[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-571779-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-571779-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","top-10-vulnerabilities-2019-owasp-ebook-overview","Top 10 Vulnerabilities - 2019 - OWASP ebook overview","","Top 10 Vulnerabilities (2019) summarizes the OWASP Top Ten critical web application threats, explaining what each vulnerability is and why it matters for website safety. It introduces OWASP’s mission and then outlines the ten categories, from Injection and Broken Authentication to Sensitive Data Exposure, XSS, insecure deserialization, and insufficient logging and monitoring. The document also details how specific attacks work, such as untrusted input leading to SQL injection, and provides practical guidance for mitigation and secure development.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/presentations/","Presentations",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/top-10-vulnerabilities-2019-owasp-ebook-overview/571779/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/top-10-vulnerabilities-2019-owasp-ebook-overview/571779.png","ImageObject",442,249,{"name":42,"@type":43},"dhado","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",6,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"What does OWASP stand for and what is its core purpose?","Question",{"text":63,"@type":64},"OWASP stands for the Open Web Application Security Project. Its core purpose is to drive visibility and evolution in software safety and security through global community efforts.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"How does an Injection vulnerability typically work?",{"text":68,"@type":64},"An injection occurs when attackers send invalid or malicious input to a web application to make it behave differently than intended, often due to missing validation and sanitization of consumed data.",{"name":70,"@type":61,"acceptedAnswer":71},"What are common causes and prevention steps for Broken Authentication vulnerabilities?",{"text":72,"@type":64},"Broken Authentication usually results from logic issues like poor session management and weak defenses against brute force. Prevention includes applying security best practices, enforcing strong password and session handling, limiting failed login attempts, and using server-side secure session management.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},571779,1792015743,{"code":4,"msg":82,"data":83},"success",[84,88,93,98,103,108,113,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":86,"slug":87},11,90,"presentations",{"id":89,"doc_module":22,"doc_module_name":25,"category_name":90,"show_sort_weight":91,"slug":92},12,"Resumes",80,"resumes",{"id":94,"doc_module":22,"doc_module_name":25,"category_name":95,"show_sort_weight":96,"slug":97},14,"Invoices",70,"invoices",{"id":99,"doc_module":22,"doc_module_name":25,"category_name":100,"show_sort_weight":101,"slug":102},15,"Posters",60,"posters",{"id":104,"doc_module":22,"doc_module_name":25,"category_name":105,"show_sort_weight":106,"slug":107},16,"Social Media",50,"social-media",{"id":109,"doc_module":22,"doc_module_name":25,"category_name":110,"show_sort_weight":111,"slug":112},17,"Forms",40,"forms",{"id":114,"doc_module":22,"doc_module_name":25,"category_name":115,"show_sort_weight":116,"slug":117},18,"Letters",30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":85,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":114,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":55},5909893218464,"https://ap-avatar.wpscdn.com/davatar_085a072bc5b1113ac321206ff7593b45","OWASP  \n# Top 10 Vulnerabilities\n\n  2019  \nThe de facto list of critical threats to  \nyour website. Learn what they areand how to protect your website.*  \n*Based on the latest OWASP Top Ten list from 2017  \n## 2\n\nOWASP stands for the Open Web ApplicationSecurity Project, that produces articles,methodologies, documentation, tools, and technologiesin the field of web application security.  \nOWASP Core Purpose: Be the thriving globalcommunity that drives visibility and evolution inthe safety and security of the world’s software .  \n## The Top 10 OWASP vulnerabilities are\n\n1. Injection   3  \n2. Broken Authentication   4  \n3. Sensitive data exposure   5  \n4. XML External Entities (XXE)   8  \n5. Broken Access control   9  \n6. Security misconfigurations   11  \n7. Cross-Site Scripting (XSS)   13  \n8. Insecure Deserialization   15  \n9. Using Components with Known Vulnerabilities   16  \n10. Insufficient Logging and Monitoring   17  \n© 2019 Sucuri. All Rights Reserved. This ebook, “OWASP Top Ten Vulnerabilities 2019”, cites information and examples found in “Top 10-2017 Top Ten” by OWASP, used under CC BY-SA .  \n## 1. Injection\n\nAn injection of code happens when an attacker sends invalid data to the web applicationwith the intention to make it do something different from what the application wasdesigned/programmed to do.  \nPerhaps the most common example around this security vulnerability is the SQL queryconsuming untrusted data. You can see one of OWASP’s examples below:  \nString query = “SELECT * FROM accounts WHEREcustID =‘” + request.getParameter(“id”)+ “’”;  \nThis query can be exploited by calling up the web page executing it with the following URL:http://example.com/app/accountView?id=’ or ’1’=’1, causing the return of all the rowsstored on the database table.  \nThe core of a code injection vulnerability is the lack of validation and sanitization of thedata consumed by the web application, which means that this vulnerability can be presenton almost any type of technology.  \nAnything that accepts parameters asinput can potentially be vulnerableto a code injection attack.  \nHere is another example of an SQL injection that affected over half a million websites.  \nThis code is part of the function get _products() . If attackers set arbitrary values for thevariable $limit they can modify the query in a way that can lead to a full compromise onsome servers.  \nIf ( ! empty( $is _default ) ) {  \nif( ! empty( $user_id) ) {$this->generate _defualt _wishlist( $user_iD );  \n}  \n$sql. = “ AND l. `is _default` = %d”;  \n}  \nif (! empty( $id ) ) {  \n$sql. = “ AND `i.ID` = %d”;  \n$sql _args [] = $id;  \n}  \n$sql .= “GROUP BY i .prod _id, L.ID”;  \nif (!empty ( $limit ) && isset ( $offset ) ) {  \n$sql .= “ LIMIT “. $offset . “ , “. $limit;  \n}  \n$wishlist = $wpdb-> get _results ($wpdb\u003Cprepare ( $sql, $sql _args ), ARRAY_A );}  \n3  \n## 2 . Broken Authentication\n\nA broken authentication vulnerability can allow an attackerto use manual or automatic mediums to try to gaincontrol over a user account – or even worse – to gaincomplete control over the system.  \nWebsites with broken authentication vulnerabilitiesare very common on the web. Broken Authenticationusually refers to logic issues that occur on the applicationauthentication’s mechanism, like bad session managementprone to username enumeration.  \nTo avoid broken authentication, don’t leave the login pagefor admins publicly accessible to all visitors of the website:  \n/administrator on Joomla!,/wp-admin/ on WordPress,/index.php/admin on Magento,/user/login on Drupal.  \nThe second most common form of this flaw is allowingusers to brute force username/password combinationsagainst those pages.  \nTypes of Vulnerabilities  \nHowever, broken authentication vulnerabilities can comein many forms. According to OWASP, a web applicationcontains a broken authentication vulnerability if it:  \n• Permits automated attacks such as credentialstuffing, where the attacker has a list of validusernames and passwords.  \n• P","cbCaiesTmuPU7X66","https://ap.wps.com/l/cbCaiesTmuPU7X66","pdf",2717481,"English","# Top 10 Vulnerabilities\n## OWASP and the Top Ten overview\n## 1. Injection\n## 2. Broken Authentication","[{\"question\":\"What does OWASP stand for and what is its core purpose?\",\"answer\":\"OWASP stands for the Open Web Application Security Project. Its core purpose is to drive visibility and evolution in software safety and security through global community efforts.\"},{\"question\":\"How does an Injection vulnerability typically work?\",\"answer\":\"An injection occurs when attackers send invalid or malicious input to a web application to make it behave differently than intended, often due to missing validation and sanitization of consumed data.\"},{\"question\":\"What are common causes and prevention steps for Broken Authentication vulnerabilities?\",\"answer\":\"Broken Authentication usually results from logic issues like poor session management and weak defenses against brute force. Prevention includes applying security best practices, enforcing strong password and session handling, limiting failed login attempts, and using server-side secure session management.\"}]","Top 10 Vulnerabilities - 2019 - OWASP ebook overview | PDF",1791923689]