api: YAML JSON TOON Database
version: 1.0.0
format: json
dataset:
  slug: common-vulnerabilities-owasp
  title: OWASP Top 10 Vulnerabilities
  description: The OWASP Top 10 web application security risks.
  summary: "The OWASP Top 10 web application security risks as ranked in the 2021 edition, from broken access control to server-side request forgery, each with a one-line description of what goes wrong. It is the standard shorthand for the most common classes of web vulnerability."
  use_when[2]: You are scoping a security review or training developers on common failure classes.,You need the official category names and their order in the 2021 list.
  caveats[2]: "This is the 2021 edition. OWASP revises the list periodically, so check owasp.org for the current version before citing a rank.","A category is a class of weakness, not a single bug; the same application can have several instances of one category."
  related[4]: authentication-factors,cryptography-basics,http-authentication-methods,http-client-error-guide
  category: Cybersecurity
  category_slug: cybersecurity
  tags: "security,owasp,vulnerabilities"
  view_count: 0
  entry_count: 10
  fields[3]{section,field,type,example}:
    data,rank,string,A01
    data,name,string,Broken Access Control
    data,description,string,Restrictions on authenticated users are not pro…
data[10]{rank,name,description}:
  A01,Broken Access Control,Restrictions on authenticated users are not properly enforced.
  A02,Cryptographic Failures,Failures related to cryptography that expose sensitive data.
  A03,Injection,Untrusted data is sent to an interpreter as part of a command or query.
  A04,Insecure Design,Missing or ineffective security design controls.
  A05,Security Misconfiguration,Insecure default configurations or incomplete ad-hoc configurations.
  A06,Vulnerable and Outdated Components,Using components with known vulnerabilities.
  A07,Identification and Authentication Failures,Weaknesses in identity and session management.
  A08,Software and Data Integrity Failures,Assuming untrusted updates and data are valid.
  A09,Security Logging and Monitoring Failures,Insufficient logging and monitoring to detect and respond to attacks.
  A10,Server-Side Request Forgery,Forcing the server to make requests to unintended locations.