OWASP top 10 Open Web Application Security Project https://owasp.org/

OWASP top 10 - 2013 (Book: release it! - Michael Nygard)

  1. OWASP Injection
  2. OWASP Broken Authentication and Session Management
  3. OWASP Cross Site Scripting (XSS)
  4. OWASP Broken Access Control
  5. OWASP Security Misconfiguration
  6. OWASP Sensitive Data Exposure
  7. OWASP Insufficient Attack Protection
  8. OWASP Cross-Site Request Forgery (CSRF)
  9. OWASP Using Components with Known Vulnerabilities
  10. OWASP Underprotected APIs

(src: Book: release it! - Michael Nygard)

2017 added

  • (8) Insecure Deserialization
  • (10) Insufficient Logging & Monitoring

2021 added

  • (4) Insecure Design
  • (8) Software And Data Integrity Failures
  • (10) Server-side Request Forgery (SSRF)

OWASP Top 10 - Versions

./resources/model-owasp-top-10.resources/unknown_filename.1.png (src: PDF - owasp top 10 (2013))

./resources/model-owasp-top-10.resources/unknown_filename.2.png (src: PDF - owasp top 10 (2017))

./resources/model-owasp-top-10.resources/unknown_filename.png (src: OWASP Top Ten | OWASP Foundation)