The non-profit Open Web Application Security Project (OWASP – https://www.owasp.org/) provides a list of 10 Risks to Web Application Security to guide architects, developers and security practitioners on critical vulnerabilities commonly present in web applications which leave applications open to exploits. This list provides a valuable starting point when planning methods to keep web applications secure.

Injection Flaws

Description	Injection flaws are the result of untrusted data “piggy-backing” off trusted data as part of a query or command. The most common type of injection is SQL injection, others are NoSQL queries, OS commands, PHP queries and LDAP queries.
Risk/Vulnerability	The system being attacked may be deceived into executing unintended commands or the attacker(s) may be able to accesses data without proper authorization.
Mitigation	Injection flaws may be detected by proper application security testing. Parameterized queries should be coded to prevent injection flaws.

Authentication Issues

Description	Session management and user authentication functions are implemented incorrectly.
Risk/Vulnerability	Attackers may be able to compromise keys, sessions, passwords or other flaws caused by weak implementations to take over user identities.
Mitigation	Implementation of multi-factor authentication methods reduces the likelihood of compromised user accounts.

Exposing Sensitive or Personal Data

Description	Some applications and APIs don’t properly protect sensitive data such as used id’s, financial data, health information and passwords.
Risk/Vulnerability	This could enable access to information to attackers allowing them to commit fraud or to steal identities.
Mitigation	Encrypting data both in transit and at rest.

XML External Entities

Description	XML processors that have not been correctly configured or implemented may evaluate external entity references within XML documents.
Risk/Vulnerability	This could allow attackers to use external entities for attacks which may include gaining of access to internal files and file shares, execution of remote code, scanning of internal network ports and DOS (Denial of Service attacks).
Mitigation	Using SAST (Static application security testing) for inspection of configurations and dependencies.

Broken Access Control

Description	Improper enforcement of user access permissions to data and non-functional system functionality.
Risk/Vulnerability	Users may be allowed to access unauthorized system functionality and/or data, this may allow for access to other accounts/data and unauthorized modification of these items.
Mitigation	System penetration testing will help to detect non-functional access controls.

Misconfigured Security

Description	Security misconfiguration as the result of insecure/add hoc default configurations, error messages displaying too much system related information, incorrect security headers, cloud storage left open to unauthorized access and systems/components improperly patched.
Risk/Vulnerability	Exploitation of misconfigured system by attackers.
Mitigation	DAST (Dynamic application security testing) will assist in the discovery of system misconfigurations. Proper management of system inventory will assist with keeping systems up to date with patches.

Cross-Site Scripting (XSS)

Description	Unintended inclusion of untrusted data in web pages without appropriate validation or escaping, or updates to current web pages with user-supplied data via web browser API’s creating JavaScript/HTML
Risk/Vulnerability	Attackers may gain the ability to inject client-side scripts into the web application.
Mitigation	Enforcement of coding practices such as input validation and encoding of data.

Insecure Deserialization

Description	Some applications persist data on the client-side via object serialization.
Risk/Vulnerability	Serialized data may be tampered with, potentially allowing the remote execution of code, tampering or removal of serialized object data, elevation of privileges or execution of injection attacks.
Mitigation	Usage of application security tools will assist with deserialization flaw detection. Penetration testing will validate issues.

Insecure Themes, Plugins, and Other Components

Description	Components that make up an application, such as software modules, frameworks and libraries execute within the application with the same level of access privileges as the application itself. Some of these components may be out of date with known vulnerabilities.
Risk/Vulnerability	Insecure components may be exploited by attackers to take control of systems or to steal sensitive data.
Mitigation	Use of SCA (Software Composition Analysis) tools will help to identify insecure versions of application components.

Insufficient Logging and Monitoring

Description	Attacks are frequently only notices after an incident occurred. This may be weeks or even months after the breach. Deficient system logging and lack of integration with response systems leads to lack of information about and slow reaction time to incidents.
Risk/Vulnerability	Slow response times and identification of breaches will allow attackers to extend their access to other systems and to maintain persistent threats within the target systems/network.
Mitigation	Penetration testing will assist in the identification of sufficiency of monitoring. Logs need to be examined after penetration testing to ensure that systems are logging attacks. Moving/replication of logs to other locations will assist breach analysis ensuring that logs being investigated have not been tampered with.