I have difficulties to pinpoint the difference between attack vector / attack surface / vulnerability and exploit.
I think the difference between a vulnerability and an exploit is the following: A vulnerability is something that could get used to do harm (e.g. a buffer overflow), but does not necessarily mean that anything can be done. An exploit makes use of a vulnerability in a "productive" way (e.g. reading the following bytes in memory after triggering an error message).
According to Wikipedia (vulnerability)
To exploit a vulnerability, an attacker must have at least one applicable tool or technique that can connect to a system weakness. In this frame, vulnerability is also known as the attack surface.
So attack surface and vulnerability seem to be synonyms in the context of IT security (?)
Could anybody please define the words or give examples for the difference between them?