OWASP Top 10 and Common Web Vulnerabilities

Vocabulary flashcards covering the OWASP Top 10 categories, critical cybersecurity definitions, and key concepts in application security.

CVE® list

An openly accessible dictionary of known vulnerabilities and exposures used by the global security community to identify improvements to existing programs.

OWASP

The Open Worldwide Application Security Project® (formerly Open Web Application Security Project), a nonprofit foundation that operates an open platform to improve software security through shared tools, information, and events.

OWASP Top 10

A list published since 2003 and updated every few years that highlights the web's most targeted vulnerabilities, primarily referenced during new or custom software development.

Broken access control

A vulnerability occurring when mechanisms limiting what users can do in a web application fail, potentially leading to unauthorized information disclosure, modification, destruction, or access to other applications.

Cryptographic failures

Vulnerabilities that occur when businesses fail to protect sensitive information like personally identifiable information (PII) using effective encryption methods or use weak hashing algorithms like MD5.

General Data Protection Regulation (GDPR)

Privacy laws requiring that sensitive business data be protected through effective encryption methods to prevent data breaches.

Injection

An attack that occurs when malicious code is inserted into a vulnerable application (such as through a login form), causing the app to execute unintended actions or creating a backdoor into the system.

Insecure design

A broad vulnerability category referring to missing or poorly implemented security controls that should have been programmed into an application during its development.

Security misconfiguration

Flaws that arise when security settings are incorrectly configured or maintained across interconnected systems, such as deploying a network server with its default settings.

Vulnerable and outdated components

A software development risk stemming from the use of open-source libraries or third-party components that contain unpatched weaknesses and are not properly maintained.

Identification and authentication failures

Security failures where an application is unable to accurately verify who a user is and confirm what actions or resources they are authorized to access.

Software and data integrity failures

Instances where software updates or patches are inadequately reviewed before implementation, creating opportunities for attackers to distribute malicious software.

Supply chain attack

A cyber attack where compromising a single system or software component leads to downstream infections across third parties.

SolarWinds cyber attack (2020)

A prominent supply chain attack in which hackers injected malicious code into software updates that the company unknowingly released to its customers.

Security logging and monitoring failures

A lack of adequate recording, tracing, monitoring, and incident response for system events (such as user login attempts), making it difficult to detect and resolve security issues.

Server-side request forgery (SSRF)

An attack where threat actors exploit a vulnerable application to manipulate normal server operations and read or update other unauthorized server resources.