A known weakness in an operating system or application that could be exploited by an attack. Vulnerabilities are discovered and reported by vulnerability scanning products.

A design, administrative, or implementation weakness or flaw in hardware, firmware, or software. If exploited, it could lead to an unacceptable impact in the form of unauthorized access to information or disruption of critical processing.