Vulnerability
A vulnerability is a weakness or susceptibility in a system, process, or person that can expose it to harm, misuse, failure, or compromise.
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
A vulnerability is a weakness in a system, process, or control that can be exploited to cause harm or gain unauthorized access.
- How it is used
- Frames weaknesses as a foundational security concept for analyzing threats, exploits, and mitigation techniques in network design.
- How deep it goes
- Defines vulnerability, distinguishes related terms, and applies them to physical access, DHCP, and IOS security updates.
- Examples
- Uses a house window, physical device access, DHCP protocol weaknesses, DHCP Snooping, and outdated Cisco IOS images as examples.
- What you can do after
- Evaluate weaknesses by distinguishing vulnerabilities, exploits, threats, and mitigations in network and device scenarios.
Read how Acing the CCNA Exam: Volume 2 Advanced Networking and Security explains vulnerability →
Grokking Web Application Security
A weakness in software, configuration, or system design that can be exploited to compromise security.
- How it is used
- Guides secure web-application development by identifying weaknesses attackers can discover and exploit.
- How deep it goes
- Explains stack-wide third-party exposure and dependency-audit workflows, without detailing individual exploit mechanisms.
- Examples
- Uses Apache Tomcat disclosure, GitHub and GitLab dependency alerts, npm audit, and a cross-language audit-tool table.
- What you can do after
- Operate/configure dependency-audit tooling to identify vulnerable dependencies, assess reported criticality, and apply available fixes.
Read how Grokking Web Application Security explains vulnerability →
Hacking Cryptography
A vulnerability is a weakness in a system or implementation that can be exploited to violate security properties.
- How it is used
- Frames cryptographic engineering failures as exploitable weaknesses and organizes attacks around concrete implementation mistakes.
- How deep it goes
- Traces vulnerabilities through runnable Go code, concrete inputs, attack simulations, and omitted validation checks.
- Examples
- Uses WEP key recovery, rainbow-table password cracking, and forged RSA signatures as concrete attack examples.
- What you can do after
- Diagnose implementation flaws by running exploit code, tracing validation logic, and choosing widely tested cryptographic implementations.
Secure APIs
An API vulnerability is a weakness in an API or its surrounding implementation that can be exploited to compromise confidentiality, integrity, availability, or authorization.
- How it is used
- Guides recognition, mitigation, testing, design, implementation, and operation of APIs against security threats.
- How deep it goes
- Identifies major vulnerability classes and connects exploitation with mitigation, without detailing individual attack implementations.
- Examples
- Uses the OWASP API Security Top 10 as a threat taxonomy and reference point.
- What you can do after
- Apply API security practices, identify vulnerabilities, and protect APIs through design, controls, automation, and monitoring.
Introduction to Generative AI, Second Edition
A security vulnerability is a weakness in a system that can be exploited to compromise its confidentiality, integrity, or availability.
- How it is used
- Uses vulnerability analysis to test AI safety, anticipate attacks, and understand risks across deployment contexts.
- How deep it goes
- Explains vulnerability mechanisms through red teaming and sociotechnical context, but stops short of implementation-level security procedures.
- Examples
- Uses harmful prompts, data leakage, poisoned datasets, phishing-filter bypasses, code-model backdoors, and tool-triggered real-world actions.
- What you can do after
- Diagnose vulnerabilities by constructing difficult inputs, examining outputs, identifying patterns, and considering downstream social consequences.
Read how Introduction to Generative AI, Second Edition explains vulnerability →
Software Security for Developers
A weakness in software that can be exploited to compromise confidentiality, integrity, or availability.
- How it is used
- Frames vulnerabilities as practical risks that every role must help prevent across the technology stack.
- How deep it goes
- Explains consequences and failure patterns, but stops short of detailed exploit mechanics or remediation procedures.
- Examples
- Uses Meltdown and Spectre, Equifax, Event-Stream, Copay, and JWS alg:none as concrete failure examples.
- What you can do after
- Apply security responsibility by updating dependencies, validating components, and avoiding unsafe cryptographic configurations.
Read how Software Security for Developers explains vulnerability →
AI-Powered Developer: Build software with ChatGPT and Copilot
A security vulnerability is a weakness in software or its environment that can be exploited to violate confidentiality, integrity, or availability.
- How it is used
- Supports threat modeling, application-design review, risk prioritization, and remediation planning during secure software development.
- How deep it goes
- Defines common weaknesses and supports scenario analysis and design review, but stops short of replacing skilled judgment or current threat intelligence.
- Examples
- Uses e-commerce cloud scenarios, microservices with Docker containers, password storage, and role-based access control to surface weaknesses.
- What you can do after
- Diagnose/debug with ChatGPT by identifying potential weaknesses, prioritizing threats, requesting mitigations, and cross-checking recommendations.
Read how AI-Powered Developer: Build software with ChatGPT and Copilot explains vulnerability →
Automating API Delivery
A vulnerability is a weakness in software or its configuration that can be exploited to cause harm or bypass intended protections.
- How it is used
- Guides API design review, threat modeling, and automated security gates across the software delivery lifecycle.
- How deep it goes
- Defines vulnerabilities, distinguishes threat-modeling terms, and applies static linting, but defers detailed vulnerability analysis to broader API security treatment.
- Examples
- Uses an insecure crAPI OpenAPI definition, security-focused linting, pull-request builds, and API security platform reports.
- What you can do after
- Evaluate API designs for security defects and enforce automated checks before insecure definitions pass a build.
GitHub Actions in Action: Continuous integration and delivery for DevOps
A software vulnerability is a weakness in software that can be exploited to compromise its security properties.
- How it is used
- Gates CI/CD changes and release artifacts by detecting known vulnerabilities in code, containers, and dependencies.
- How deep it goes
- Explains workflow triggers, severity gates, scanning tools, SARIF reporting, and package remediation without detailing vulnerability exploitation.
- Examples
- Uses CodeQL findings in C# and JavaScript, Trivy-scanned container images, SARIF uploads, and Dependabot-generated update pull requests.
- What you can do after
- Apply GitHub Advanced Security, Trivy, and Dependabot to detect, report, and block known vulnerabilities before deployment.
"Looks Good to Me"
A weakness or problem in software that can be exploited to compromise confidentiality, integrity, availability, or control.
- How it is used
- Uses vulnerability checks to decide whether a pull request can be approved.
- How deep it goes
- Identifies glaring vulnerabilities and approval consequences but does not detail exploit analysis or remediation techniques.
- Examples
- Uses vulnerabilities missed by automation and weaknesses exposing personal or sensitive data as review examples.
- What you can do after
- Evaluate review findings and block changes that introduce vulnerabilities affecting data or system security.
Think Like a CTO
A security vulnerability is a weakness in software or a system that can be exploited to compromise confidentiality, integrity, availability, or otherwise cause unauthorized harm.
- How it is used
- Frames vulnerabilities as an organizational security responsibility requiring prevention, patching, detection, and breach containment.
- How deep it goes
- Explains common causes and a worked SQL-injection scenario, then connects weaknesses to patching, testing, education, and review.
- Examples
- Uses poorly tested software, Apache Log4j, manual memory risks, and a crafted SQL-injection input as concrete examples.
- What you can do after
- Diagnose/debug with it by recognizing exploitable coding weaknesses and evaluating patching, testing, monitoring, and containment practices.
Data-Driven Cybersecurity
A vulnerability is a weakness in a system, application, or configuration that can be exploited to compromise security.
- How it is used
- Uses vulnerability measures to prioritize remediation, monitor security-control gaps, and connect technical exposure with organizational risk decisions.
- How deep it goes
- Defines vulnerabilities and demonstrates dashboard-based prioritization, but stops short of prescribing detailed discovery, patching, or verification procedures.
- Examples
- Uses TechGuardian and TechMed dashboards, severity-based targets, internet-facing services, web applications, VPNs, RDP, and cloud services.
- What you can do after
- Evaluate vulnerability risk by severity, exposure, coverage, closure progress, and related detection and response performance.
Spring Security in Action, Second Edition
A weakness in an application that permits unauthorized use of data or functionality or allows the application to affect other systems.
- How it is used
- Frames security as protection against unauthorized data, functionality, and effects on other systems.
- How deep it goes
- Defines the weakness and illustrates consequences, but stops short of explaining exploitation or remediation procedures.
- Examples
- Uses back-office leaks, fraudulent ride charges, cross-user banking transactions, and sensitive logs or errors.
- What you can do after
- Apply layered security from project inception and recognize common exposure paths before they cause financial or reputational harm.
Read how Spring Security in Action, Second Edition explains vulnerability →
Azure Security
A vulnerability is a weakness or gap in a system or its security controls that can be exploited by a bad actor.
- How it is used
- Frames weaknesses in security controls as entry points for understanding and preventing attacks.
- How deep it goes
- Defines vulnerabilities and places them in threat analysis, but stops short of implementation guidance or specific vulnerability examples.
- Examples
- Uses a gym-training analogy to illustrate learning from others and adapting defensive practice to evolving threats.
- What you can do after
- Evaluate how bad actors might compromise an environment and consider steps to reduce that likelihood.
Learn Docker in a Month of Lunches, Second Edition
A vulnerability is a weakness in software that can be exploited to cause unintended or insecure behavior.
- How it is used
- Uses vulnerability checks to prevent unsafe container images from reaching production.
- How deep it goes
- Explains dependency risk, scanning, build failure, and image signing, but stops short of exploit mechanics.
- Examples
- Uses decade-old open source libraries with known high-severity vulnerabilities and container-image scans in CI.
- What you can do after
- Diagnose/debug with it by scanning images, failing unsafe builds, updating dependencies, and admitting only signed artifacts.
Read how Learn Docker in a Month of Lunches, Second Edition explains vulnerability →
.NET in Action, Second Edition
A vulnerability is a weakness in software, configuration, or architecture that can be exploited to compromise security.
- How it is used
- Identifies weaknesses in applications and architectures and guides security fixes.
- How deep it goes
- Maps components, connections, trust boundaries, and threat vectors, while stopping short of comprehensive security coverage.
- Examples
- Uses an ASP.NET Core catalog API, SQLite database, browser Swagger UI, HTTP traffic, and a company-network boundary.
- What you can do after
- Diagnose vulnerabilities by modeling trust boundaries, inspecting generated SQL, and applying .NET security tools and techniques.
Read how .NET in Action, Second Edition explains vulnerability →
Related concepts
- security threatused by · A security threat is a potential actor, condition, event, or action capable of harming or compromising systems, information, operations, or users.
- software updateaddressed by · A software update is a change applied to existing software to modify or improve its behavior, correct defects or vulnerabilities, or add functionality.
- exploitused by · An exploit is code, data, or a procedure that takes advantage of a vulnerability to produce unintended behavior or gain unauthorized access.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.