.png)
The CWE/25, a ranking of the 25 most important software vulnerabilities, was created by MITRE in collaboration with the SANS Institute. The Common Weakness Enumeration (CWE) is a database of software security flaws discovered across the board in software development. The CWE details the vulnerability and suggests mitigation measures for each entry.
The OWASP Foundation is a nonprofit foundation that works to improve the security of software it releases OWASP Top 10 which is a standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
Access controls are critical for securing applications against unauthorized access to data and resources. Failures frequently result in the unauthorized disclosure of information, the modification or deletion of all data, or the execution of business operations outside the user's scope.
Cryptographic Failures can either be a flawed encryption system or no encryption at all. The main impact of a cryptography failure is the potential exposure of sensitive data. Depending on the sensitive data that is not sufficiently safeguarded by encryption, there may be compliance, reputational, or competitive business risks associated with its exposure.
Injection is a risk category that describes threat actors' ability to provide web apps with malicious input that causes the program to execute unforeseen and undesired commands. When an app cannot distinguish between malicious input and its code, injection takes place.
Insecure design is a broad category representing different weaknesses, expressed as “missing or ineffective control design.”
This group of dangers concerns the improper configuration of an application's security components. Individual mistakes are frequently at work here, such as leaving cloud storage buckets open or opening ports that are not necessary.
These vulnerabilities come from using out-of-date frameworks or libraries that are easy to exploit.
To safeguard against threats linked to authentication, it is essential to confirm the user's identity, authenticate them, and manage their sessions. If the program allows automated assaults like credential stuffing, in which the attacker has a list of legitimate users and passwords, there may be authentication flaws.
Failures in code and infrastructure that do not provide integrity protection are related to software and data integrity issues. This can happen when an application depends on plugins, libraries, or modules from unreliable sources and repositories.
Monitoring and logging contribute to security responsibility, event visibility, incident alerting, and forensics. Failures in these capabilities seriously impair your company's capacity to identify and address application security breaches.
SSRF vulnerabilities occur when a web application retrieves a remote resource without checking the user-supplied URL. Even when the program is shielded by a firewall, VPN, or another sort of network access control list, it enables an attacker to force the application to submit a forged request to an unexpected location (ACL).
The software writes data past the end, or before the beginning, of the intended buffer.
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
When sending a SQL command to a downstream component, the program generates all or a portion of it using input that has been impacted externally by an upstream component, but it fails to neutralize or does so in a way that could cause the intended SQL command to be altered.
The product receives input or data, but it does not validate or incorrectly validate that the input has the properties that are required to process the data safely and correctly.
The software reads data past the end, or before the beginning, of the intended buffer.
The software builds all or a portion of an OS command using input that has been modified externally by an upstream component, but it fails to remove or removes them wrongly specific aspects that could change the intended OS command when it is sent to a downstream component.
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
The software constructs a pathname from external input to identify a file or directory that is beneath a restricted parent directory, but the pathname is not correctly neutralized to prevent it from resolving to a destination outside of the restricted directory.
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
When the logic in the software expects that the outcome will always be larger than the initial number, a calculation is performed that could result in an integer overflow or wraparound.
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
The software builds all or a portion of a command using input that has been influenced externally from an upstream component, but it fails to neutralize or does so in a way that could cause the intended command to be changed when it is sent to a downstream component.
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
The software operates on a memory buffer, but it has the ability to read from or write to memory locations that are outside the buffer's intended boundaries.
During installation, installed file permissions are set to allow anyone to modify those files.
The web server gets a URL or a request of a similar nature from an upstream component and obtains its contents, but it does not adequately verify that the request is being sent to the intended recipient.
A code sequence that can run concurrently with other code exists in the program, and while it needs temporary, exclusive access to a shared resource, there is a timing window in which the shared resource can be changed by another code sequence that is running concurrently.
The software's inability to effectively manage the allocation and upkeep of a finite resource allows an actor to affect how much of it is used, eventually exhausting the resource's supply.
When an XML document is processed by the program, it may contain XML entities with URIs that resolve to documents outside of its intended control, which results in the product embedding false documents in its output.
The software creates all or a portion of a code segment using input that has been externally influenced by an upstream component, but it fails to remove or removes wrongly specific parts that could alter the syntax or behavior of the intended code segment.
OWASP top 10 is the main category and the CWE is a breakdown of each issue.
However, as CWEs address software issues rather than just those related to web applications, they will occasionally have problems that don't fit into any of the OWASP Top 10 categories, as you can see below.
SecOps Solution is an award-winning agent-less Full-stack Vulnerability and Patch Management Platform that helps organizations identify, prioritize and remediate security vulnerabilities and misconfigurations in seconds.
To schedule a demo, just pick a slot that is most convenient for you.
