vulnerabiliti

Vulnerabiliti, commonly referred to as vulnerabilities in information security, are weaknesses in a system, product, or process that can be exploited to breach confidentiality, integrity, or availability. In cybersecurity terms, a vulnerability is distinct from an attack and from an exploit: a flaw exists, an attacker may take advantage of it, and a remediation may close it.

Vulnerabilities can appear in software code, hardware design, configurations, or human and organizational processes. Software vulnerabilities include memory safety flaws, input validation errors, and insecure deserialization. Configuration vulnerabilities arise from weak passwords, default credentials, overly permissive access, or improper network exposure. Human vulnerabilities involve social engineering and weak security practices.

Discovery and assessment involve automated scanners, manual testing, fuzzing, and code reviews to identify weaknesses. When a vulnerability is found, it is often assigned an identifier in a public database (such as CVE) and scored for risk using a standard like CVSS, which considers exploitability, impact, and scope.

Management of vulnerabilities focuses on prioritization, patching, and hardening. Organizations apply software and firmware updates, reconfigure systems, and implement compensating controls such as network segmentation and least-privilege access. Effective vulnerability management also requires asset inventories, change control, and testing of fixes before deployment.

Disclosure and response are guided by responsible disclosure practices. Vendors, researchers, and CERT/CSIRT teams coordinate to publish advisories, assign CVE identifiers, and release patches, minimizing exposure and guiding remediation.

Supply-chain vulnerabilities affect components from multiple vendors. Practices such as maintaining an up-to-date software bill of materials (SBOM) and rigorous supplier assessments help reduce risk.

Notable examples include Heartbleed (OpenSSL, CVE-2014-0160) and EternalBlue (MS17-010), illustrating the potential impact of unpatched flaws.