Discover published sets by community

When application functions related to authentication and session management are implemented incorrectly, attackers can compromise passwords, keys, or session tokens, or exploit other implementation flaws to assume users' identities. Example: An attacker could use stolen session tokens to impersonate a user.

Security Misconfiguration happens when security settings are defined, implemented, and maintained poorly, or when default accounts and unused services are not removed. Example: A server with default admin credentials is left accessible to attackers.

Cross-Site Scripting occurs when an attacker uses a web application to send malicious scripts to end-users. These vulnerabilities allow attackers to execute scripts in the user's browser, which can hijack user sessions or deface websites. Example: A comment section on a website allows the injection of a script that steals cookies.

XXE vulnerabilities occur when an application processes XML input that references external entities. Attackers can exploit vulnerable XML processors if they accept XML input from an untrusted source. Example: An attacker can use XXE to retrieve files on a server.

Insecure Deserialization flaws occur when untrusted data is used to abuse the logic of an application, inflict a denial of service (DoS), or execute arbitrary code when objects are deserialized. Example: An attacker modifies serialized objects to grant themselves admin privileges.

Applications using components with known vulnerabilities may undermine application defenses and enable various attacks. Example: An application using an old, vulnerable version of a library that allows remote code execution.

Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Example: An attacker dwells in a network undetected due to insufficient monitoring and inadequate alerting protocols.

Sensitive data exposure occurs when an application does not adequately protect sensitive information from being disclosed to attackers. This can include data in transit or at rest. Example: An unencrypted database with personal user information gets leaked.

Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. Adversaries use it to read or modify data without authorization. Example: An attacker might use SQL injection to manipulate a query to an SQL database.