Which vulnerability is described in the 6.5.1 category?

• A. Cross-site scripting
• B. Insecure communications
• C. Buffer overflows
• D. Improper error handling

Answer: (C)

The thing being tested is a type of software flaw that comes from how memory and input are handled in code. A buffer overflow happens when a program writes more data into a fixed-size memory buffer than it can actually hold. That overflow can spill into adjacent memory, potentially corrupting instructions or control data, which can crash the program or even let an attacker run arbitrary code. This kind of memory-unsafe behavior is a classic, highly exploitable vulnerability in software, and it’s a primary example of what security testing and secure-coding practices aim to prevent. That’s why it’s the best fit for this category—six point five one focuses on coding-related weaknesses that can lead to memory corruption and control flow compromises.

Cross-site scripting is a browser-focused injection flaw where malicious scripts are inserted into web pages and executed in a user’s browser. Insecure communications refers to flaws in how data is transmitted, such as weak encryption or unprotected channels. Improper error handling concerns how a program reports or manages errors, which can lead to information leakage or crashes. While important, they belong to different vulnerability families and aren’t the specific memory-unsafe coding flaw highlighted by this category.