api: YAML JSON TOON Database
version: 1.0.0
format: yaml
dataset:
  id: 2752
  slug: common-vulnerabilities-owasp
  title: OWASP Top 10 Vulnerabilities
  description: The OWASP Top 10 web application security risks.
  summary: The OWASP Top 10 web application security risks as ranked in the 2021 edition, from broken access control to server-side request forgery, each with a one-line description of what goes wrong. It is the standard shorthand for the most common classes of web vulnerability.
  use_when:
    - You are scoping a security review or training developers on common failure classes.
    - You need the official category names and their order in the 2021 list.
  caveats:
    - This is the 2021 edition. OWASP revises the list periodically, so check owasp.org for the current version before citing a rank.
    - A category is a class of weakness, not a single bug; the same application can have several instances of one category.
  related:
    - authentication-factors
    - cryptography-basics
    - http-authentication-methods
    - http-client-error-guide
  entry_count: 10
  fields:
    - section: data
      field: rank
      type: string
      example: A01
    - section: data
      field: name
      type: string
      example: Broken Access Control
    - section: data
      field: description
      type: string
      example: Restrictions on authenticated users are not pro…
  category: Cybersecurity
  category_slug: cybersecurity
  tags: security,owasp,vulnerabilities
  view_count: 40
  created_at: 1793403093
  updated_at: 1793403093
data:
  - rank: A01
    name: Broken Access Control
    description: Restrictions on authenticated users are not properly enforced.
  - rank: A02
    name: Cryptographic Failures
    description: Failures related to cryptography that expose sensitive data.
  - rank: A03
    name: Injection
    description: Untrusted data is sent to an interpreter as part of a command or query.
  - rank: A04
    name: Insecure Design
    description: Missing or ineffective security design controls.
  - rank: A05
    name: Security Misconfiguration
    description: Insecure default configurations or incomplete ad-hoc configurations.
  - rank: A06
    name: Vulnerable and Outdated Components
    description: Using components with known vulnerabilities.
  - rank: A07
    name: Identification and Authentication Failures
    description: Weaknesses in identity and session management.
  - rank: A08
    name: Software and Data Integrity Failures
    description: Assuming untrusted updates and data are valid.
  - rank: A09
    name: Security Logging and Monitoring Failures
    description: Insufficient logging and monitoring to detect and respond to attacks.
  - rank: A10
    name: Server-Side Request Forgery
    description: Forcing the server to make requests to unintended locations.