Owasp Top Ten 2017. Owasp top 10 2017. The list has some new additions and consolidates.
A4 insecure direct object references and a7 missing function level access control merged into a52017 broken access control. Owasp top 10 application security risks 2017 a12017 injection injection flaws such as sql nosql os and ldap injection occur when untrusted data is sent to an interpreter as part of a command or query. The owasp top 10 2017 is based primarily on 40 data submissions from firms that specialize in application security and an industry survey that was completed by over 500 individuals.
2017 top 10 a12017 injection a22017 broken authentication a32017 sensitive data exposure a42017 xml external entities xxe a52017 broken access control a62017 security misconfiguration a72017 cross site scripting xss a82017 insecure deserialization a92017 using components with known vulnerabilities.
A4 xml external entities. Insecure deserialization was ranked at number three so it was added to the top 10 as a82017 insecure deserialization after risk rating. See the chart below for the main vulnerabilities. The owasp top 10 list is developed by web.