[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571639-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-571639-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","owasp-top-10-2017-the-ten-most-critical-web-application-security-risks","OWASP Top 10-2017 - The Ten Most Critical Web Application Security Risks","","OWASP Top 10-2017 identifies the ten most critical web application security risks and explains why insecure software threatens financial, healthcare, defense, energy, and other essential infrastructure. It emphasizes the need to discover and resolve common risks quickly as software becomes more complex and connected. The foreword highlights extensive community feedback, concise testable issue recommendations, and guidance for developers, security testers, organizations, and application managers, referencing ASVS and next-step resources.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/general/","General",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/owasp-top-10-2017-the-ten-most-critical-web-application-security-risks/571639/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/owasp-top-10-2017-the-ten-most-critical-web-application-security-risks/571639.png","ImageObject",442,249,{"name":42,"@type":43},"EvelynWrites","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-26","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",8,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What is the purpose of OWASP Top 10-2017?","Question",{"text":63,"@type":64},"It raises awareness and provides a de facto application security standard by presenting the ten most critical web application security risks with concise, testable recommendations.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"Why is application security harder today, according to the foreword?",{"text":68,"@type":64},"Modern software is increasingly complex and connected, and rapid development processes increase the difficulty of achieving application security exponentially.",{"name":70,"@type":61,"acceptedAnswer":71},"Who should use the “What’s Next” guidance in OWASP Top 10-2017?",{"text":72,"@type":64},"The foreword provides different next steps for developers, security testers, organizations (suitable for CIOs and CISOs), and application managers responsible for the application lifecycle.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},571639,1792097053,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,119,124],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":116,"show_sort_weight":117,"slug":118},18,"Letters",30,"letters",{"id":120,"doc_module":22,"doc_module_name":25,"category_name":121,"show_sort_weight":122,"slug":123},21,"Paper Templates",5,"papers-templates",{"id":125,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":4,"slug":126},158,"general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":125,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":136,"language":137,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":138,"faqs":139,"seo_title":140,"seo_description":12,"update_tm":141,"read_time":142},687212989558,"https://ap-avatar.wpscdn.com/davatar_a8503ba1806abce46bf441b54a3ca4cd","OWASP Top 10-2017  \nThe Ten Most Critical Web Application Security Risks  \nThis work is licensed under a   \n[https://owasp.org](https://owasp.org)  Creative Commons Attribution-ShareAlike 4.0 International License  \n1  \nTOC Table of Contents  \n\n| Table of Contents |  |  | About OWASP |\n| --- | --- | --- | --- |\n| TOC-About OWASP   1\u003Cbr>FW-Foreword   2\u003Cbr>I-Introduction   3\u003Cbr>RN-Release Notes   4\u003Cbr>Risk-Application Security Risks   5\u003Cbr>T10-OWASP Top 10 Application Security\u003Cbr>Risks – 2017   6\u003Cbr>A1:2017-Injection …….………. .……………………… 7\u003Cbr>A2:2017-Broken Authentication   8\u003Cbr>A3:2017-Sensitive Data Exposure   9\u003Cbr>A4:2017-XML External Entities (XXE)    10\u003Cbr>A5:2017-Broken Access Control    11\u003Cbr>A6:2017-Security Misconfiguration    12\u003Cbr>A7:2017-Cross-Site Scripting (XSS)    13\u003Cbr>A8:2017-Insecure Deserialization    14\u003Cbr>A9:2017-Using Components with Known\u003Cbr>Vulnerabilities   15\u003Cbr>A10:2017-Insufficient Logging & Monitoring    16\u003Cbr>+D-What’s Next for Developers    17\u003Cbr>+T-What’s Next for Security Testers    18\u003Cbr>+O-What’s Next for Organizations    19\u003Cbr>+A-What’s Next for Application Managers   20\u003Cbr>+R-Note About Risks   21\u003Cbr>+RF-Details About Risk Factors   22\u003Cbr>+DAT-Methodology and Data …. .…………………23\u003Cbr>+ACK-Acknowledgements   24 |  |  | The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications and APIs that can be trusted.\u003Cbr>At OWASP, you'll find free and open:\u003Cbr>• Application security tools and standards.\u003Cbr>• Complete books on application security testing, secure code development, and secure code review.\u003Cbr>• Presentations and videos.\u003Cbr>• Cheat sheets on many common topics.\u003Cbr>• Standard security controls and libraries.\u003Cbr>• Local chapters worldwide.\u003Cbr>• Cutting edge research.\u003Cbr>• Extensive conferences worldwide.\u003Cbr>• Mailing lists.\u003Cbr>Learn more at: [https://www.owasp.org](https://www.owasp.org).\u003Cbr>All OWASP tools, documents, videos, presentations, and chapters are free and open to anyone interested in improving application security.\u003Cbr>We advocate approaching application security as a people, process, and technology problem, because the most effective approaches to application security require improvements in these areas.\u003Cbr>OWASP is a new kind of organization. Our freedom from commercial pressures allows us to provide unbiased, practical, and cost-effective information about application security.\u003Cbr>OWASP is not affiliated with any technology company, although we support the informed use of commercial security technology. OWASP produces many types of materials in a collaborative, transparent, and open way.\u003Cbr>The OWASP Foundation is the non-profit entity that ensures the project's long-term success. Almost everyone associated with OWASP is a volunteer, including the OWASP board, chapter leaders, project leaders, and project members. We support innovative security research with grants and infrastructure.\u003Cbr>Come join us! |\n| Copyright and License |  |  |  |\n| | Copyright © 2003 – 2017 The OWASP Foundation\u003Cbr>This document is released under the Creative Commons Attribution Share-Alike 4.0 license.\u003Cbr>For any reuse or distribution, you must make it clear to others the license terms of this work. |  |  |\n\n2  \nFW Foreword  \n\n| Foreword |\n| --- |\n| Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure. As our software becomes increasingly complex, and connected, the difficulty of achieving application security increases exponentially. The rapid pace of modern software development processes makes the most common risks essential to discover and resolve quickly and accurately. We can no longer afford to tolerate relatively simple security problems like those presented in this OWASP Top 10.\u003Cbr>A great deal of feedback was received during the creation of the OWASP Top 10-2017, more than for any other equivalent OWASP effort. This shows how much passion the communit","cbCaisZ7G10xeuKn","https://ap.wps.com/l/cbCaisZ7G10xeuKn","pdf",1787737,25,"English","# About OWASP\n# FW Foreword\n# Table of Contents\n## Introduction\n## Release Notes\n## OWASP Top 10 Application Security Risks – 2017\n## A1:2017 Injection\n## A2:2017 Broken Authentication\n## A3:2017 Sensitive Data Exposure\n## A4:2017 XML External Entities (XXE)\n## A5:2017 Broken Access Control\n## A6:2017 Security Misconfiguration\n## A7:2017 Cross-Site Scripting (XSS)\n## A8:2017 Insecure Deserialization\n## A9:2017 Using Components with Known Vulnerabilities\n## A10:2017 Insufficient Logging & Monitoring\n## What’s Next for Developers\n## What’s Next for Security Testers\n## What’s Next for Organizations\n## What’s Next for Application Managers\n## Note About Risks\n## Details About Risk Factors\n## Methodology and Data\n## Acknowledgements","[{\"question\":\"What is the purpose of OWASP Top 10-2017?\",\"answer\":\"It raises awareness and provides a de facto application security standard by presenting the ten most critical web application security risks with concise, testable recommendations.\"},{\"question\":\"Why is application security harder today, according to the foreword?\",\"answer\":\"Modern software is increasingly complex and connected, and rapid development processes increase the difficulty of achieving application security exponentially.\"},{\"question\":\"Who should use the “What’s Next” guidance in OWASP Top 10-2017?\",\"answer\":\"The foreword provides different next steps for developers, security testers, organizations (suitable for CIOs and CISOs), and application managers responsible for the application lifecycle.\"}]","OWASP Top 10-2017 - The Ten Most Critical Web Application Security Risks | PDF",1791922866,9]