Well let's see what a client and a server are before getting into more detail.
The client is a process that requires a resource from another process called the server. The client and the server must each speak the same language. In this context the language is called a protocol. While writing this post I'm using a process that identifies my browser, use a protocol(HTTP, strangely hf doesn't use TLS :( ) to send it to the server and ask it to store it for later use, so that other clients(i.e. you) may view it as well.
That being said, client side vulnerabilities are the ones that affect mostly the client in a security context, as in, a third potentially malicious runs commands on the client's box without the client being aware. When the surface of attack is defined by a web browser, these attacks are related to the language the browser understands: html and javacript for the most part. You can lookup vulnerabilities such as XSS and CSRF on OWASP. Other attacks were common on the past such as stack/heap buffer overflows determined by how the browser was sanitizing input.
The later category of vulnerabilities apply to a much broader range of clients aside from a web browser.
Server side vulnerabilities involve a process called the server which performs the requests of clients if the latter are authorized. When restricted to the web such vulnerabilities are LFI, RFI, SQLi, command injection, directory traversal attacks and so on. You can again check them up on OWASP. Similarly to client processes server processes might be vulnerable to stack/heap buffer overflows.
You can start here with stack buffer overflows:
Code
securitytube.net<slash>groups?operation=view&groupId=4
