OWASP Top Ten
The OWASP Top 10 is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications. "Globally recognized by developers as the first step towards more secure coding."
= 11 items
(filtered by ) / - Top Ten
- 1. InjectionSQL, NoSQL, OS, and LDAP injection.
- 2. Broken AuthenticationAllows attackers to compromise passwords, keys, or session tokens, to assume other users’ identities temporarily or permanently.
- 3. Sensitive Data ExposureFinancial, healthcare, and PII.
- 4. XML External Entities (XXE)Poorly configured XML processors evaluate external entity references within XML documents.
- 5. Broken Access ControlAccess other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc.
- 6. Security MisconfigurationInsecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages.
- 7. Cross-Site Scripting XSSIncluding untrusted data in a new web page without proper validation or escaping.
- 8. Insecure DeserializationOften leads to remote code execution.
- 9. Using Components with Known VulnerabilitiesLibraries, frameworks, and other software modules, run with the same privileges as the application.
- 10. Insufficient Logging & MonitoringAllows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data.