24 lines
1.6 KiB
Markdown
24 lines
1.6 KiB
Markdown
---
|
||
note type:
|
||
- theory
|
||
date: 2026-06-03
|
||
done: true
|
||
---
|
||
This stands for Open Web Application Security Project.
|
||
|
||
It is a non profit foundation which publishes the OWASP top 10, which is a standard document that identifies the most critical security risks to web applications.
|
||
|
||
Current edition: **OWASP Top 10:2025**
|
||
|
||
The 2025 list ranks risks as follows:
|
||
|
||
- **A01:2025 Broken Access Control**: Remains the #1 risk, covering unauthorized access and privilege escalation; includes [[Server-Side Request Forgery (SSRF)]].
|
||
- **A02:2025 Security Misconfiguration**: Moved up to #2, highlighting insecure defaults, exposed services, and inconsistent controls.
|
||
- **A03:2025 Software Supply Chain Failures**: A new, expanded category (from "Vulnerable and Outdated Components") covering dependencies, CI/CD systems, and distribution infrastructure.
|
||
- **A04:2025 Cryptographic Failures**: Covers insecure encryption, weak key management, and data exposure.
|
||
- **A05:2025 Injection**: Includes SQL, OS, and template injection flaws.
|
||
- **A06:2025 Insecure Design**: Focuses on architectural weaknesses and lack of threat modeling.
|
||
- **A07:2025 Authentication Failures**: Covers weak login flows, session handling, and password policies.
|
||
- **A08:2025 Software or Data Integrity Failures**: Addresses tampering with code, data, or CI/CD pipelines.
|
||
- **A09:2025 Security Logging & Alerting Failures**: Highlights gaps in monitoring that allow attacks to go undetected.
|
||
- **A10:2025 Mishandling of Exceptional Conditions**: A new category focusing on unsafe error handling and system resilience during failures. |