Glossary

Session hijacking is an attack in which an adversary obtains the token identifying somebody else's authenticated session and uses it to act as that person.

Session fixation is a flaw in which an application authenticates a user without replacing the session identifier the browser already holds, leaving an identifier the attacker set in advance attached to the authenticated session.

Sensitive data exposure is the outcome in which an application reveals protected information to someone not authorized to have it, whatever the weakness that allowed it.

A race condition is a flaw in a concurrent code sequence that needs exclusive access to a shared resource, where a timing window lets another sequence change that resource first.

Application security testing is the set of methods used to find security defects in an application, from examining its code to exercising the running system and inspecting its dependencies.

DAST is a category of security testing that exercises a running application from the outside, sending crafted requests to its interfaces and judging the responses, with no access to source code.

Path traversal is a weakness in which an application builds a filesystem path from untrusted input, letting an attacker reach files outside the directory it meant to restrict them to.

A backdoor is a hidden means of access to a system that bypasses its normal authentication, placed there deliberately by someone able to modify the system or its supply chain.

A payload is the part of a transmission or a program that performs its intended function, as distinct from the headers and delivery machinery that exist only to carry it.

Code injection is a vulnerability in which an application assembles part of its own program text from untrusted input, so that input executes as code in the application's own language.

Pen testing is authorized security testing in which assessors imitate real attacks to find ways around the controls protecting an application, system, or network.

EDR is security software that continuously records activity on endpoints, analyzes that record for evidence of attack, and gives responders the means to investigate and contain what it finds.

A CVE is a unique identifier and public record for one publicly disclosed software vulnerability, assigned by an authorized organization within the CVE Program.

Application security is the practice of protecting applications from attack across their whole life, from the code that builds them to the systems running them in production.

Fuzz testing is an automated technique that feeds malformed and unexpected input to a program to find inputs that crash it or corrupt its memory.

An exploit is a technique or piece of code that takes advantage of a vulnerability to make a system do something its design does not permit.

Command injection is a vulnerability that lets an attacker run operating system commands on a host by supplying input that an application passes to a shell.

Log4j is an Apache open-source logging library for Java applications. Log4j2 is its current generation, at the center of the 2021 Log4Shell flaw.

Log4Shell (CVE-2021-44228) is a critical remote code execution vulnerability in Apache Log4j, exploitable through a single logged JNDI lookup string.

Software security is the practice of designing, building, and running applications that resist attack across development, deployment, and runtime.

Learn what a zero-day exploit is, how it differs from a vulnerability or attack, why known-signature tools miss it, and how to reduce exposure.

Learn what code security is, what it protects, how SAST, SCA, secrets scanning, and code review work, and where runtime security fills the gaps.

A vulnerability is a weakness in software, hardware, or configuration that attackers can exploit to gain access, execute code, or steal data.

Learn what software instrumentation is, how manual and automatic methods work, what data they collect, and how instrumentation supports application security.

A false positive is a security alert that flags harmless activity as malicious. The opposite of a false negative, where a real threat goes undetected.