Vulnerabilities

A vulnerability is a weakness in software that an attacker could exploit or that could make the software fail. Not every vulnerability is a security problem: some cause crashes, incorrect results or data loss.

Sources inside the code

Programming bugs are errors in code that make it behave incorrectly. A bug can be harmless, but it can also create a way in. For example, a bug that skips an account check could let a user reach data they should not see.

Some vulnerabilities are specific to a programming language. If a language lets a program manipulate memory directly, code that reads or writes outside its memory may corrupt data, crash or expose information. Languages that manage memory for you reduce this risk, but do not remove every vulnerability.

Security vulnerabilities are weaknesses that could allow unauthorised access, data theft or damage to a system. They may come from bugs, weak design or code written by someone else.

Design, testing and practice

Weak design can create vulnerabilities even when each section of code is correct. The parts may fit together badly, or a step may be missing. For example, a game might trust a score sent from the player's device; editing the score before it is sent allows cheating.

Insufficient testing means bugs and vulnerabilities may still be there when software is released. If no one tries unusual or invalid situations, problems stay hidden until a user or attacker finds them.

Bad programming practices, such as not following coding standards, make vulnerabilities more likely. Coding standards are agreed rules for writing code clearly and consistently, so mistakes are easier to spot and risky shortcuts are avoided.

Code from outside

Third-party libraries are ready-made code that you add to your program. Using one without checking it can bring in vulnerabilities from code you did not write. A library might be out of date, contain known bugs or come from an untrusted source. Check its origin, version and reputation before you rely on it. Following coding standards and checking libraries before use are practical ways to reduce vulnerabilities.