An information security "vulnerability" is a mistake in software that can be directly used by a hacker to gain access to a system or network. <br/><br/>CVE considers a mistake a vulnerability if it allows an attacker to use it to violate a reasonable security policy for that system (this excludes excluding entirely "open" security policies in which all users are trusted, or where there is no consideration of risk to the system). <br/><br/>For CVE, a vulnerability is a state in a computing system (or set of systems) that either: <br/><br/>   · allows an attacker to execute commands as another user <br/>   · allows an attacker to access data that is contrary to the specified access restrictions for that data <br/>   · allows an attacker to pose as another entity <br/>   · allows an attacker to conduct a denial of service <br/><br/>source:  http://cve.mitre.org<br/>