Owasp Top 10

Question 1

This occurs when restrictions on what authenticated users can do aren’t properly enforced. Attackers can exploit these weaknesses to access unauthorized functionality or data.

Answer 1

Broken Access Control

Question 2

this category focuses on failures related to protecting data in transit and at rest. It includes issues like weak encryption, misconfigured cryptographic modules, or not encrypting sensitive data.

Answer 2

Cryptographic Failures

Question 3

flaws, such as SQL, NoSQL, command, or LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. This can allow attackers to execute unintended commands or access data.

Answer 3

Injection

Question 4

emphasizes the need for secure design patterns and threat modeling in the development process. It covers architectural weaknesses that cannot be fixed by simply adding security controls later.

Answer 4

Insecure Design

Question 5

This vulnerability arises from insecure default configurations, incomplete configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages that provide sensitive information to attackers.

Answer 5

Security Misconfiguration

Question 6

Often referred to as “Using Components with Known Vulnerabilities,” this risk is about using libraries, frameworks, and other software modules that have known security issues, which attackers can exploit if not properly updated or patched.

Answer 6

Vulnerable and Outdated Components

Question 7

this category involves issues with managing user identities and sessions. Weak password policies, insecure session management, and improper implementation of multi-factor authentication fall under this category.

Answer 7

Identification and Authentication Failures

Question 8

This category deals with failures related to code and data integrity. It includes issues where software updates, critical data, or even CI/CD pipelines are not properly protected, allowing unauthorized modifications.

Answer 8

Software and Data Integrity Failures

Question 9

This category emphasizes the importance of comprehensive logging, alerting, and monitoring systems to identify suspicious activities early.

Answer 9

Security Logging and Monitoring Failures

Question 10

vulnerabilities occur when a server fetches a remote resource without validating the user-supplied URL. This can allow attackers to trick the server into making requests to unintended locations, potentially exposing internal systems.

Answer 10

Server-Side Request Forgery (SSRF)