OWASP Top Ten

• CWEs Mapped - 34
• Max Incidence Rate - 55.97%
• Avg Incidence Rate - 3.81%
• Avg Weighted Exploit - 6.92
• Avg Weighted Impact - 5.93
• Max Coverage - 94.55% 
• Avg Coverage - 47.72%
• Total Occurrences - 318,487
• Total CVEs - 19,013

• Violation of the principle of least privilege or deny by default, where access should only be granted for particular capabilities, roles, or users, but is available to anyone.
• Bypassing access control checks by modifying the URL (parameter tampering or force browsing), internal application state, or the HTML page, or by using an attack tool modifying API requests.
• Permitting viewing or editing someone else's account, by providing its unique identifier (insecure direct object references)
• Accessing API with missing access controls for POST, PUT and DELETE.
• Elevation of privilege. Acting as a user without being logged in or acting as an admin when logged in as a user.
• Metadata manipulation, such as replaying or tampering with a JSON Web Token (JWT) access control token, or a cookie or hidden field manipulated to elevate privileges or abusing JWT invalidation.
• CORS misconfiguration allows API access from unauthorized/untrusted origins.
• Force browsing to authenticated pages as an unauthenticated user or to privileged pages as a standard user.

pstmt.setString(1, request.getParameter("acct"));
ResultSet results = pstmt.executeQuery( );

https://example.com/app/accountInfo?acct=notmyacct

https://example.com/app/getappInfo
https://example.com/app/admin_getappInfo

• CWEs Mapped - 29
• Max Incidence Rate - 46.44%
• Avg Incidence Rate - 4.49%
• Avg Weighted Exploit - 7.29
• Avg Weighted Impact - 6.81
• Max Coverage - 79.33%  
• Avg Coverage - 34.85%
• Total Occurrences - 233,788
• Total CVEs - 3,075

• Is any data transmitted in clear text? This concerns protocols such as HTTP, SMTP, FTP also using TLS upgrades like STARTTLS. External internet traffic is hazardous. Verify all internal traffic, e.g., between load balancers, web servers, or back-end systems.
• Are any old or weak cryptographic algorithms or protocols used either by default or in older code?
• Are default crypto keys in use, weak crypto keys generated or re-used, or is proper key management or rotation missing? Are crypto keys checked into source code repositories?
• Is encryption not enforced, e.g., are any HTTP headers (browser) security directives or headers missing?
• Is the received server certificate and the trust chain properly validated?
• Are initialization vectors ignored, reused, or not generated sufficiently secure for the cryptographic mode of operation? Is an insecure mode of operation such as ECB in use? Is encryption used when authenticated encryption is more appropriate?
• Are passwords being used as cryptographic keys in absence of a password base key derivation function?
• Is randomness used for cryptographic purposes that was not designed to meet cryptographic requirements? Even if the correct function is chosen, does it need to be seeded by the developer, and if not, has the developer over-written the strong seeding functionality built into it with a seed that lacks sufficient entropy/unpredictability?
• Are deprecated hash functions such as MD5 or SHA1 in use, or are non-cryptographic hash functions used when cryptographic hash functions are needed?
• Are deprecated cryptographic padding methods such as PKCS number 1 v1.5 in use?
• Are cryptographic error messages or side channel information exploitable, for example in the form of padding oracle attacks?

• CWEs Mapped - 33
• Max Incidence Rate - 19.09%
• Avg Incidence Rate - 3.37%
• Avg Weighted Exploit - 7.25
• Avg Weighted Impact - 7.15
• Max Coverage - 94.04% 
• Avg Coverage - 47.90%
• Total Occurrences - 274,228 
• Total CVEs - 32,078

• User-supplied data is not validated, filtered, or sanitized by the application.
• Dynamic queries or non-parameterized calls without context-aware escaping are used directly in the interpreter.
• Hostile data is used within object-relational mapping (ORM) search parameters to extract additional, sensitive records.
• Hostile data is directly used or concatenated. The SQL or command contains the structure and malicious data in dynamic queries, commands, or stored procedures.

String query = "SELECT \* FROM accounts WHERE custID='" + request.getParameter("id") + "'";

Query HQLQuery = session.createQuery("FROM accounts WHERE custID='" + request.getParameter("id") + "'");

http://example.com/app/accountView?id=' UNION SELECT SLEEP(10);--

• CWEs Mapped - 40
• Max Incidence Rate - 24.19%
• Avg Incidence Rate - 3.00%
• Avg Weighted Exploit - 6.46
• Avg Weighted Impact - 6.78
• Max Coverage - 77.25%
• Avg Coverage - 42.51%
• Total Occurrences - 62,407
• Total CVEs - 2,691

• CWEs Mapped - 20
• Max Incidence Rate - 19.84%
• Avg Incidence Rate - 4.51%
• Avg Weighted Exploit - 8.12
• Avg Weighted Impact - 6.56
• Max Coverage - 89.58%
• Avg Coverage - 44.84%
• Total Occurrences - 208,387
• Total CVEs - 789

• CWEs Mapped - 3
• Max Incidence Rate - 27.96%
• Avg Incidence Rate - 8.77%
• Avg Weighted Exploit - 51.78%
• Avg Weighted Impact - 22.47%
• Max Coverage - 5.00
• Avg Coverage - 5.00
• Total Occurrences - 30,457
• Total CVEs - 0

• CVE-2017-5638, a Struts 2 remote code execution vulnerability that enables the execution of arbitrary code on the server, has been blamed for significant breaches.
• While the internet of things (IoT) is frequently difficult or impossible to patch, the importance of patching them can be great (e.g., biomedical devices).

• CWEs Mapped - 22
• Max Incidence Rate - 14.84%
• Avg Incidence Rate - 2.55%
• Avg Weighted Exploit - 7.40
• Avg Weighted Impact - 6.50
• Max Coverage - 79.51%
• Avg Coverage - 45.72%
• Total Occurrences - 132,195
• Total CVEs - 3,897

• CWEs Mapped - 10
• Max Incidence Rate - 16.67%
• Avg Incidence Rate - 2.05%
• Avg Weighted Exploit - 6.94
• Avg Weighted Impact - 7.94
• Max Coverage - 75.04%
• Avg Coverage - 45.35%
• Total Occurrences - 47,972
• Total CVEs - 1,152

• CWEs Mapped - 4
• Max Incidence Rate - 19.23%
• Avg Incidence Rate - 6.51%
• Avg Weighted Exploit - 6.87
• Avg Weighted Impact - 4.99
• Max Coverage - 53.67%
• Avg Coverage - 39.97%
• Total Occurrences - 53,615
• Total CVEs - 242

• Auditable events, such as logins, failed logins, and high-value transactions, are not logged.
• Warnings and errors generate no, inadequate, or unclear log messages.
• Logs of applications and APIs are not monitored for suspicious activity.
• Logs are only stored locally.
• Appropriate alerting thresholds and response escalation processes are not in place or effective.
• Penetration testing and scans by dynamic application security testing (DAST) tools (such as OWASP ZAP) do not trigger alerts.
• The application cannot detect, escalate, or alert for active attacks in real-time or near real-time.

• CWEs Mapped - 1
• Max Incidence Rate - 2.72%
• Avg Incidence Rate - 2.72%
• Avg Weighted Exploit - 8.28
• Avg Weighted Impact - 6.72
• Max Coverage - 67.72%
• Avg Coverage - 67.72%
• Total Occurrences - 9,503
• Total CVEs - 385