Vulnerability Types
Overview
This document provides an overview of the different types of vulnerabilities that can be found in software. It is important to understand the different types of vulnerabilities in order to effectively secure software.
Common Vulnerability Types
Fortworx uses a set of common vulnerability types to categorize vulnerabilities. These vulnerability types are based on a combination of various different sources. When analyzing inbound reports, Fortworx uses these vulnerability types to categorize the vulnerabilities. If a vulnerability does not fit into one of these categories, it is not categorized under any vulnerability type.
SQL Injection
Max severity 10A code injection technique that exploits vulnerabilities in an application's software by inserting malicious SQL statements into an entry field for execution.
Cross-Site Scripting (XSS)
Max severity 10A vulnerability that allows attackers to inject malicious scripts into webpages viewed by other users. These scripts can steal cookies, session tokens, or other sensitive information.
Prompt Injection
Max severity 10An attack that involves injecting malicious inputs into prompts, often targeting AI and natural language processing systems to manipulate or exploit the intended behavior.
Buffer Overflow
Max severity 10A vulnerability where a program writes more data to a buffer than it can hold, causing data to overflow into adjacent memory, potentially allowing attackers to execute arbitrary code.
Cross-Site Request Forgery (CSRF)
Max severity 10An attack that tricks a user into performing actions on a web application without their knowledge, by exploiting the user's authenticated session.
Broken Authentication
Max severity 10A vulnerability that allows attackers to compromise passwords, keys, or session tokens, or exploit other flaws to assume other users' identities.
Insecure Direct Object References (IDOR)
Max severity 10A vulnerability where an application provides direct access to objects based on user-supplied input, leading to unauthorized access if not properly controlled.
Security Misconfiguration
Max severity 10A vulnerability arising from improperly configured security settings, leaving the application or infrastructure open to various attacks.
Sensitive Data Exposure
Max severity 10A vulnerability where sensitive data such as passwords, credit card numbers, or personal information is not properly protected, leading to potential leaks.
Unvalidated Redirects and Forwards
Max severity 10A vulnerability where an application redirects or forwards users to other pages and websites without proper validation, potentially leading to phishing attacks.
Remote Code Execution (RCE)
Max severity 10A vulnerability that allows attackers to execute arbitrary code on a remote machine, often leading to full system compromise.
Path Traversal
Max severity 10An attack that exploits vulnerabilities in file system access controls by manipulating file paths to access files and directories outside the intended directory.
Zero-Day Exploits
Max severity 10Vulnerabilities that are exploited before the software vendor has released a patch or become aware of the flaw, leaving systems defenseless.
Man-in-the-Middle (MITM) Attacks
Max severity 10An attack where the attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating with each other.
Denial of Service (DoS)
Max severity 10An attack that aims to make a system or network resource unavailable to its intended users by overwhelming it with a flood of illegitimate requests.
Distributed Denial of Service (DDoS)
Max severity 10A DoS attack executed from multiple computers or devices distributed across various locations, making it more difficult to stop.
Clickjacking
Max severity 10A technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially revealing confidential information or taking control of their computer.
XML External Entities (XXE)
Max severity 10A vulnerability that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser, potentially leading to data exfiltration, denial of service, or other attacks.
Local File Inclusion (LFI)
Max severity 10An attack where an attacker tricks a web application into including files on the web server, potentially allowing the attacker to execute arbitrary code.
Remote File Inclusion (RFI)
Max severity 10Similar to LFI, but the attacker can include files from a remote server, often leading to remote code execution or data theft.