OWASP Top 10 security vulnerabilities

Each year OWASP publishes a ranking that identifies the most critical security vulnerabilities. Here is the 2017 ranking :

• The Injection : corresponds to the risk of command injection (System, SQL, Shellcode, ...)
• Broken Authentification and Session Management : correspond to the risk of breaking or bypassing authentication and session management. Includes session theft or password recovery.
• Cross-Site Scripting : corresponds to the XSS either injecting content into a page, causing unwanted actions on a web page. XSS vulnerabilities are particularly widespread among the Web security vulnerabilities.
• Broken Access Control : corresponds to security breaches on the rights of authenticated users. Attackers can exploit these flaws to gain access to other users.
• Security Misconfiguration : corresponds to the vulnerabilities due to a poor configuration of the Web servers, applications, database or framework.
• Sensitive Data Exposure : corresponds to security breaches exposing sensitive data such as passwords, credit card numbers or personal data and the need to encrypt these data.
• Insufficient Attack Protection : corresponds to a lack of respect for good safety practices.
• Cross-Site Request Forgery (CSRF) : corresponds to the vulnerabilities related to the execution of requests without the knowledge of the user.
• Using Components with Known Vulnerabilities : corresponds to the vulnerabilities associated with the use of vulnerable third party components.
• Underprotected APIs : Corresponds to the lack of security of applications using APIs (Applications Programming Interface).

Source : owasp.org