1.6 KiB
Executable File
1.6 KiB
Executable File
note type, date, done
| note type | date | done | |
|---|---|---|---|
|
2026-06-03 | true |
This stands for Open Web Application Security Project.
It is a non profit foundation which publishes the OWASP top 10, which is a standard document that identifies the most critical security risks to web applications.
Current edition: OWASP Top 10:2025
The 2025 list ranks risks as follows:
- A01:2025 Broken Access Control: Remains the #1 risk, covering unauthorized access and privilege escalation; includes Server-Side Request Forgery (SSRF).
- A02:2025 Security Misconfiguration: Moved up to #2, highlighting insecure defaults, exposed services, and inconsistent controls.
- A03:2025 Software Supply Chain Failures: A new, expanded category (from "Vulnerable and Outdated Components") covering dependencies, CI/CD systems, and distribution infrastructure.
- A04:2025 Cryptographic Failures: Covers insecure encryption, weak key management, and data exposure.
- A05:2025 Injection: Includes SQL, OS, and template injection flaws.
- A06:2025 Insecure Design: Focuses on architectural weaknesses and lack of threat modeling.
- A07:2025 Authentication Failures: Covers weak login flows, session handling, and password policies.
- A08:2025 Software or Data Integrity Failures: Addresses tampering with code, data, or CI/CD pipelines.
- A09:2025 Security Logging & Alerting Failures: Highlights gaps in monitoring that allow attacks to go undetected.
- A10:2025 Mishandling of Exceptional Conditions: A new category focusing on unsafe error handling and system resilience during failures.