A vulnerability is a weakness in software, hardware, or another stack layer that attackers can exploit to gain unauthorized access or compromise systems. Its effects can reach confidentiality, integrity, or availability, making security a shared responsibility rather than an application-only concern. section 1.0
Common failure patterns include:
- Leaving a known dependency flaw unpatched, as with Apache Struts and the Equifax breach. section 1.2
- Trusting a compromised supply-chain component, as with the Event-Stream backdoor affecting Copay wallet versions 5.0.2 through 5.1. section 1.2
- Accepting the JWS alg:none option, which can make signed-data protection unsafe when misused. section 11.8
Figure 1.1 Headlines showcasing major recent data breaches and security vulnerabilities, emphasizing the widespread impact on millions of users and the persistent threat to digital security
Use the breach headlines to connect vulnerabilities with their widespread effects on users and organizations. section 1.0
