Cody Dumont has an article about the latest version of the OWASP ten most critical web application security risks. The software security community created the Open Web Application Security Project (OWASP) to help educate developers and security professionals. The OWASP Foundation was started in 2001 and is a 501(c)(3) charitable organization (since 2004) that supports and manages OWASP projects and infrastructure.
The summary of Cody’s article lists the OWASP ten most critical web application security risks:
- A1 – Injection: Injection flaws, such as SQL, OS, and LDAP injection occur when untrusted data is sent to an interpreter as part of a command or query.
- A2 – Broken Authentication and Session Management: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.
- A3 – Cross-Site Scripting (XSS): XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping.
- A4 – Insecure Direct Object References: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key.
- A5 – Security Misconfiguration: Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform.
- A6 – Sensitive Data Exposure: Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials.
- A7 – Missing Function Level Access Control: Most web applications verify function level access rights before making that functionality visible in the UI.
- A8 – Cross-Site Request Forgery (CSRF): A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application.
- A9 – Using Known Vulnerable Components: Components, such as libraries, frameworks, and other software modules, almost always run with full privileges.
- A10 – Unvalidated Redirects and Forwards: Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages.
You can visit the OWASP site here.