The differences are:
session scope variables are ONLY available to that SESSION.
So you would use them for information that ONLY pertains to the
current browser session. User IDs, User preferrences, etc. It is
the same type of information that you would store in a COOKIE, but
is on the CF Server instead of the CLIENT COOKIE. User A and User B
get different data each via the sesion scope. user A can not read
session scope varaibles set by user B. Another advantage of session
scope variables is the ability to store complex data types like
arrays, querys and invoked cfcs. The session scope variable lasts
as lok as the session time out is set in the administrator, or the
application tag.
APPLICATION scope is a SHARED scope that is accessable to all
scripts within an application as defined by the application tag.
user A and user B on your appliation get the same data from the
application scope. Application variables last as long as the
timeout in the administrator or application tag is set to.