Zennoxa Shield

Application Security Glossary

60 plain-English definitions of the terms behind modern AppSec — with how each one is scanned, prioritized, and fixed. Grounded in our reproducible research.

Scan types

Code Security ScannerA code security scanner is a tool that automatically inspects a codebase and its dependencies for security vulnerabilities, exposed secrets, and misconfigurations, integrating into developer workflows and CI to catch issues before code reaches production.Container ScanningContainer scanning is a method that inspects container images layer by layer to inventory installed OS packages and application dependencies, matching them against vulnerability databases and checking for misconfigurations, outdated base images, and embedded secrets.DAST (Dynamic Application Security Testing)DAST (Dynamic Application Security Testing) is a black-box method that tests a running application from the outside by sending crafted inputs and observing responses, uncovering vulnerabilities such as injection, authentication flaws, and misconfigurations without access to the source code.Dependency ScanningDependency scanning is a method that examines a project's direct and transitive third-party libraries, resolving their exact versions and checking them against known-vulnerability databases to flag insecure dependencies and recommend safe upgrades.IaC Scanning (Infrastructure as Code Scanning)IaC scanning is a method that statically analyzes infrastructure-as-code files, such as Terraform, CloudFormation, Kubernetes, and Dockerfiles, to catch insecure configurations like public storage, open ports, or missing encryption before the infrastructure is provisioned.IAST (Interactive Application Security Testing)IAST (Interactive Application Security Testing) is a grey-box method that instruments a running application from the inside to observe code execution, data flow, and configuration in real time, confirming vulnerabilities with low false positives as the app is exercised by tests or traffic.SAST (Static Application Security Testing)SAST (Static Application Security Testing) is a white-box method that analyzes an application's source code, bytecode, or binaries without running it, tracing how untrusted data flows through the program to find vulnerabilities like SQL injection and cross-site scripting early in development.SBOM (Software Bill of Materials)An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component, library, and dependency in a piece of software, typically in a standard format like SPDX or CycloneDX, enabling teams to track what they ship and respond quickly to new vulnerabilities.SCA (Software Composition Analysis)SCA (Software Composition Analysis) is a method that inventories the open-source and third-party components in a codebase and matches them against known-vulnerability databases like the NVD and license data, flagging risky or non-compliant dependencies developers rely on.Secret ScanningSecret scanning is a method that inspects source code, configuration, and commit history for exposed credentials such as API keys, tokens, passwords, and private keys, alerting developers so leaked secrets can be revoked before attackers exploit them.

Injection vulnerabilities

Command InjectionCommand injection is a vulnerability where an attacker supplies input that gets executed as an operating-system command by the application, letting them run arbitrary commands on the host. It occurs when untrusted input is passed into a shell or command call without strict validation.Cross-Site Scripting (XSS)Cross-site scripting (XSS) is a vulnerability where an attacker injects malicious scripts into a web page that then execute in other users' browsers, letting them steal sessions, credentials, or perform actions as the victim. It happens when untrusted input is rendered into a page without proper encoding.Insecure DeserializationInsecure deserialization is a vulnerability where an application deserializes untrusted data into objects, letting an attacker tamper with the serialized payload to alter application logic or trigger remote code execution. It occurs when serialized input from an untrusted source is reconstructed without integrity checks.LDAP InjectionLDAP injection is a vulnerability where an attacker inserts crafted characters into an LDAP directory query, altering its logic to bypass authentication or read unauthorized directory entries. It occurs when untrusted input is placed into an LDAP filter without proper escaping.Open RedirectOpen redirect is a vulnerability where an application redirects users to a URL taken from untrusted input, letting an attacker send victims to a malicious site while starting from a trusted domain. It occurs when a redirect destination is not validated against an allowlist.Path TraversalPath traversal is a vulnerability where an attacker manipulates a file path (often using ../ sequences) to access files outside the intended directory, exposing configuration, source code, or credentials. It occurs when untrusted input is used to build a filesystem path without proper validation.Server-Side Request Forgery (SSRF)Server-side request forgery (SSRF) is a vulnerability where an attacker tricks a server into making HTTP or network requests to attacker-chosen destinations, reaching internal services, cloud metadata endpoints, or other systems behind the firewall. It occurs when user-supplied URLs are fetched without validation.SQL InjectionSQL injection is a vulnerability where an attacker inserts malicious SQL fragments into an application's database query, letting them read, modify, or delete data they shouldn't be able to access. It occurs when untrusted input is concatenated directly into a query instead of being parameterized.XML External Entity (XXE)XML external entity (XXE) is a vulnerability where an XML parser processes attacker-defined external entities, letting an attacker read local files, reach internal systems, or cause denial of service. It occurs when XML input from an untrusted source is parsed with external entity resolution enabled.XPath InjectionXPath injection is a vulnerability where an attacker inserts crafted input into an XPath query used to navigate XML data, altering the query to bypass authentication or extract unauthorized nodes. It occurs when untrusted input is concatenated into an XPath expression without proper handling.

Other vulnerabilities

Broken Access ControlBroken Access Control is a vulnerability where an application fails to properly enforce what an authenticated user is allowed to do or see, letting attackers access other users' data, perform privileged actions, or bypass permission checks they should not be able to reach.Buffer OverflowA buffer overflow is a memory-safety vulnerability where a program writes more data into a fixed-size buffer than it can hold, overwriting adjacent memory and potentially corrupting data, crashing the application, or letting an attacker execute arbitrary code.Cross-Site Request Forgery (CSRF)Cross-Site Request Forgery (CSRF) is a web vulnerability that tricks an authenticated user's browser into sending an unwanted state-changing request to a site where they are logged in, letting an attacker perform actions as that user without knowing their credentials.Hardcoded SecretA hardcoded secret is a credential such as a password, API key, token, or private key written directly into source code or configuration and committed to a repository, where anyone with read access to the code — or its git history — can retrieve and abuse it.Insecure Direct Object Reference (IDOR)Insecure Direct Object Reference (IDOR) is an access-control flaw where an application exposes a reference to an internal object — such as a record ID in a URL or API request — and fails to verify the requester is authorized for it, letting attackers access other users' data by changing the identifier.Prototype PollutionPrototype pollution is a JavaScript vulnerability where an attacker injects properties into a base object's prototype (such as via __proto__), causing those properties to appear on all objects at runtime and leading to denial of service, property tampering, or in some cases remote code execution.Regular Expression Denial of Service (ReDoS)Regular Expression Denial of Service (ReDoS) is a vulnerability where a poorly written regular expression takes exponential time to evaluate certain inputs, allowing an attacker to send a short crafted string that consumes CPU for seconds or minutes and stalls or crashes the service.Use-After-FreeUse-after-free is a memory-safety vulnerability where a program continues to use a pointer to memory that has already been freed, causing crashes, data corruption, or — when an attacker controls the reallocated memory — code execution.Weak CryptographyWeak cryptography is the use of broken, outdated, or misconfigured cryptographic algorithms and practices — such as MD5, SHA-1, DES, small keys, or hardcoded keys — that fail to adequately protect data, letting attackers decrypt, forge, or crack values that were assumed to be secure.

Signals & prioritization

CISA KEV (Known Exploited Vulnerabilities Catalog)CISA KEV (Known Exploited Vulnerabilities Catalog) is an authoritative, regularly updated list maintained by the U.S. cybersecurity agency CISA of CVEs that have confirmed evidence of active exploitation in the wild.CVE (Common Vulnerabilities and Exposures)CVE (Common Vulnerabilities and Exposures) is a public catalog of unique identifiers, formatted like CVE-2024-12345, assigned to individually disclosed security flaws in software and hardware so that everyone can refer to the same vulnerability unambiguously.CVSS (Common Vulnerability Scoring System)CVSS (Common Vulnerability Scoring System) is an open standard that rates the severity of a security vulnerability on a 0-10 scale, using characteristics like attack vector, complexity, required privileges, and impact to confidentiality, integrity, and availability.Data-Flow AnalysisData-flow analysis is a static analysis technique that tracks how values move and are transformed through a program — from where they are defined to where they are used — enabling tools to reason about program behavior without executing the code.EPSS (Exploit Prediction Scoring System)EPSS (Exploit Prediction Scoring System) is a data-driven model that estimates the probability, from 0 to 1, that a given vulnerability will be exploited in the wild within the next 30 days, helping teams prioritize the flaws most likely to be attacked.False-Positive RateFalse-positive rate is the proportion of a security tool's findings that turn out not to be real issues; in scanning, a false positive is an alert flagged as a vulnerability that, on inspection, is not actually exploitable or valid.Precision and RecallPrecision and recall are two complementary accuracy metrics for detection tools: precision is the share of reported findings that are correct (true positives over all reported), and recall is the share of all real issues that were found (true positives over all actual issues).Priority EngineThe Priority Engine is Zennoxa Shield's risk-scoring approach that combines four public signals into a single 0-100 score using the formula CVSS·0.30 + EPSS·0.30 + KEV·0.25 + reachability·0.15, so developers can rank findings by real risk rather than raw severity alone.Reachability AnalysisReachability analysis is a technique that determines whether the vulnerable code inside a dependency or codebase can actually be invoked along an executable path from your application, so teams can distinguish exploitable flaws from ones that are present but never reached.Risk-Based PrioritizationRisk-based prioritization is the practice of ranking security findings by their actual risk — combining severity with exploit likelihood, confirmed exploitation, and exposure — rather than by severity alone, so teams remediate the vulnerabilities most likely to cause real harm first.Taint AnalysisTaint analysis is a security technique that tracks untrusted 'tainted' data from where it enters a program (a source, such as user input) to sensitive operations (a sink, such as a database query), flagging a vulnerability when tainted data reaches a sink without proper sanitization.

DevSecOps

CI/CD SecurityCI/CD security is the practice of protecting the continuous integration and delivery pipeline and embedding automated security checks — such as SAST, dependency scanning, and secret detection — into it, so that both the pipeline and the code it ships stay secure.Dependency ConfusionDependency confusion is a supply chain attack where an attacker publishes a malicious package to a public registry using the same name as an organization's private internal package, tricking the build system into installing the attacker's version instead.Quality GateA quality gate is an automated pass/fail checkpoint in a CI/CD pipeline that enforces code-quality standards — such as test coverage, code smells, duplication, and security findings — and blocks changes that fall below the agreed threshold.RemediationRemediation is the process of resolving a security vulnerability by eliminating its root cause — for example upgrading a vulnerable dependency, patching flawed code, or fixing a misconfiguration — so the weakness can no longer be exploited.Security DebtSecurity debt is the accumulated backlog of known but unresolved security issues — unpatched vulnerabilities, risky dependencies, and deferred fixes — that a team carries over time, increasing risk the longer it goes unaddressed.Security GateA security gate is an automated checkpoint in a CI/CD pipeline that evaluates code, dependencies, and configuration against security policy and blocks a build or merge when findings exceed defined thresholds, such as any critical vulnerability.Shift LeftShift left is the DevSecOps practice of moving security testing and quality checks earlier in the software development lifecycle — into coding, code review, and CI — so defects are found and fixed before they reach production.Software Supply Chain SecuritySoftware supply chain security is the practice of protecting every component, dependency, tool, and process used to build and deliver software — from third-party libraries to the build pipeline — so that malicious or vulnerable code cannot be introduced along the way.TyposquattingTyposquatting is a supply chain attack where an attacker publishes a malicious package under a name that closely misspells or mimics a popular legitimate package, so developers who make a typo or copy a wrong name install the malicious version.Vulnerability TriageVulnerability triage is the process of reviewing security findings to determine which are genuine, how severe they are, and which to fix first — filtering out false positives and ranking real issues by exploitability, reachability, and business impact.

Standards & supply chain

Build ProvenanceBuild provenance is verifiable, tamper-evident metadata that records how a software artifact was produced, including its source inputs, build steps, and build environment, so consumers can confirm an artifact's origin and integrity.Code SigningCode signing is the practice of using a cryptographic digital signature to prove the author or publisher of software and to verify that the code has not been altered since it was signed.CopyleftCopyleft is a category of open source licensing that requires anyone who distributes a modified or derivative version of the software to release it under the same license terms, keeping the code and its derivatives freely available.CWE (Common Weakness Enumeration)CWE (Common Weakness Enumeration) is a community-developed, MITRE-maintained catalog of software and hardware weakness types, each with a unique identifier like CWE-79, that gives the industry a common language for classifying the root causes of vulnerabilities.License ComplianceLicense compliance is the process of identifying the open source and third-party licenses used by a software project's dependencies and ensuring the project meets each license's obligations, such as attribution or source disclosure.Malicious PackageA malicious package is a software library published to a package registry that intentionally contains harmful code, designed to compromise developers or applications that install it as a dependency.OWASP BenchmarkThe OWASP Benchmark is a free, open test suite of thousands of deliberately vulnerable and safe code samples used to measure how accurately a static application security testing tool detects real vulnerabilities while avoiding false positives.OWASP Top 10The OWASP Top 10 is a periodically updated awareness document from the Open Worldwide Application Security Project that ranks the ten most critical web application security risks, such as broken access control, injection, and cryptographic failures, to guide developers and security teams.SLSA (Supply-chain Levels for Software Artifacts)SLSA (Supply-chain Levels for Software Artifacts) is an open security framework that defines a graded set of levels for hardening the software build and release process, using verifiable provenance to protect artifacts from tampering between source and consumer.Software Composition Analysis (SCA)Software Composition Analysis (SCA) is the practice of identifying the open source and third-party components in a codebase and analyzing them for known vulnerabilities, license obligations, and supply chain risks.
Application Security Glossary — Zennoxa Shield