OWASP Top 10 2021
L'OWASP Top 10 est le document de référence standard pour la sécurité des applications web. Il représente un large consensus sur les risques de sécurité les plus critiques pour les applications web.
Broken Access Control
Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of data.
Cryptographic Failures
Failures related to cryptography which often lead to sensitive data exposure. This was previously known as Sensitive Data Exposure.
Injection
Injection flaws occur when an application sends hostile data to an interpreter. This includes SQL, NoSQL, OS command, ORM, LDAP, and Expression Language injection.
Insecure Design
Insecure design is a broad category representing different weaknesses, expressed as missing or ineffective control design. This is distinct from implementation flaws.
Security Misconfiguration
The application might be vulnerable if it is missing appropriate security hardening or has improperly configured permissions on cloud services.
Vulnerable and Outdated Components
Components such as libraries, frameworks, and other software modules run with the same privileges as the application. If a vulnerable component is exploited, it can cause serious data loss.
Identification and Authentication Failures
Confirmation of the user's identity, authentication, and session management is critical to protect against authentication-related attacks.
Software and Data Integrity Failures
Software and data integrity failures relate to code and infrastructure that does not protect against integrity violations, including insecure deserialization.
Security Logging and Monitoring Failures
This category helps detect, escalate, and respond to active breaches. Without logging and monitoring, breaches cannot be detected.
Server-Side Request Forgery
SSRF flaws occur whenever a web application fetches a remote resource without validating the user-supplied URL.
Analyser les Vulnérabilités OWASP Top 10
Shoulder détecte des patterns dans plusieurs catégories OWASP. Lancez une analyse pour trouver des problèmes dans votre code.
npx @shoulderdev/cli trust .
Centre des Menaces →