OWASP Top 10

In short: The OWASP Top 10 is a list of the ten most common and dangerous security risks in web applications, published by the non-profit organisation OWASP.

In more detail: It serves as an entry point for developers and as a basis for security tests. The list is updated every few years. The 2021 edition includes broken access control, cryptographic failures, injection, insecure design, misconfiguration and outdated components.

In Depth

1. Broken access control: Users can see or change data they should not.
2. Cryptographic failures: missing or weak encryption.
3. Injection: Input is executed as commands (SQL injection, XSS).
4. Insecure design: Security was not planned in.
5. Security misconfiguration: default passwords, open admin pages, verbose error messages.
6. Vulnerable and outdated components: dependencies and vulnerabilities (CVE).
7. Identification and authentication failures: weak passwords, missing 2FA.
8. Software and data integrity failures: insecure updates, supply chain.
9. Missing logging and monitoring.
10. Server-side request forgery (SSRF): The server is tricked into fetching internal addresses.

See also: CSRF (cross-site request forgery), Security headers (HSTS, CSP and more)