Top Vulnerabilities

Unvalidated Input

Information from Web requests is not validated before being used by a web application.

Broken Access Control

Restrictions on what authenticated users are allowed to do are not properly enforced.

Broken Authentication and Session Mgmt.

Account credentials and session tokens are not properly protected.

Cross-site Scripting (XSS) Flaws

The Web application can be used as a mechanism to transport an attack to an end user's browser.

Buffer Overflows

Web applications pass parameters when they access external systems or the local operation system. If an attacker can embed malicious commands in these parameters, the external system may execute those commands on behalf of the web application.

Improper Error Handling

Error conditions that occur during normal operation are not handled properly and could result in giving detailed system information to a hacker, or crash the server.

Insecure Storage

Web applications frequently use cryptographic functions to protect information and credentials. If not coded properly, it can result in weak protection.

Denial of Service

Attackers can consume web application resources to a point where legitimate users can no longer access or use the application.

Insecure configuration management

Strong server configuration standard is critical to a secure web application. Servers are not secure out of the box and need to be configured for security.