting JWT-related material.
JSON Web Key Set (JWKS)
A JSON Web Key Set (JWKS) is a JSON document that contains an array of JSON Web Keys, typically published at a discovery URL so relying parties can retrieve the public keys needed to verify signatures or encrypt tokens for an issuer.
JSON Web Signature (JWS)
JSON Web Signature (JWS) is a JOSE standard for representing content protected by digital signatures or message authentication codes, commonly used as the signed form of JWTs with a header, payload, and signature.
JSON Web Token (JWT) Attacks
JWT attacks are techniques that abuse flawed creation, signing, encryption, or validation of JSON Web Tokens—such as accepting unsigned tokens, guessing weak HMAC secrets, confusing key types, or trusting mutable claims—to impersonate users or escalate privileges.
Just-in-Time Access (JIT)
Just-in-Time Access (JIT) is an access-management practice that grants elevated permissions only when needed, for a limited duration, and often with approval—replacing standing privileged roles with temporary, auditable elevation.
JWT (JSON Web Token)
A JWT (JSON Web Token) is a compact, URL-safe token format that encodes JSON claims in a header and payload, typically protected by a digital signature or message authentication code so recipients can verify integrity and authenticity.
JWT alg none
JWT alg:none is an authentication bypass technique where a token advertises the none algorithm and carries no signature; vulnerable verifiers accept the crafted claims as trusted, allowing attackers to impersonate users without cryptographic proof.
JWT Algorithm Confusion
JWT algorithm confusion is a class of authentication flaws where a verifier accepts an attacker-controlled or mismatched signing algorithm—such as treating an asymmetric public key as an HMAC secret or honoring an unexpected alg value—so forged tokens validate successfully.
JWT Claim
A JWT claim is a piece of information asserted in a JSON Web Token payload—such as subject, issuer, audience, or a custom role—encoded as a JSON name/value pair that verifiers may use for authentication context and authorization decisions after the token is validated.
JWT Key Confusion
JWT key confusion is a verification flaw where cryptographic key material is used with the wrong algorithm family—most classically treating an asymmetric public key as an HMAC secret—so attackers can forge tokens that a confused verifier accepts as valid.
JWT kid Injection
JWT kid injection is an attack that manipulates the JSON Web Signature kid (key ID) header parameter so a verifier resolves or loads attacker-influenced key material—via path traversal, SQL injection, URL fetch, or unconstrained key maps—allowing forged tokens to validate.
JWT Signature Bypass
JWT signature bypass is any weakness that lets an application accept or act on JWT claims without successfully verifying a valid cryptographic signature or MAC under an approved algorithm and key—effectively treating an unauthenticated payload as an authenticated assertion.
JWT Token Replay
JWT token replay is the reuse of a previously issued JSON Web Token by an attacker or unintended party to gain authorized access, typically after theft from browsers, logs, mobile storage, network interception, or cross-site leakage, while the token remains cryptographically valid.
K
Kerberos
Kerberos is a network authentication protocol that uses time-limited, encrypted tickets issued by a trusted Key Distribution Center (KDC) so clients can prove identity to services without repeatedly sending passwords over the network.
Key Derivation Function (KDF)
A key derivation function (KDF) is a cryptographic algorithm that turns input key material, such as a shared secret or password, into one or more strong keys with the right length, separation, and context for encryption, authentication, or protocol state.
Key Exchange
Key exchange is the protocol process that lets two or more parties establish shared secret keying material over an untrusted network, usually by combining public messages with private values and then deriving symmetric session keys through a KDF.
Key Management Service (KMS)
A Key Management Service (KMS) is a managed cryptographic key service that creates, stores, protects, rotates, authorizes, and audits keys used for encryption, decryption, signing, verification, and key wrapping, usually through cloud APIs backed by hardened key custody infrastructure.
Key Rotation
Key rotation is the controlled process of replacing cryptographic keys, certificates, or signing credentials with new ones while preserving availability, auditability, and the ability to decrypt or verify data created with older keys for as long as policy requires.
Kubernetes Admission Controller
A Kubernetes admission controller is a plugin or webhook that intercepts API requests after authentication and authorization but before object persistence, allowing the cluster to mutate, validate, or reject resources according to policy.
Kubernetes Network Policy
A Kubernetes NetworkPolicy is a namespace-scoped API object that selects pods and specifies which ingress and egress connections those pods may accept or initiate, enforced by a compatible CNI plugin rather than by the Kubernetes control plane itself.
Kubernetes RBAC
Kubernetes RBAC is the API server’s role-based authorization mode: Roles and ClusterRoles list allowed verbs on API resources, and RoleBindings or ClusterRoleBindings attach those permissions to users, groups, or service accounts.
Kubernetes Secret
A Kubernetes Secret is an API object that holds small pieces of sensitive data—tokens, passwords, certificates—so pods can consume them as files or environment variables instead of baking credentials into images or manifests in plaintext form.
L
Large Language Model (LLM)
A Large Language Model (LLM) is a neural network trained on vast text corpora to predict and generate language. In applications, it turns prompts and retrieved context into answers, plans, or tool calls—without inherent understanding of truth, policy, or authorization.
LDAP
LDAP (Lightweight Directory Access Protocol) is a standard application protocol for reading and modifying hierarchical directory information—commonly user accounts, groups, and organizational attributes—used by identity systems and applications for lookups and sometimes authentication.
LDAP Injection
LDAP Injection is a vulnerability in which untrusted input is incorporated into an LDAP search filter or distinguished name so that attackers can alter query logic—often bypassing authentication or reading unauthorized directory attributes—using LDAP metacharacters rather than SQL syntax.
Least Privilege
Least privilege is a security principle that grants each user, process, or system only the minimum permissions required to perform an authorized task—for the minimum necessary time—reducing the impact of mistakes and compromised credentials.
Load Balancer
A load balancer is a networking component that distributes incoming traffic across multiple backend servers or services to improve availability, scalability, and performance—usually using health checks and routing algorithms.
Local File Inclusion (LFI)
Local File Inclusion (LFI) is a vulnerability in which an application includes or reads files from the local filesystem based on user-controllable input without sufficient validation, allowing attackers to access sensitive files or, in some cases, escalate to remote code execution.
Lockfile
A lockfile is a package-manager-generated file that records the exact resolved dependency graph, including versions and often integrity hashes, so installs can be reproduced consistently.
Log Correlation
Log correlation is the process of linking related events from multiple sources—using shared identifiers, time windows, and entity context—so isolated log lines become a coherent timeline of activity for detection and investigation.
Log4Shell (CVE-2021-44228)
Log4Shell, primarily tracked as CVE-2021-44228, is a critical remote code execution vulnerability in Apache Log4j 2 where attacker-controlled log input could trigger JNDI lookups (commonly LDAP) that load and execute remote code—often with a single malicious string reaching an application log statement.
Logjam (CVE-2015-4000)
Logjam, tracked as CVE-2015-4000, is a TLS vulnerability class in which a man-in-the-middle can downgrade connections to export-grade Diffie-Hellman key exchange with weak parameters, enabling computation of session keys and decryption of affected TLS traffic.
Lucky Thirteen
Lucky Thirteen is a timing side-channel attack against TLS (and DTLS) implementations using CBC cipher suites with the MAC-then-pad-then-encrypt construction: small differences in how padding and HMAC failures are processed can reveal plaintext bytes to a network attacker who carefully measures response times.
M
Malicious File Upload
A Malicious File Upload is an attack in which an adversary intentionally submits hostile file content through an application’s upload capability—webshells, malware droppers, weaponized documents, or script-bearing media—to compromise the server, other users, or downstream processors.
Malicious Package
A malicious package is a software package intentionally published, modified, or distributed to execute harmful behavior such as credential theft, backdoor installation, data exfiltration, or build compromise.
Malvertising
Malvertising is the use of online advertising networks to deliver malware, exploit kits, or phishing content through ads that appear on otherwise legitimate websites, so visitors are attacked by the ad slot rather than by a compromise of the publisher’s own pages.
Man-in-the-Middle (MITM)
A man-in-the-middle (MITM) attack is a threat model in which an adversary positions between communicating parties to intercept, relay, modify, or impersonate traffic so that one or both sides believe they are talking directly to each other.
Mass Assignment
Mass assignment is a vulnerability where an application automatically binds client-supplied input to internal object properties without an allowlist—letting attackers modify privileged fields such as roles, prices, or ownership by including unexpected parameters in requests.
MCP Server
An MCP server is a process or service that implements the Model Context Protocol and exposes tools, resources, and/or prompt templates to an LLM host. It is the integration endpoint the model can discover and invoke—equivalent to a plugin with a standardized RPC interface.
Mean Time to Detect (MTTD)
Mean Time to Detect (MTTD) is the average time between when a security incident begins—typically initial compromise or first malicious action—and when the organization first becomes aware of it through monitoring, hunting, or external notice.
Mean Time to Respond (MTTR)
Mean Time to Respond (MTTR) is the average time from when a security incident is detected—or from an agreed response-start event—until containment or another defined response outcome is achieved, measuring how quickly the organization acts once it knows something is wrong.
Meltdown
Meltdown is a transient execution vulnerability in which a user-space program can transiently access privileged kernel memory and recover its contents through microarchitectural side channels—breaking the isolation between user applications and the operating system kernel on affected CPUs.
Membership Inference Attack
A membership inference attack (MIA) determines whether a specific record was part of a model’s training (or fine-tuning) set by analyzing the model’s outputs—confidence, loss, or generation behavior—on that record compared with similar non-members.
Memory Corruption
Memory corruption is a class of software flaws in which a program writes to or uses memory in unintended ways—such as buffer overflows, use-after-free, or out-of-bounds access—breaking integrity of data or control flow and often enabling crashes or code execution.
Metadata Service
A metadata service is a provider-operated, typically link-local HTTP endpoint that a compute identity (VM, function, or node) can query for instance attributes, user data, and temporary cloud credentials without storing long-lived keys on disk.
MFA Fatigue
MFA fatigue is an attack technique in which adversaries—often after stealing a password—flood a victim with repeated multi-factor authentication prompts until the user approves one out of confusion, frustration, or habit, granting the attacker access.
MFA Push Bombing
MFA push bombing is an attack pattern that generates a high volume of push-based multi-factor authentication notifications against a target account—usually after obtaining the password—to overwhelm the user and increase the chance of an accidental or fatigued approval.
Microservices
Microservices are an architectural style that structures an application as a set of small, independently deployable services—each owning a focused business capability and communicating over the network through APIs or messaging.
MIME Sniffing
MIME sniffing is a browser behavior in which the user agent inspects response body bytes to infer or override the declared Content-Type when it believes the server mislabeled the resource—sometimes executing non-script types as HTML or JavaScript.
Mishandling of Exceptional Conditions
Mishandling of Exceptional Conditions is a class of weaknesses where error, timeout, and failure paths are implemented insecurely—swallowing exceptions without action, failing open when security checks error, or returning verbose diagnostics that leak sensitive information to attackers.
Mitigation
Mitigation is an action that reduces the likelihood or impact of a security weakness without necessarily eliminating the root cause—such as virtual patching, network isolation, feature disablement, or stricter monitoring—often used until permanent remediation is possible.
MITRE ATT&CK
MITRE ATT&CK is a publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, used by defenders to describe behavior, map detections and controls, and plan exercises in a shared language.
Mixed Content
Mixed content occurs when a page loaded over HTTPS embeds or requests subresources over cleartext HTTP, weakening the page’s transport security; browsers increasingly block active mixed content such as scripts and may restrict or warn on passive mixed content such as images.
Model Context Protocol (MCP)
The Model Context Protocol (MCP) is an open protocol that standardizes how LLM applications (hosts) connect to external tools, resources, and prompt templates (servers) over JSON-RPC, so agents can use a shared ecosystem of integrations instead of one-off plugins.
Model Denial of Service
Model denial of service is an availability attack against LLM inference: crafted or voluminous requests occupy GPUs, blow context windows, trigger pathological decoding, or exhaust worker pools so legitimate users cannot get completions in time—or at all.
Model Extraction
Model extraction is an attack that reconstructs a substitute model—or a close approximation of its behavior—by querying a victim model at scale. The attacker harvests input-output pairs and trains a clone that copies functionality, pricing, or safety bypasses without access to original weights.
Model Inversion
A model inversion attack reconstructs approximations of private training inputs—or other sensitive features—from a model’s outputs, embeddings, or gradients. The attacker does not steal weights; they ask the model to reveal what it memorized or encoded about people and records.
Model Poisoning
Model poisoning is compromise of a model artifact itself—base weights, fine-tunes, LoRA adapters, quantized files, or evaluation checkpoints—so the loaded model contains a backdoor or altered behavior that was not present in a trusted training run from clean data.
ModSecurity
ModSecurity is an open-source web application firewall (WAF) engine that inspects HTTP traffic using configurable rules—commonly the OWASP Core Rule Set—to detect and block common web attacks such as injection, XSS, and protocol abuse.
MTA Strict Transport Security (MTA-STS)
MTA Strict Transport Security (MTA-STS) is a mail-security mechanism in which a receiving domain publishes a DNS signal and an HTTPS-hosted policy telling sending MTAs to require valid TLS and approved MX names when delivering email to that domain.
Multi-Factor Authentication (MFA)
Multi-Factor Authentication (MFA) is an authentication method that requires two or more independent factors—typically something you know, have, or are—before granting access, so stolen passwords alone are usually insufficient for account takeover.
Multi-Tenant Isolation
Multi-tenant isolation is the set of technical and operational controls that keep one tenant’s identities, data, networks, and failures from affecting another tenant on shared infrastructure—whether those tenants are customers, teams, or environments.
Mutation XSS (mXSS)
Mutation XSS (mXSS) is a class of cross-site scripting where seemingly safe HTML is altered by browser parsing, serialization, or mutation logic—such that a sanitizer’s clean output becomes dangerous after the browser mutates the markup.
Mutual TLS (mTLS)
Mutual TLS (mTLS) is a mode of Transport Layer Security in which both the server and the client present X.509 certificates during the handshake, so each party can authenticate the other before application data is exchanged.
MX Record
An MX record is a DNS resource record that tells sending mail servers which hostnames accept email for a domain and in what preference order they should be tried.
N
Namespace Confusion
Namespace confusion is a software supply-chain attack pattern where ambiguous, unclaimed, or inconsistently enforced package namespaces let an attacker make a package appear to belong to a trusted organization or source.
Namespace Isolation
Namespace isolation is the use of separate namespaces to limit what a process or tenant can see: Linux namespaces partition kernel resources (PID, network, mounts, users), while Kubernetes namespaces partition API objects—neither is a complete security boundary without matching policy.
Nonce
A nonce is a value intended to be used once in a cryptographic context, often to guarantee uniqueness, bind a protocol message to one session, or prevent replay; depending on the algorithm it may need to be unpredictable, unique, or both.
NoSQL Injection
NoSQL injection is an attack technique that manipulates NoSQL database queries by injecting operators, crafted JSON structures, or unexpected types into application inputs, causing unauthorized data access, authentication bypass, or other unintended database behavior.
Not Before Claim (nbf)
The not-before claim (nbf) is a registered JWT claim containing a NumericDate before which the token must not be accepted for processing, allowing issuers to delay validity until a scheduled time or to align token usability with a defined window.
NS Record
An NS record is a DNS resource record that identifies which authoritative name servers are responsible for a zone or delegated portion of the namespace.
Null Pointer Dereference
A null pointer dereference occurs when a program reads or writes memory through a pointer that is NULL (or otherwise invalid at address zero), typically causing a crash and, in some contexts, denial of service or further memory-safety impact.
NXDOMAIN
NXDOMAIN is a DNS response code that means the queried domain name does not exist in the DNS namespace known to the authoritative server.
O
OAuth `state`
OAuth `state` is an opaque value the client includes in the authorization request and must verify on the callback; it binds the redirect response to the user’s browser session and mitigates cross-site request forgery against the OAuth redirect endpoint.
OAuth 2.0
OAuth 2.0 is an authorization framework that lets a user or system grant a client application limited access to protected resources without sharing the resource owner’s primary credentials, typically by issuing access tokens to the client.
OAuth Authorization Server
An OAuth authorization server (AS) is the OAuth role that authenticates resource owners and clients, obtains authorization, and issues access tokens (and related artifacts such as refresh tokens or authorization codes) according to configured grants and policies.
OAuth Client
An OAuth client is an application that requests authorization from a resource owner and tokens from an authorization server in order to access protected resources—classified as public or confidential based on its ability to authenticate and protect credentials.
OAuth Misconfiguration
OAuth misconfiguration is the insecure setup or implementation of OAuth 2.0 (or related identity flows) such that redirect handling, clients, grants, scopes, or token validation fail to enforce intended security properties, enabling impersonation or unauthorized API access.
OAuth Resource Server
An OAuth resource server (RS) is the OAuth role that hosts protected resources—typically an API—and accepts access tokens from clients, validating them and enforcing authorization such as scopes, audiences, and subject permissions before returning data or performing actions.
OAuth Scope
An OAuth scope is a permission label requested by a client and granted by the authorization server (often with resource-owner consent) that constrains what an issued access token is allowed to do at a resource server.
OAuth Token Theft
OAuth token theft is the unauthorized acquisition of OAuth access tokens, refresh tokens, or authorization codes—through XSS, malware, misdirected redirects, insecure storage, or log leakage—allowing attackers to access APIs as the victim client or user.
OCSP Stapling
OCSP stapling is a TLS feature where a server attaches a fresh, CA-signed OCSP response to the TLS handshake so clients can verify certificate revocation status without making their own OCSP request.
OIDC `nonce`
OIDC `nonce` is a client-generated string included in the authentication request and returned as an ID token claim so the client can verify that the token was issued in response to its own login flow, mitigating certain ID token replay and injection attacks.
One-Time Password (OTP)
A one-time password (OTP) is a short-lived authentication code valid for a single use or brief window, generated by an algorithm or delivered out-of-band, and commonly used as a second factor alongside a primary credential.
Open Redirect
An open redirect is a vulnerability in which an application forwards users to a URL taken from untrusted input without sufficient validation, allowing attackers to craft links on a trusted domain that send victims to malicious destinations.
OpenAPI Specification
The OpenAPI Specification (OAS) is a standard, language-agnostic format for describing HTTP APIs—including paths, operations, parameters, authentication, and schemas—so humans and tools can document, validate, generate, and secure interfaces from a shared contract.
OpenID Connect (OIDC)
OpenID Connect (OIDC) is an identity layer built on OAuth 2.0 that enables clients to verify end-user identity based on authentication performed by an authorization server and to obtain basic profile information via standardized ID tokens and UserInfo endpoints.
Origin
An origin is the security principal browsers derive from a URL’s scheme, host, and port. Two URLs share an origin only when all three match; origins define the boundary for cookies, storage, and most cross-document access rules enforced by the Same-Origin Policy.
Origin Server
An origin server is the authoritative source of an application’s content or API responses—the infrastructure that CDNs, reverse proxies, and caches fetch from when they cannot (or should not) answer from an edge copy alone.
OS Command Injection
OS Command Injection is a vulnerability in which untrusted input is passed to an operating-system command interpreter—such as a Unix shell or Windows cmd/PowerShell—so attackers can execute additional OS commands with the privileges of the application process (commonly tracked as CWE-78).
Out-of-Bounds Read
An out-of-bounds read is a memory safety flaw in which a program reads data outside the valid boundaries of a buffer or object—leaking adjacent memory contents that may include secrets, pointers, or data useful for further exploitation.
Out-of-Bounds Write
An out-of-bounds write is a memory safety flaw in which a program writes data outside the valid boundaries of a buffer or object, corrupting adjacent memory such as other variables, object metadata, or control structures.
OWASP Core Rule Set (CRS)
The OWASP Core Rule Set (CRS) is a set of generic attack detection rules for compatible web application firewalls—commonly used with ModSecurity—that helps identify and block common web threats such as SQL injection, XSS, and protocol violations.
P
Package Hijacking
Package hijacking is a software supply-chain compromise where an attacker gains control over an existing trusted package, maintainer account, or publishing workflow and releases unauthorized versions under that package's legitimate name.
Package Repository
A package repository is a service or registry that stores, indexes, and distributes reusable software packages and metadata for package managers, build systems, and deployment pipelines.
Padding Oracle Attack
A padding oracle attack is a cryptographic side-channel technique that decrypts ciphertext—commonly CBC-mode ciphertext—by submitting modified ciphertexts and observing whether the receiver reports valid or invalid padding, turning those error distinctions into a byte-by-byte plaintext recovery oracle.
Pagination Abuse
Pagination abuse is the misuse of list API pagination controls—such as oversized page sizes, deep offsets, cursor manipulation, or parallel page fetching—to scrape bulk data, bypass intended result windows, or inflict disproportionate backend load.
Parameter Tampering
Parameter Tampering is an attack in which adversaries modify request parameters—query strings, form fields, cookies, headers, or API JSON—to alter application behavior, such as changing prices, object IDs, quantities, or role indicators that the server trusts without re-validation.
Passkey
A passkey is a FIDO/WebAuthn discoverable credential—often synced across a user’s devices by a platform provider—that authenticates with public-key cryptography instead of a reusable password, typically unlocked by biometrics or a device PIN.
Password Hashing
Password hashing is the practice of transforming a password into a one-way cryptographic digest—using a slow, salted, adaptive algorithm—so systems can verify login attempts without storing recoverable plaintext passwords.
Password Spraying
Password spraying is a credential attack in which adversaries attempt a small number of commonly used passwords against many usernames, staying under per-account lockout thresholds while discovering accounts that reuse weak passwords.
Passwordless Authentication
Passwordless authentication is a family of login methods that verify a user without requiring them to create, remember, or type a reusable password—commonly using passkeys/WebAuthn, magic links, device biometrics unlocking cryptographic keys, or one-time factors as the primary authenticator.
Patch Management
Patch management is the repeatable process of identifying, prioritizing, testing, deploying, and verifying software updates that fix vulnerabilities, defects, or operational issues.
Path Confusion
Path Confusion is a vulnerability class in which different components—browsers, reverse proxies, WAFs, and application routers—parse or normalize the same URL path differently, so security checks see one path while the handler executes another (via tricks like /;/, encoded dots, dual decoding, or mismatched trailing-slash rules).
PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is a standardized key-derivation function that repeatedly applies a pseudorandom function such as HMAC to a password and salt, producing a derived key whose computation cost scales with an iteration count.
Penetration Testing
Penetration testing (pentesting) is an authorized, time-boxed attempt to evaluate security by actively exploiting weaknesses in systems, applications, or people—demonstrating real impact and attack paths rather than only listing theoretical findings.
Permissions Policy
Permissions Policy is a browser security mechanism—delivered primarily via an HTTP response header—that allows a site to control which origins may use powerful features such as camera, microphone, geolocation, payment, and other sensitive capabilities.
Phishing
Phishing is a social-engineering attack that uses deceptive messages—most often email, but also web, chat, or ads—to trick people into revealing secrets, installing malware, or completing a harmful action on an attacker-controlled destination that impersonates a trusted brand or colleague.
Phishing-Resistant MFA
Phishing-resistant MFA is multi-factor authentication that cannot be completed successfully by tricking a user into revealing a reusable secret or approving a bogus login on an attacker-controlled lookalike site—typically achieved with FIDO2/WebAuthn cryptographic authenticators bound to the legitimate origin.
Pipeline Poisoning
Pipeline poisoning is the compromise or manipulation of CI/CD workflows, build scripts, runners, secrets, or release automation so malicious changes are built, signed, tested, or deployed through trusted delivery paths.
Pod Security
Pod Security is Kubernetes’ built-in admission policy that labels namespaces with Privileged, Baseline, or Restricted profiles so pods cannot request dangerous isolation breaks—such as privileged mode, host namespaces, or extra capabilities—unless the namespace explicitly allows them.
Polyglot File
A Polyglot File is a single byte sequence crafted to be valid—or plausibly interpretable—as two or more file formats at once (for example GIF+JavaScript or PDF+ZIP), allowing attackers to pass one checker while exploiting another consumer.
POODLE (CVE-2014-3566)
POODLE (Padding Oracle On Downgraded Legacy Encryption), tracked as CVE-2014-3566, is an attack against SSL 3.0 CBC-mode cipher suites that exploits padding validation weaknesses—often after forcing a protocol downgrade—to decrypt HTTP cookies and other secrets byte by byte.
Preflight Request
A preflight request is an automatic OPTIONS request a browser sends before certain cross-origin HTTP requests to ask the target server whether the actual method, headers, and credentials are permitted under Cross-Origin Resource Sharing (CORS) rules.
Pretexting
Pretexting is a social-engineering technique in which the attacker invents a convincing identity, scenario, and reason for contact—the pretext—so the target feels obligated or helpful enough to disclose information, grant access, or complete a transaction they would refuse from a stranger.
Private Network Access (PNA)
Private Network Access (PNA) is a browser security policy—formerly known as CORS-RFC1918—that restricts websites on public networks from making requests to private, local, or loopback addresses unless the target explicitly opts in through CORS and, when required, a dedicated preflight.
Privilege Escalation
Privilege escalation is the process by which an attacker increases their access rights beyond what was initially granted—either by obtaining higher privileges (vertical) or accessing another user’s resources at the same privilege tier (horizontal).
Privileged Access Management (PAM)
Privileged Access Management (PAM) is the set of tools and processes that discover, vault, elevate, monitor, and revoke elevated credentials and administrative sessions so powerful access is least-privilege, time-bound, and auditable.
Prompt Injection
Prompt injection is an attack in which untrusted text is concatenated into an LLM’s context so the model follows the attacker’s instructions instead of the developer’s—changing answers, leaking context, or triggering tools.
Prompt Leakage
Prompt leakage is the unauthorized disclosure of hidden prompt content—system instructions, developer notes, tool schemas, or retrieved snippets—through an LLM’s completions, logs, or error paths, so attackers can read the control plane the application meant to keep private.
Proof Key for Code Exchange (PKCE)
Proof Key for Code Exchange (PKCE) is an OAuth 2.0 extension that binds an authorization code to the client that started the flow by requiring a one-time code_verifier at token exchange that matches a previously sent code_challenge, mitigating authorization code interception.
Proof of Concept (PoC)
In cybersecurity, a proof of concept (PoC) is a minimal demonstration—often a script, request sequence, or lab exploit—that shows a vulnerability is real and reachable, without necessarily delivering a full, reliable, or stealthy attack tool.
Protocol Upgrade
A protocol upgrade is a negotiated switch of an existing connection from one application protocol to another—most commonly an HTTP/1.1 connection upgrading to WebSockets or another non-HTTP framed protocol using the HTTP Upgrade mechanism.
Prototype Pollution
Prototype Pollution is a JavaScript vulnerability in which untrusted input modifies Object.prototype (or other prototypes) via keys such as __proto__ or constructor.prototype, causing unexpected inherited properties that can escalate into XSS, logic bypasses, or remote code execution.
PTR Record
A PTR record is a DNS resource record used in reverse DNS to map an IP address back to a hostname, usually inside the in-addr.arpa or ip6.arpa namespaces.
Public Key Infrastructure (PKI)
Public Key Infrastructure (PKI) is the combination of policies, processes, technology, and Certificate Authorities that creates, distributes, manages, stores, and revokes digital certificates and public-key credentials used for authentication and encryption.
Public Storage Bucket
A public storage bucket is a cloud object store (such as S3, GCS, or Azure Blob) whose ACL, IAM policy, or anonymous-access setting allows anyone on the internet—or any principal in the cloud—to list or read objects without being an intended consumer.
Punycode
Punycode is an ASCII-compatible encoding that represents certain Unicode domain labels in a form beginning with xn-- so they can be transported through DNS and related protocols that expect ASCII text.
Purple Team
A purple team is a collaborative practice—sometimes a standing function—where offensive (red) and defensive (blue) specialists work together to emulate attacker techniques, observe detection outcomes in real time, and iteratively improve controls, alerts, and response playbooks.
Q
QUIC
QUIC is a modern transport protocol built on UDP that provides multiplexed, reliable streams with integrated TLS 1.3 encryption, connection migration, and reduced handshake latency—serving as the foundation for HTTP/3.
Quishing
Quishing is phishing that uses a QR code as the delivery mechanism so the victim’s camera—not a visible hyperlink—opens the malicious site, often bypassing email link rewriting, desktop hover checks, and hurried visual inspection.
R
Race Condition
A race condition is a flaw that occurs when a system’s behavior depends on the unpredictable timing or interleaving of concurrent operations, allowing attackers to perform actions twice, bypass checks, or corrupt state by winning a timing window.
Rate Limiting
Rate limiting is a control that restricts how many requests a client, user, IP, token, or other identity may make to a service within a time window, reducing abuse such as brute force, scraping, and resource exhaustion.
Recursive DNS Resolver
A recursive DNS resolver is a DNS server that accepts client queries, performs the necessary lookup chain on the client’s behalf, caches the results, and returns the final answer.
Red Team
A red team is an authorized group that simulates real-world adversaries to test an organization’s people, processes, and technology—pursuing specific objectives such as domain dominance or data theft—while measuring whether defenses detect and stop the intrusion path.
Referrer Policy
Referrer Policy is a web security and privacy mechanism—commonly set via an HTTP header or meta/referrerpolicy attributes—that controls how much referrer information the browser includes when navigating or loading resources.
Reflected XSS
Reflected XSS is a cross-site scripting vulnerability in which attacker-controlled input from a request is immediately included in the HTTP response without proper neutralization, so a victim who opens a crafted link executes attacker script in the trusted site’s origin.
Refresh Token
A refresh token is a long-lived OAuth credential issued to a client that can be presented to the authorization server’s token endpoint to obtain new access tokens—without interactively re-authenticating the resource owner each time.
Registrar Lock
Registrar lock is a registrar-managed protection state, commonly implemented through EPP status codes such as clientTransferProhibited, that helps prevent unauthorized domain transfers or updates unless the lock is removed first.
Registry Lock
Registry lock is a high-assurance domain protection service in which the registry places additional restrictions on sensitive changes and typically requires out-of-band, manually verified approval before transfers, updates, or deletions can proceed.
Regular Expression Denial of Service (ReDoS)
Regular Expression Denial of Service (ReDoS) is an availability attack in which a vulnerable regular expression—typically with nested quantifiers that cause catastrophic backtracking—takes extreme CPU time on carefully crafted input, stalling the process that evaluates it.
Remediation
Remediation is the set of actions that permanently remove or correct a security weakness—such as applying a patch, rewriting vulnerable code, rotating compromised credentials, or correctly configuring a control—so the underlying issue no longer exists in the affected environment.
Remote Code Execution (RCE)
Remote Code Execution (RCE) is a security impact in which an attacker can execute attacker-controlled code on a target system over a network—without physical access—usually by exploiting a vulnerability in an application, library, or service.
Remote File Inclusion (RFI)
Remote File Inclusion (RFI) is a vulnerability in which an application includes or executes a file from a remote URL based on user-controllable input, allowing attackers to supply malicious code hosted on their servers and often achieve remote code execution.
Replay Attack
A replay attack is a network or application attack in which an adversary captures a valid protocol message, token, or encrypted record and later retransmits it to trick a receiver into accepting the old message as a fresh, legitimate action—often without needing to decrypt or forge new cryptography.
Reporting API
The Reporting API is a browser mechanism that lets websites register collector URLs and receive structured reports about policy violations, deprecations, and other browser-generated events, typically delivered via asynchronous POST requests defined in Reporting-Endpoints.
Reporting-Endpoints
Reporting-Endpoints is an HTTP response header that registers named collector URLs for the Reporting API, letting browsers know where to send structured reports such as Content Security Policy violations, COOP issues, and deprecation warnings.
Representational State Transfer (REST)
Representational State Transfer (REST) is an architectural style for networked applications that models the system as resources identified by URIs, manipulated through uniform interface operations—commonly HTTP methods—and exchanged as representations such as JSON.
Reproducible Build
A reproducible build is a build process property where independent parties can rebuild software from the same source, dependencies, and environment definition and obtain the same output artifacts.
Resource Exhaustion
Resource exhaustion is a condition—often attacker-induced—in which an application or its host runs out of a finite resource such as CPU, memory, disk space, file descriptors, or network connections, causing failures, severe slowdowns, or denial of service for legitimate users.
Responsible Disclosure
Responsible disclosure is the practice of privately reporting a security vulnerability to the affected vendor or operator and allowing a reasonable window to investigate and fix before public details that would aid attackers are released—often formalized today as coordinated vulnerability disclosure (CVD).
REST API
A REST API is an application programming interface that exposes resources over HTTP using resource URIs, standard methods such as GET POST PUT PATCH and DELETE, and representations like JSON—following REST architectural constraints to varying degrees in real-world implementations.
Retrieval Poisoning
Retrieval poisoning is an attack that manipulates which documents a RAG or search pipeline returns—by inserting, promoting, or tampering with indexed content—so the LLM sees attacker-chosen context and treats it as trusted knowledge or instructions.
Retrieval-Augmented Generation (RAG)
Retrieval-Augmented Generation (RAG) is an architecture that looks up documents or records at query time, inserts the retrieved text into an LLM prompt, and asks the model to answer using that context rather than relying only on training weights.
Reverse DNS Lookup
A reverse DNS lookup is a Domain Name System query that resolves an IP address to a hostname, typically using pointer (PTR) records in the reverse DNS namespace such as in-addr.arpa or ip6.arpa.
Reverse Proxy
A reverse proxy is an intermediary that sits in front of one or more origin servers and handles inbound client requests—providing TLS termination, routing, caching, compression, and security controls while making the backends appear as a single service.
Reverse Tabnabbing
Reverse tabnabbing is an attack in which a page opened from a trusted site—typically via target=_blank—retains a reference to the original window through window.opener and navigates that original tab to a phishing page while the user focuses on the new tab.
Risk-Based Authentication
Risk-based authentication (RBA) is an authentication strategy that estimates the risk of a login or transaction from contextual signals and then allows, challenges, or denies the attempt according to policy thresholds.
ROBOT Attack
ROBOT (Return Of Bleichenbacher's Oracle Threat) is a practical revival of Bleichenbacher-style RSA PKCS#1 v1.5 padding-oracle attacks against TLS servers that still perform RSA key exchange and leak whether crafted RSA ciphertexts decrypt to correctly formatted premaster secrets—allowing attackers to decrypt or sign with the server’s RSA key under vulnerable conditions.
Rogue Access Point
A rogue access point is a wireless access point installed on a network without the organization’s approval—whether by an attacker, a well-meaning employee, or malware on a connected device—creating an unmonitored edge that can bypass wired controls, leak traffic, or intercept nearby clients.
Role-Based Access Control (RBAC)
Role-Based Access Control (RBAC) is an authorization model that assigns users to roles and grants permissions to those roles, so access decisions are based primarily on a principal’s role membership rather than on individual per-user permission lists.
Root Certificate
A root certificate is a self-signed X.509 certificate that acts as a trust anchor in a public key infrastructure; relying parties that trust the root can validate certificate chains ending at that anchor.
Rowhammer Attack
A Rowhammer attack is a hardware-oriented exploit technique that repeatedly accesses (hammers) rows in DRAM to induce electrical disturbance bit flips in adjacent rows, potentially corrupting data or undermining memory isolation used by security boundaries.
RSA
RSA is a public-key cryptosystem based on the practical difficulty of factoring large composite numbers; it supports encryption and digital signatures using a public exponent and modulus paired with a closely held private exponent.
Runtime Application Self-Protection (RASP)
Runtime Application Self-Protection (RASP) is a security control that instruments a running application so it can detect, alert on, or block suspicious behavior using runtime context from inside the application process.
S
Salt (Cryptography)
In cryptography, a salt is random data mixed with a password (or other secret) before hashing so that identical inputs produce different digests, defeating precomputed rainbow-table attacks and ensuring per-credential uniqueness.
Same-Origin Policy (SOP)
The Same-Origin Policy (SOP) is a fundamental browser security rule that restricts how documents or scripts from one origin can interact with resources from another origin, preventing arbitrary cross-site reads of sensitive data.
SameSite Cookie
SameSite is a cookie attribute that controls whether a browser includes a cookie on cross-site requests, with common values Strict, Lax, and None that trade CSRF resistance against cross-site functionality such as embeds and federated flows.
SAML (Security Assertion Markup Language)
SAML (Security Assertion Markup Language) is an XML-based open standard for exchanging authentication and authorization assertions between an identity provider and a service provider, commonly used to implement enterprise single sign-on.
Schema Validation
Schema validation is the practice of checking API requests—and sometimes responses—against a declared contract such as OpenAPI or JSON Schema so malformed types, missing required fields, oversized values, and unexpected properties are rejected before business logic runs.
scrypt
scrypt is a memory-hard password-based key-derivation function that mixes a large amount of RAM into its computation so that massively parallel password-guessing hardware becomes more expensive to operate.
Sec-Fetch-Dest
Sec-Fetch-Dest is a Fetch Metadata request header set by browsers that indicates the destination of a request—such as document, script, image, or empty—so servers can distinguish navigation from subresource loads and apply appropriate security policies.
Sec-Fetch-Mode
Sec-Fetch-Mode is a Fetch Metadata request header that tells the server how the browser issued the request—such as a top-level navigation, a CORS subresource fetch, or a no-cors embed—so servers can apply policy before handling the response.
Sec-Fetch-Site
Sec-Fetch-Site is a Fetch Metadata request header that tells the server the relationship between the origin of the resource that initiated the request and the origin of the target URL—same-origin, same-site, cross-site, or none.
Sec-Fetch-User
Sec-Fetch-User is a Fetch Metadata request header sent on navigations to indicate whether the request was triggered by a user activation such as a click, tap, or keyboard submit—?1 for yes and ?0 for no.
Second-Level Domain (SLD)
A second-level domain (SLD) is the label directly to the left of the top-level domain in a domain name—for example, the example in example.com—typically the name an organization registers and controls under a TLD.
Secret Scanning
Secret scanning is the automated detection of exposed credentials, tokens, keys, passwords, and other sensitive values in code, commits, build logs, artifacts, tickets, and collaboration systems.
Secrets Management
Secrets management is the controlled storage, issuance, access, rotation, auditing, and revocation of sensitive credentials such as passwords, API keys, tokens, certificates, and encryption keys.
Secrets Manager
A secrets manager is a managed service that stores encrypted credentials, issues them to authenticated identities over an API, records access, and often rotates values on a schedule so applications do not keep long-lived secrets in code, images, or local files.
Secure by Default
Secure by default is the practice of shipping systems with safe initial configurations, permissions, behaviors, and guardrails enabled so users receive meaningful protection without extra setup.
Secure by Design
Secure by design is the engineering practice of making security a core design requirement from the start, so systems resist foreseeable misuse through architecture, controls, defaults, and lifecycle decisions.
Secure Cookie
A Secure cookie is a cookie marked with the Secure attribute so browsers only send it on encrypted HTTPS (and other secure) requests, preventing transmission over cleartext HTTP where network attackers could read or inject cookie values.
Secure Hash Algorithm 2 (SHA-2)
Secure Hash Algorithm 2 (SHA-2) is a family of cryptographic hash functions—including SHA-256, SHA-384, and SHA-512—that map arbitrary input to a fixed-length digest used for integrity checks, digital signatures, and keyed constructions such as HMAC.
Secure Hash Algorithm 3 (SHA-3)
Secure Hash Algorithm 3 (SHA-3) is a NIST hash function family based on the Keccak sponge construction, providing fixed-length digests such as SHA3-256 and extensible-output functions (SHAKE) as an alternative structural design to SHA-2.
Secure Software Development Lifecycle (SSDLC)
The Secure Software Development Lifecycle (SSDLC) is an SDLC model that integrates security activities, evidence, and accountability into every phase of software delivery.
Security Assertion
A security assertion is a signed statement issued by a trusted identity authority that conveys authentication, attribute, or authorization claims about a subject so a relying party can establish a session or make an access decision without directly verifying the primary credentials.
Security Group
A security group is a cloud virtual firewall attached to network interfaces or instances: it allows specified ingress and egress traffic (usually stateful) and implicitly denies the rest, acting as the first packet filter in front of VMs, load balancers, and many managed services.
Security Information and Event Management (SIEM)
Security Information and Event Management (SIEM) is a platform that collects, normalizes, stores, and analyzes security and operational logs from many sources so teams can search history, correlate events, generate alerts, and support investigations and compliance reporting.
Security Logging and Alerting Failures
Security Logging and Alerting Failures is an OWASP Top 10 category (A09:2021 Security Logging and Monitoring Failures) covering insufficient, tamperable, or unused logs and alerts—so attacks, abuse, and breaches are not detected, investigated, or responded to in time.
Security Misconfiguration
Security Misconfiguration is an OWASP Top 10 category (A05:2021) covering insecure or incomplete configuration of applications, frameworks, servers, cloud services, and permissions—including default credentials, unnecessary features, verbose errors, and missing security headers or patches.
Security Operations Center (SOC)
A Security Operations Center (SOC) is the people, process, and technology function that continuously monitors an organization’s environment, triages alerts, investigates suspicious activity, and coordinates response—often around the clock.
Security Orchestration, Automation and Response (SOAR)
Security Orchestration, Automation and Response (SOAR) is a capability that connects security tools through playbooks so routine enrichment, case handling, and approved response actions run consistently—with humans remaining in control of high-impact decisions.
Security Token
A security token is a digital credential that a client presents to prove authentication or authorization state—such as an OAuth access token, OpenID Connect ID token, SAML assertion, or application session token—so a service can make an access decision without recollecting primary credentials.
Self-Signed Certificate
A self-signed certificate is an X.509 certificate signed with its own private key rather than by a separate Certificate Authority, so it asserts identity without a third-party CA signature in the public trust system.
Sender Policy Framework (SPF)
Sender Policy Framework (SPF) is an email-authentication mechanism in which a domain publishes a DNS TXT record listing which hosts are allowed to send mail for that domain in envelope-level SMTP contexts.
Sender-Constrained Token
A sender-constrained token is an access credential that is cryptographically bound to a client key so that presenting the token alone is insufficient—the caller must also prove possession of the bound private key, typically via mutual TLS or DPoP proofs.
Sensitive Data Exposure
Sensitive Data Exposure is a vulnerability class in which applications or infrastructure fail to adequately protect confidential information at rest or in transit—through missing encryption, weak cryptography, cleartext channels, or excessive retention—so attackers who gain access can read secrets, personal data, or business-critical records.
Sensitive Information Disclosure
Sensitive information disclosure in LLM applications is the unintended release of confidential data—PII, credentials, proprietary documents, or other tenants’ context—through model completions, tool results, logs, or retrieved snippets that the application should have kept private.
Server-Sent Events (SSE)
Server-Sent Events (SSE) are a web technology for one-way, long-lived HTTP streams where a server pushes text events to a browser or client over a persistent connection, commonly using the text/event-stream media type.
Server-Side Include Injection (SSI)
Server-Side Include Injection (SSI) is a vulnerability in which untrusted input is incorporated into a page that the web server parses for SSI directives—such as <!--#include --> or <!--#exec -->—allowing attackers to disclose files, leak environment data, or execute commands when SSI is enabled.
Server-Side Prototype Pollution
Server-Side Prototype Pollution is a Node.js (and similar JS runtime) vulnerability in which untrusted JSON or objects are deep-merged or cloned unsafely, allowing attackers to modify Object.prototype and influence server logic, configuration, or dangerous APIs—sometimes escalating to remote code execution.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) is a vulnerability in which an attacker causes a server to make HTTP or other network requests to unintended destinations—often internal services or cloud metadata endpoints—by supplying or influencing request URLs.
Server-Side Template Injection (SSTI)
Server-Side Template Injection (SSTI) is a vulnerability that occurs when untrusted input is embedded into a server-side template and evaluated by the template engine, allowing attackers to inject template expressions that can lead to information disclosure or remote code execution.
Serverless Security
Serverless security is the practice of protecting event-driven functions and managed backends (FaaS, BaaS) where the provider runs the host: identity, event inputs, dependencies, secrets, and downstream permissions become the control surface instead of SSH and patch windows.
Service Mesh
A service mesh is an infrastructure layer that manages service-to-service communication—typically via sidecar or node proxies—providing features such as mTLS, traffic routing, retries, observability, and policy enforcement without changing each application’s business code.
Session Fixation
Session fixation is an attack in which an adversary establishes or obtains a known session identifier and tricks a victim into authenticating under that same session ID, allowing the attacker to reuse the authenticated session afterward.
Session Hijacking
Session hijacking is an attack in which an adversary takes over a legitimate user’s authenticated session—typically by stealing, predicting, or otherwise obtaining the session token—and then impersonates that user without needing their password.
Session Management
Session management is the set of controls that create, maintain, rotate, and destroy authenticated sessions so that users remain securely identified across requests without repeatedly sending passwords.
Session Replay
Session replay is the reuse of a previously captured user session—typically by resubmitting stolen cookies, bearer tokens, or recorded request sequences—so an attacker can act as that user later, without performing a new login. The same name also describes client-side recording tools that capture DOM, clicks, and keystrokes and can leak secrets if they are misconfigured.
Shadow AI
Shadow AI is the unsanctioned use of AI systems—public chatbots, browser extensions, coding agents, or personal MCP servers—for work data and workflows, outside IT’s approved models, logging, and contractual controls.
Shadow API
A shadow API is an application programming interface—or a set of endpoints—that is reachable in an environment but missing from the official inventory, documentation, or governance process, so it operates without expected ownership, monitoring, testing, or security review.
Shellshock (CVE-2014-6271)
Shellshock, primarily tracked as CVE-2014-6271 (with related follow-on CVEs), is a critical Bash vulnerability where specially crafted environment variables could still execute trailing commands after a function definition—allowing attackers to run arbitrary shell commands on systems that launched Bash with untrusted environment input, famously including CGI web servers.
Shift Left Security
Shift left security is the practice of moving security feedback earlier in the software delivery process so teams can prevent or fix risk before release.
Shoulder Surfing
Shoulder surfing is a social-engineering and physical-observation attack in which an adversary watches, films, or otherwise captures a person’s screen, keypad, or gestures to obtain passwords, PINs, MFA codes, or sensitive data without touching the victim’s device.
Side-Channel Attack
A side-channel attack extracts sensitive information by observing indirect effects of computation—such as timing, power consumption, cache behavior, electromagnetic emissions, or acoustic signals—rather than by breaking cryptographic algorithms mathematically.
SIM Swapping
SIM swapping (or SIM jacking) is a social-engineering and carrier-process attack in which an adversary convinces a mobile operator to move a victim’s phone number to a SIM the attacker controls, enabling interception of calls, SMS one-time passwords, and account-recovery messages.
Simple Object Access Protocol (SOAP)
Simple Object Access Protocol (SOAP) is an XML-based messaging protocol for exchanging structured information between applications—typically over HTTP—using envelopes, optional WSDL contracts, and a family of WS-* extensions for security, addressing, and reliability.
Single Sign-On (SSO)
Single Sign-On (SSO) is an authentication architecture that lets users access multiple applications with one set of credentials and a shared login session, typically mediated by a central identity provider using protocols such as SAML or OpenID Connect.
Slowloris
Slowloris is an application-layer denial-of-service technique that opens many HTTP connections to a target and keeps them open by sending headers or body data extremely slowly—or never finishing the request—so worker threads or connection slots stay occupied until legitimate clients are starved.
Small Language Models
Small Language Models (SLMs) are compact neural language models—typically with far fewer parameters than frontier large language models—designed to run efficiently on modest hardware, edge devices, or cost-constrained environments while still performing useful language tasks.
Smishing
Smishing is phishing delivered through SMS or other mobile text channels, using a short, urgent message and a link, callback number, or attachment prompt to trick the recipient into revealing credentials, one-time codes, payment details, or device access.
SMTP TLS Reporting (TLS-RPT)
SMTP TLS Reporting (TLS-RPT) is a reporting mechanism in which a domain publishes a DNS policy telling participating senders where to send aggregated reports about failures encountered while applying SMTP transport-security policies such as MTA-STS or DANE.
SOA Record
An SOA record, or Start of Authority record, is the DNS record at the top of a zone that declares core administrative metadata such as the primary source, serial number, and refresh-related timers.
Social Engineering
Social engineering is the practice of manipulating people into taking unsafe actions or revealing sensitive information by exploiting trust, authority, fear, helpfulness, or routine—rather than by exploiting a software vulnerability as the primary step.
Software Bill of Materials (SBOM)
A Software Bill of Materials (SBOM) is a structured inventory of software components, dependencies, versions, suppliers, and relationships associated with an application or artifact.
Software Composition Analysis (SCA)
Software Composition Analysis (SCA) is the automated identification and assessment of third-party and open-source components for vulnerabilities, license obligations, policy violations, and supply-chain risk.
Software Development Lifecycle (SDLC)
The Software Development Lifecycle (SDLC) is the structured process teams use to plan, design, build, test, release, operate, and maintain software.
Software or Data Integrity Failures
Software or Data Integrity Failures is an OWASP Top 10 category (A08:2021) covering assumptions that software updates, CI/CD artifacts, critical data, and serialized objects are trustworthy without verifying integrity—enabling supply-chain compromise, unsigned updates, and insecure deserialization attacks.
Software Supply Chain Attack
A software supply chain attack is an intentional compromise of software components, development systems, build pipelines, distribution channels, or trusted vendors to reach downstream users or systems.
Software Supply Chain Failures
Software supply chain failures are weaknesses in dependency, build, artifact, update, or integrity controls that allow untrusted or unverified software changes to enter systems.
Spear Phishing
Spear phishing is a targeted phishing attack aimed at a specific individual, role, or organization, using researched personal or business context so the lure looks like a genuine message from a colleague, partner, or service the victim already expects to hear from.
Spectre
Spectre is a family of speculative execution vulnerabilities in which attackers trick a CPU into transiently executing instructions that access secret data, then recover that data through microarchitectural side channels such as cache timing—often across process, sandbox, or privilege boundaries.
Speculative Execution Attack
A speculative execution attack abuses CPU performance features that execute instructions before it is certain they should run, leaving microarchitectural side effects—especially in caches—that attackers measure to infer secret data across security boundaries.
Split-Horizon DNS
Split-horizon DNS is a DNS design in which the same hostname can return different answers depending on where the query comes from or which DNS view handles it.
SQL Injection (SQLi)
SQL Injection (SQLi) is a vulnerability in which untrusted input is interpreted as part of a SQL statement, allowing attackers to alter query logic to read, modify, or destroy database data—and sometimes execute commands on the database server.
SRV Record
An SRV record is a DNS resource record that tells clients which host and port provide a named service, along with priority and weight values for selection behavior.
SSL/TLS
SSL/TLS refers to cryptographic protocols that secure network communications—historically Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS)—providing confidentiality, integrity, and server (and optionally client) authentication for protocols such as HTTPS.
Stack Buffer Overflow
A stack buffer overflow is a buffer overflow that occurs in a stack-allocated buffer, allowing excess data to overwrite adjacent stack memory such as saved registers, security cookies, or return addresses and potentially redirect program control flow.
Stack Trace Exposure
Stack Trace Exposure is an information disclosure flaw in which exception call stacks—class names, methods, line numbers, and filesystem paths—are returned to clients in HTTP responses or emails, revealing application structure and aiding further attacks.
Static Application Security Testing (SAST)
Static Application Security Testing (SAST) is security analysis of source code, bytecode, or binaries without running the application, usually to identify insecure patterns and dataflow risks early in development.
Step-Up Authentication
Step-up authentication is the practice of requiring an additional or stronger authenticator challenge for sensitive actions or elevated risk—even when the user already has a valid low-assurance session—so high-impact operations get fresh, higher-assurance proof.
Stored XSS
Stored XSS (persistent cross-site scripting) is a vulnerability in which attacker-supplied script is saved by the application—in a database, CMS, comment field, or other storage—and later delivered to other users’ browsers as if it were trusted content.
Subdomain
A subdomain is a DNS name that sits under a parent domain—for example api.example.com under example.com—created by adding one or more labels to the left of the parent name to identify a specific host, service, or site.
Subdomain Takeover
A subdomain takeover is the hijacking of a subdomain because its DNS still points to a deprovisioned or claimable external service that an attacker can register or control.
Subject Alternative Name (SAN)
Subject Alternative Name (SAN) is an X.509 certificate extension that lists additional identities—most commonly DNS names or IP addresses—that the certificate is authorized to represent, and it is the primary hostname identity field for modern public TLS validation.
Subject Claim (sub)
The subject claim (sub) is a registered JWT claim that identifies the principal that is the subject of the token—typically a user, service account, or client—providing a stable identifier relying parties use after validation to key authorization and audit decisions.
Subresource Integrity (SRI)
Subresource Integrity (SRI) is a browser security feature that lets pages specify cryptographic hashes for external scripts and stylesheets so the browser loads them only if the fetched content matches the expected integrity value.
Supply-chain Levels for Software Artifacts (SLSA)
Supply-chain Levels for Software Artifacts (SLSA) is a security framework for improving software supply chain integrity through defined build levels, provenance requirements, and controls that reduce tampering risk.
SWEET32 (CVE-2016-2183)
SWEET32, associated with CVE-2016-2183 (and related findings), is a practical birthday-bound attack against 64-bit block ciphers such as 3DES and Blowfish in TLS and other protocols: after enough data is encrypted under one session key, colliding ciphertext blocks can leak plaintext information about HTTPS cookies and similar secrets.
Symmetric Cryptography
Symmetric cryptography uses the same secret key material for corresponding protection and verification operations—such as encrypting and decrypting with AES or computing and verifying an HMAC—making it efficient for bulk data protection once keys are established.
System for Cross-Domain Identity Management (SCIM)
System for Cross-Domain Identity Management (SCIM) is a standardized HTTP-based protocol for creating, reading, updating, and deleting user and group identities across domains—commonly used to automate provisioning from an identity provider into SaaS applications.
System Prompt
A system prompt is the developer- or product-supplied instruction block placed in an LLM’s context (often with a privileged role) to set identity, tone, tool policy, and task rules before user messages and retrieved documents are added.
T
Tabnabbing
Tabnabbing is a phishing technique in which an attacker-controlled page silently changes a background browser tab to resemble a legitimate login screen—often after the user leaves the tab idle—so the victim returns and submits credentials to the fake page.
Tactics, Techniques and Procedures (TTP)
Tactics, Techniques and Procedures (TTPs) describe how adversaries operate: the tactical goals they pursue, the techniques they use to achieve them, and the specific procedures or implementations observed in real campaigns.
Third-Party Cookie
A third-party cookie is a cookie used in a cross-site context—typically set or sent by a different site than the one in the browser’s address bar—often through embedded content such as iframes, pixels, or third-party scripts.
Threat Intelligence
Threat intelligence is processed, contextual knowledge about adversaries, their capabilities, infrastructure, and intent—used to prioritize defenses, detections, and response rather than raw lists of indicators alone.
Threat Modeling
Threat modeling is a structured security practice for identifying likely threats, abuse cases, trust boundaries, and mitigations in a system before attackers can exploit design weaknesses.
Time-Based One-Time Password (TOTP)
Time-Based One-Time Password (TOTP) is an algorithm that generates short numeric codes from a shared secret and the current time step, defined in RFC 6238 and widely implemented by authenticator apps as a second authentication factor.
Time-Based SQL Injection
Time-based SQL injection is a blind SQL injection technique in which attackers infer database information by intentionally delaying query execution—using functions such as SLEEP or WAITFOR—and measuring whether responses take longer based on true or false conditions.
Time-of-Check to Time-of-Use (TOCTOU)
Time-of-Check to Time-of-Use (TOCTOU) is a race-condition pattern in which a program validates a condition (the check) and later acts on a resource assuming the condition still holds (the use), while an attacker changes the resource in between and bypasses the intended control.
TLS 1.2
TLS 1.2 is a Transport Layer Security protocol version standardized in RFC 5246 that authenticates endpoints, negotiates cryptographic parameters, and encrypts application data; it remains widely deployed but requires careful configuration to avoid obsolete cipher suites and lacking forward secrecy.
TLS 1.3
TLS 1.3 is the Transport Layer Security protocol version defined in RFC 8446 that mandates ephemeral key agreement, AEAD-only record protection, a simplified cipher suite list, and a reduced-round-trip handshake for securing network communications.
TLS Downgrade Attack
A TLS downgrade attack is a man-in-the-middle technique that interferes with protocol negotiation so a client and server agree on an older TLS version, weaker cipher suite, or otherwise reduced security mode that the attacker can more easily exploit.
TLS Handshake
A TLS handshake is the initial negotiation in which a client and server agree on protocol parameters, authenticate one or both parties with certificates, establish shared secrets, and derive keys that protect subsequent application data records.
TLSA Record
A TLSA record is a DNS resource record used by DANE to publish DNSSEC-protected information about the certificate, public key, or issuing authority that a TLS service is expected to use.
Token Exchange
Token exchange is an OAuth 2.0 extension (RFC 8693) that lets a client present an existing security token to an authorization server and receive a new token—often with a different audience, scope set, or actor identity—for controlled delegation between APIs and services.
Token Introspection
Token introspection is an OAuth 2.0 protocol that lets a protected resource query the authorization server to determine the active state and metadata of an access or refresh token—commonly used when tokens are opaque rather than self-contained JWTs.
Token Replay
Token replay is an attack in which an adversary captures a valid security token—such as a session cookie, OAuth access token, refresh token, or federation assertion—and reuses it to impersonate the legitimate subject until the token expires or is revoked.
Token Revocation
Token revocation is the process of actively invalidating a previously issued security token—such as an OAuth access or refresh token—so it can no longer be used to obtain access, typically via an authorization server revocation endpoint or internal session store updates.
Tool Poisoning
Tool poisoning is an attack that tampers with the tools an LLM agent can call—their names, descriptions, schemas, implementations, or returned data—so the model follows hidden instructions, calls the wrong API, or exfiltrates context while believing it is using a legitimate capability.
Top-Level Domain (TLD)
A Top-Level Domain (TLD) is the rightmost label in a DNS name—such as .com, .org, or .uk—that sits at the highest level of the public DNS hierarchy beneath the root and categorizes or geographically associates domains registered under it.
Training Data Leakage
Training data leakage is the disclosure of information that a model memorized during training or fine-tuning—often as verbatim or near-verbatim text—so users or attackers can recover secrets, personal data, or proprietary documents that were in the training corpus.
Training Data Poisoning
Training data poisoning is the deliberate contamination of datasets used to train, fine-tune, or align a model so the resulting weights behave incorrectly—for example by inserting a backdoor, shifting answers on a topic, or causing targeted failures—while ordinary benchmarks still look acceptable.
Transfer-Encoding
Transfer-Encoding is an HTTP message header that specifies encodings applied to the payload body so it can be safely transferred—most notably chunked, which sends the body as a sequence of chunks—while defining how receivers determine message boundaries on the wire.
Trust Anchor
A trust anchor is a public key and associated identity information that a relying party explicitly trusts as a starting point for certificate path validation—commonly represented by a root certificate in an operating system or application trust store.
Trust Chain
A trust chain is the validated sequence of certificates and signatures that connects a presented end-entity certificate to a trust anchor a relying party already accepts, establishing cryptographic trust for that subject under PKI policy.
Trusted Types
Trusted Types is a browser security mechanism that restricts assignment of raw strings to dangerous DOM sinks—such as innerHTML, eval-like APIs, and script URLs—requiring values created through developer-defined policies that return TrustedHTML, TrustedScript, or TrustedScriptURL objects.
TrustedHTML
TrustedHTML is a Trusted Types object representing HTML markup that a browser policy has explicitly produced as safe for assignment to HTML-interpreting DOM sinks such as Element.innerHTML.
TrustedScript
TrustedScript is a Trusted Types object representing JavaScript source text that a policy has explicitly produced as allowable for assignment to script-code sinks such as eval, Function constructors, or similar guarded APIs when Trusted Types are enforced.
TrustedScriptURL
TrustedScriptURL is a Trusted Types object representing a URL that a policy has explicitly approved for use in script-loading sinks such as HTMLScriptElement.src when Trusted Types are enforced.
TTL (Time to Live)
TTL, or Time to Live, is the number of seconds a DNS answer may be cached before a resolver or client should refresh it from an authoritative source.
TXT Record
A TXT record is a DNS resource record that stores text strings, commonly used for domain verification, email authentication policies, and other application-specific metadata.
Type Confusion
Type confusion is a vulnerability in which a program interprets a value or object as a different type than it actually is—often via unsafe casts—so field offsets and method tables are wrong, enabling out-of-bounds access, corrupted state, or code execution.
Typosquatting
Typosquatting is the practice of registering domain names, packages, or other identifiers that closely resemble popular brands or projects—often via typos, alternate TLDs, or confusing characters—to trick users into visiting malicious sites or installing malicious software.
U
Unbounded Consumption
Unbounded consumption is an LLM application failure in which missing limits on tokens, requests, context size, or tool-using loops allow a user or attacker to exhaust money, GPU time, or downstream quotas—without needing to ‘break’ the model’s answers.
Unicode Normalization Attack
A Unicode Normalization Attack abuses differences between Unicode forms (such as NFC vs NFKC), homoglyphs, and best-fit mappings so that a string fails or passes a security filter in one representation but becomes dangerous after the application, filesystem, or database normalizes it to another form.
Uninitialized Memory
Uninitialized memory vulnerabilities occur when a program uses memory whose contents have not been set to a defined value—leaking residual data from previous use, causing nondeterministic behavior, or enabling further memory corruption when stale pointers or lengths are trusted.
Universal XSS (UXSS)
Universal XSS (UXSS) is a class of vulnerabilities—typically in browsers, extensions, or platform components—that allow an attacker to execute script in the context of arbitrary or unintended origins, bypassing the usual same-origin boundaries that contain ordinary website XSS.
Unrestricted Access to Sensitive Business Flows
Unrestricted access to sensitive business flows is an API risk where critical processes—such as purchasing limited goods, creating accounts, redeeming rewards, or booking appointments—can be automated or exploited at scale because the API lacks sufficient business logic protections beyond basic authentication.
Unrestricted File Upload
Unrestricted File Upload (CWE-434) is a vulnerability in which an application accepts files without adequate restrictions on type, size, extension, or content—allowing attackers to upload dangerous formats that the server or other users later process or execute.
Unrestricted Resource Consumption
Unrestricted resource consumption is an API security risk where missing or weak limits on request size, execution cost, allocation, or call rate allow clients to exhaust CPU, memory, storage, network, or third-party quotas—causing denial of service or runaway cloud spend.
Unsafe Consumption of APIs
Unsafe consumption of APIs is a security weakness where an application trusts data from upstream or third-party APIs without sufficient validation, authentication verification, integrity checks, or least-privilege handling—allowing malicious or malformed responses to compromise the consumer.
Use-After-Free
Use-After-Free (UAF) is a memory safety vulnerability in which a program continues to use a pointer to memory after that memory has been freed, so a later allocation may occupy the same address and attacker-controlled data is interpreted as a live object.
V
Vector and Embedding Weaknesses
Vector and embedding weaknesses are security flaws in how embeddings are created, stored, queried, and authorized—allowing attackers to leak private chunks, invert vectors, poison neighbors, or bypass document ACLs through similarity search rather than through a traditional file download.
Vector Database
A vector database stores high-dimensional embeddings and retrieves nearest neighbors by similarity. In AI applications it is the index behind semantic search and RAG, returning document chunks whose vectors are close to a query vector.
Verbose Error Message
A Verbose Error Message is an application or framework failure response that returns excessive technical detail to the client—such as SQL fragments, file paths, configuration hints, library versions, or internal identifiers—giving attackers reconnaissance data they can use to refine further exploits.
Virtual Host
A virtual host is a configuration that allows one server or reverse proxy to host multiple websites or applications—usually distinguished by hostname (name-based) or by IP address—so many domains can share the same infrastructure.
Vishing
Vishing is voice-based phishing: a social-engineering attack conducted over a phone call in which the adversary impersonates a trusted institution, colleague, or vendor to extract secrets, payments, or remote access while adapting the story in real time.
Vulnerability Assessment
A vulnerability assessment is a systematic process of identifying, classifying, and ranking security weaknesses in systems, applications, or networks—usually emphasizing breadth of coverage and actionable inventories rather than deep manual exploitation.
Vulnerability Exploitability eXchange (VEX)
Vulnerability Exploitability eXchange (VEX) is a machine-readable security advisory format that states whether a specific product or component is affected by a known vulnerability and explains the status.
Vulnerability Management
Vulnerability management is the continuous process of identifying, prioritizing, remediating, accepting, and verifying security weaknesses across software, infrastructure, identities, and third-party components.
W
Watering-Hole Attack
A watering-hole attack is a strategy in which adversaries compromise or inject hostile content into a website that a chosen community already trusts and visits—industry forums, vendor documentation, local news, or hobby sites—so targets are infected or phished during ordinary browsing rather than by a lure they must click in email.
Web Application Firewall (WAF)
A Web Application Firewall (WAF) is a security control that monitors, filters, and blocks HTTP/HTTPS traffic to and from a web application based on rules and models designed to detect attacks such as SQL injection, XSS, and known exploit patterns.
Web Authentication API (WebAuthn)
The Web Authentication API (WebAuthn) is a W3C standard browser API that lets web applications register and authenticate users with public-key credentials held by authenticators—forming the web half of FIDO2 passwordless and MFA experiences such as passkeys.
Web Cache Deception
Web cache deception is an attack that tricks a shared HTTP cache into storing a victim’s authenticated or otherwise private response under a public-looking URL—often by appending a static-looking path suffix—so the attacker can later retrieve that cached private content without the victim’s session.
Web Cache Poisoning
Web cache poisoning is an attack on shared HTTP caches—such as CDNs and reverse proxies—where an adversary causes a harmful or unintended response to be stored under a cache key that innocent visitors later reuse, delivering attacker-controlled content without a direct compromise of each victim's session.
WebAuthn Attestation
WebAuthn attestation is optional cryptographic evidence produced during credential registration that can help a relying party verify characteristics of the authenticator—such as manufacturer, model, or certification status—rather than only receiving an anonymous public key.
WebAuthn Authenticator
A WebAuthn authenticator is a hardware or platform component that generates and stores public-key credentials and produces signed WebAuthn assertions—such as a laptop’s secure enclave, a phone’s passkey provider, or a USB/NFC security key.
WebAuthn Relying Party
A WebAuthn relying party (RP) is the web application or service that initiates WebAuthn registration and authentication ceremonies, stores public credentials, and verifies authenticator assertions—identified by an RP ID typically derived from its effective domain.
Webhook
A webhook is an HTTP callback mechanism where a provider sends an event notification—usually a POST with a JSON payload—to a URL you register, so your system can react to changes without continuously polling the provider’s API.
WebSocket
A WebSocket is a communications protocol that provides a full-duplex, persistent channel between client and server over a single TCP connection—typically established via an HTTP Upgrade handshake and often secured as WSS over TLS.
WebSockets Security
WebSockets security is the set of practices that protect bidirectional WebSocket connections—authenticating endpoints, authorizing messages, encrypting transport with WSS, and validating untrusted message payloads against injection, hijacking, and abuse.
White-Box Testing
White-box testing is a security evaluation approach where testers have full internal knowledge of the system—including source code, architecture, configuration, and design documentation—so they can analyze implementation details and verify controls beyond what runtime probing alone reveals.
WHOIS
WHOIS is a query protocol and ecosystem historically used to look up registration data for Internet resources—especially domain names—returning registrant, registrar, and nameserver information; modern practice increasingly uses RDAP with privacy-redacted outputs.
Wildcard Certificate
A wildcard certificate is an X.509 TLS certificate whose subject alternative name uses a wildcard DNS label (typically *.example.com) so a single certificate can authenticate many hostnames under one parent domain.
Workload Identity
Workload identity is a pattern that gives applications, pods, functions, and CI jobs their own short-lived cloud credentials by federating a platform identity (Kubernetes service account, environment identity, or OIDC token) into Cloud IAM—instead of distributing long-lived access keys.
X
X-Content-Type-Options
X-Content-Type-Options is an HTTP response header whose nosniff value tells browsers to respect the declared Content-Type and not MIME-sniff responses into a different type—reducing certain XSS and content confusion attacks.
X-Forwarded-For
X-Forwarded-For is a de-facto standard HTTP request header that lists the client IP addresses observed as a request passes through proxies and load balancers, with each trusted hop typically appending the address it saw on the inbound connection so backends can recover the original client IP behind TLS-terminating infrastructure.
X-Forwarded-Host
X-Forwarded-Host is a de-facto standard HTTP request header that carries the Host header value the client originally sent to an edge proxy, allowing backends behind TLS terminators and load balancers to perform virtual-host routing, generate correct absolute URLs, and enforce tenant isolation when the direct connection Host names the internal service instead of the public hostname.
X-Forwarded-Proto
X-Forwarded-Proto is a de-facto standard HTTP request header set by reverse proxies and load balancers to indicate whether the client originally connected over HTTP or HTTPS, enabling backends that receive plain HTTP on private networks to generate correct absolute URLs, enforce TLS redirects, and apply secure cookie policies based on the external scheme.
X-Frame-Options
X-Frame-Options is an HTTP response header that controls whether a browser may render a page in a frame, iframe, embed, or object—historically used as a primary defense against clickjacking by restricting who can embed the page.
X-XSS-Protection
X-XSS-Protection is a legacy HTTP response header that enabled or configured browser XSS filters (auditors). Modern browsers have removed these filters; the header is obsolete and should not be relied on for XSS defense.
X.509 Certificate
An X.509 certificate is a standardized digital document that binds a public key to an identity (such as a DNS name) and is signed by a trusted issuer, enabling relying parties to authenticate that identity in protocols like TLS.
XML External Entity (XXE) Injection
XML External Entity (XXE) injection is an attack against XML parsers that process Document Type Definitions (DTDs), allowing adversaries to define external entities that disclose files, trigger SSRF-like requests, or cause denial of service when untrusted XML is parsed insecurely.
XPath Injection
XPath Injection is an attack technique that manipulates XML Path Language (XPath) queries by injecting metacharacters or crafted fragments into application inputs, causing unauthorized data disclosure, authentication bypass, or unintended XML node selection.
XS-Leaks
XS-Leaks (cross-site leaks) are a family of web attacks that infer private information about a user’s interaction with a victim site by abusing cross-origin side channels—such as timing, framing, caching, or window APIs—without directly reading the victim origin’s DOM.
Z
Zero Trust Architecture
Zero Trust Architecture (ZTA) is a cybersecurity approach that assumes no implicit trust based on network location—every access request must be authenticated, authorized, and continuously evaluated against policy using identity, device posture, and context.
Zero-Day Exploit
A zero-day exploit is attack code that takes advantage of a previously unknown software vulnerability—one for which the vendor has had “zero days” of public notice to develop and distribute a patch—often used before defenders can apply mitigations.
Zip Bomb
A zip bomb is a malicious ZIP (or similar archive) crafted so that decompression produces an enormous amount of data relative to the small compressed file—often via nested archives or overlapping compressed streams—exhausting disk, memory, or CPU during extraction.
Zip Slip
Zip Slip is an archive extraction vulnerability in which malicious entries use path traversal sequences (such as ../) in their filenames so that, when extracted, files are written outside the intended directory—often overwriting application code, configuration, or system files.
Zombie API
A zombie API is a deprecated, unused, or supposedly retired API—or API version—that remains reachable and functional in production without active ownership, patching, or monitoring, creating lingering attack surface that security programs often overlook.
Zone Transfer (AXFR/IXFR)
A zone transfer is the replication of DNS zone data between authoritative servers, typically using AXFR for full copies or IXFR for incremental changes.