2.3 - CompTIA Security+

Memory injection

Security flaws that occur when an attacker injects malicious code into an application’s process memory.

Buffer

An area of memory that an application reserves to store expected data.

Buffer overflow

A vulnerability that occurs when an attacker passes data that deliberately overfills the buffer.

Race condition vulnerabilities

Software flaws associated with the timing or order of events within a software program.

Time-of-check (TOC)

A race condition vulnerability that occurs when there is a change in a resource due to it being checked.

Time-of-use (TOU)

A race condition vulnerability that occurs when there is a resource change after it has been checked but before it is used.

Malicious update

An update that appears legitimate but contains harmful code, used by cybercriminals to distribute malware.

Structured Query Language injection (SQLi)

An attack that injects a malicious query to retrieve sensitive information from a database.

Cross-site scripting (XSS)

Web-based attack where attackers inject a malicious script on a trusted site to compromise clients.

End-of-life (EOL)

A product or version declared no longer supported by the manufacturer, leading to vulnerabilities.

Legacy systems

Outdated systems that continue to be used despite their shortcomings.

Virtual machine (VM) escape

A security vulnerability where an attacker escapes a virtual machine to access the host system.

Resource reuse

When data or resources from one VM are used by another, potentially creating vulnerabilities.

Cloud-specific attacks

Attacks targeting applications hosted on cloud platforms, exploiting misconfigurations or weak authentication.

Software supply chain

Vulnerabilities introduced to software products during their development and maintenance.

Service providers

Entities that offer services related to software development or deployment, potentially introducing vulnerabilities.

Hardware supplier

Companies providing physical components for IT systems, whose neglect can lead to vulnerabilities.

Software provider

Applications and frameworks used in development; their compromise can expose entire applications to attacks.

Cryptographic vulnerabilities

Weaknesses in cryptographic systems that can be exploited to compromise data.

Misconfiguration vulnerabilities

Errors in security control implementation that expose systems to unauthorized access.

Rooting

Gaining administrative privileges on an Android device to modify system files or install custom ROMs.

Side loading

Installation of applications from unofficial sources that may expose users to malware.

Jailbreaking

Gaining full access to an iOS device by removing limitations imposed by the iOS operating system.

Zero-day attacks

Exploits against previously unknown software/hardware flaws before they are fixed by developers.