Top 10 2013-Release Notes - Revision history

T.Gigler: deleted a doubled 'luseprev' paramater (avoids 'Category: Pages using duplicate arguments in template calls')

2017-04-23T20:32:03Z

deleted a doubled 'luseprev' paramater (avoids 'Category: Pages using duplicate arguments in template calls')

Paul Swift: Removed typo.

2013-07-05T09:34:42Z

Removed typo.

T.Gigler: 5) We added: 2013-A9: Using Components with Known Vulnerabilities: .... risk of using components with known vulnerabilities. underlined 3 times

2013-06-17T20:53:04Z

5) We added: 2013-A9: Using Components with Known Vulnerabilities: .... risk of using components with known vulnerabilities. <u>underlined</u> 3 times

T.Gigler: internationalization: Top_10:LanguageFile|text=whatChangedFrom2010to2013

2013-06-15T17:38:50Z

internationalization: Top_10:LanguageFile|text=whatChangedFrom2010to2013

T.Gigler: Internationalized 2013-Links and corrected description for 2013-A7 and A9

2013-06-14T23:29:07Z

Internationalized 2013-Links and corrected description for 2013-A7 and A9

T.Gigler: added '|year=2013 |language=en, prev={{Top_10:LanguageFile...}}, |next={{Top_10:LanguageFile...}}' at Top/BottomTemplates and '|language=en' where it has been missing

2013-06-14T15:24:45Z

added '|year=2013 |language=en, prev={{Top_10:LanguageFile...}}, |next={{Top_10:LanguageFile...}}' at Top/BottomTemplates and '|language=en' where it has been missing

Neil Smithline at 12:05, 10 May 2013

2013-05-10T12:05:08Z

T.Gigler: Changed use of Template 'Top_10_2010:SubsectionAdvancedTemplate': Replace Parameter 'number' by 'subsection' and 'position'

2013-04-13T22:26:04Z

Changed use of Template 'Top_10_2010:SubsectionAdvancedTemplate': Replace Parameter 'number' by 'subsection' and 'position'

Neil Smithline at 22:19, 23 February 2013

2013-02-23T22:19:30Z

Neil Smithline at 22:15, 23 February 2013

2013-02-23T22:15:41Z

@@ Line 66: / Line 66: @@
 {{Top_10_2013:BottomTemplate
    |usenext=2013NextLink
    |next={{Top_10:LanguageFile|text=risk|year=2013|language=en}}
    |useprev=2013PrevLink

@@ Line 11: / Line 11: @@
 The threat landscape for applications security constantly changes. Key factors in this evolution are advances made by attackers, the release of new technologies with new weaknesses as well as more built in defenses, and the deployment of increasingly complex systems. To keep pace, we periodically update the OWASP Top 10. In this 2013 release, we made the following changes:
 <ol>
-<li>Broken Authentication and Session Management moved up in prevalence based on our data set,. Probably because this area is being looked at harder, not because issues are actually more prevalent. This caused Risks A2 and A3 to switch places.</li>
+<li>Broken Authentication and Session Management moved up in prevalence based on our data set. Probably because this area is being looked at harder, not because issues are actually more prevalent. This caused Risks A2 and A3 to switch places.</li>
 <li>Cross-Site Request Forgery (CSRF) moved down in prevalence based on our data set from 2010-A5 to 2013-A8. We believe this is because CSRF has been in the OWASP Top 10 for 6 years, and organizations and framework developers have focused on it enough to significantly reduce the number of CSRF vulnerabilities in real world applications.</li>
 <li>We broadened Failure to Restrict URL Access from the 2010 OWASP Top 10 to be more inclusive:

@@ Line 15: / Line 15: @@
 <li>We broadened Failure to Restrict URL Access from the 2010 OWASP Top 10 to be more inclusive:
 <p style="padding-left: 2em; text-indent: -2em;">
-+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2010-A8: Failure to Restrict URL Access is now 2013-A7: Missing Function Level Access Control – to cover all of function level access control. There are many ways to specify which function is being accessed, not just the URL.</p></li>
++&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2010-A8: Failure to Restrict URL Access is now <u>2013-A7: Missing Function Level Access Control</u> – to cover all of function level access control. There are many ways to specify which function is being accessed, not just the URL.</p></li>
-<li>We merged and broadened 2010-A7 & 2010-A9 to CREATE: 2013-A6: Sensitive Data Exposure:
+<li>We merged and broadened 2010-A7 & 2010-A9 to CREATE: <u>2013-A6: Sensitive Data Exposure</u>:
 <p style="padding-left: 2em; text-indent: -2em;">
 -&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This new category was created by merging 2010-A7 – Insecure Cryptographic Storage  & 2010-A9 - Insufficient Transport Layer Protection, plus adding browser side sensitive data risks as well. This new category covers sensitive data protection (other than access control which is covered by 2013-A4 and 2013-A7) from the moment sensitive data is provided by the user, sent to and stored within the application, and then sent back to the browser again.</p></li>
-<li>We added: 2013-A9: Using Known Vulnerable Components:
+<li>We added: <u>2013-A9: Using Components with Known Vulnerabilities</u>:
 <p style="padding-left: 2em; text-indent: -2em;">
-+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This issue was mentioned as part of 2010-A6 – Security Misconfiguration, but now deserves a category in its own right as the growth and depth of component based development has significantly increased the risk of using known vulnerable components.</p></li>
++&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This issue was mentioned as part of 2010-A6 – Security Misconfiguration, but now has a category of its own as the growth and depth of component based development has significantly increased the risk of using components with known vulnerabilities.</p></li>
 </ol>
 {{Top_10:SubsectionTableEndTemplate}}

@@ Line 8: / Line 8: @@
 }}
-{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title=What Changed From 2010 to 2013?|width=100%|year=2013|language=en}}
+{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title={{Top_10:LanguageFile|text=whatChangedFrom2010to2013|year=2013|language=en}}|width=100%|year=2013|language=en}}
 The threat landscape for applications security constantly changes. Key factors in this evolution are advances made by attackers, the release of new technologies with new weaknesses as well as more built in defenses, and the deployment of increasingly complex systems. To keep pace, we periodically update the OWASP Top 10. In this 2013 release, we made the following changes:
 <ol>

@@ Line 31: / Line 31: @@
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A1 | A1-Injection]]
-| [[Top_10_2013-A1 | A1-Injection]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}|A1-{{Top_10_2010:ByTheNumbers|1|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A3 | A3-Broken Authentication and Session Management]]
-| [[Top_10_2013-A2 | A2-Broken Authentication and Session Management]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}|A2-{{Top_10_2010:ByTheNumbers|2|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A2 | A2-Cross Site Scripting (XSS)]]
-| [[Top_10_2007-A3 | A3-Cross Site Scripting (XSS)]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}|A3-{{Top_10_2010:ByTheNumbers|3|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A4 | A4-Insecure Direct Object Reference]]
-| [[Top_10_2013-A4 | A4-Insecure Direct Object References]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}|A4-{{Top_10_2010:ByTheNumbers|4|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A6 | A6-Security Misconfiguration]]
-| [[Top_10_2013-A5 | A5-Security Misconfiguration]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}|A5-{{Top_10_2010:ByTheNumbers|5|language=en|year=2013}}]]
 |- style="background-color: #D7D6C0;"
 | [[Top_10_2010-A7 | A7-Insecure Cryptographic Storage - Merged with A9 -->]]
-| [[Top_10_2013-A6 | A6-Sensitive Data Exposure]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}|A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}]]
 |- style="background-color: #D7D6C0;"
 | [[Top_10_2010-A8 | A8-Failure to Restrict URL Access - Broadened into -->]]
-| [[Top_10_2013-A7 | A7-Missing Function Level Action Control]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}|A7-{{Top_10_2010:ByTheNumbers|7|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2007-A5 | A5-Cross Site Request Forgery (CSRF)]]
-| [[Top_10_2013-A8 | A8-Cross Site Request Forgery (CSRF)]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}|A8-{{Top_10_2010:ByTheNumbers|8|language=en|year=2013}}]]
 |- style="background-color: #D7D6C0;"
 | [[Top_10_2010-A6 | <buried in A6: Security Misconfiguration>]]
-| [[Top_10_2013-A9 | A9-Using Known Vulnerable Components]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}|A9-{{Top_10_2010:ByTheNumbers|9|language=en|year=2013}}]]
 |- style="background-color: #FFFFFF;"
 | [[Top_10_2010-A10 | A10-Unvalidated Redirects and Forwards]]
-| [[Top_10_2013-A10 | A10-Unvalidated Redirects and Forwards]]
+| [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}|A10-{{Top_10_2010:ByTheNumbers|10|language=en|year=2013}}]]
 |- style="background-color: #E6B9B8;"
 | [[Top_10_2010-A9 | A9-Insufficient Transport Layer Protection]]
-| Merged with [[Top_10_2010-A7 | 2010-A7]] into [[Top_10_2013-A6 | 2013-A6]]
+| Merged with [[Top_10_2010-A7 | 2010-A7]] into [[{{Top_10:LanguageFile|text=documentRootTop10|year=2013|language=en}}-A6-{{Top_10_2010:ByTheNumbers|6|language=en|year=2013}}|2013-A6]]
 |}
 </center>

@@ Line 1: / Line 1: @@
 {{Top_10_2013:TopTemplate
      |usenext=2013NextLink
-     |next=Risk
+     |next={{Top_10:LanguageFile|text=risk|year=2013|language=en}}
      |useprev=2013PrevLink
-     |prev=Introduction
+     |prev={{Top_10:LanguageFile|text=introduction|year=2013|language=en}}
 }}
-{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title=What Changed From 2010 to 2013?|width=100%|year=2013}}
+{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title=What Changed From 2010 to 2013?|width=100%|year=2013|language=en}}
 The threat landscape for applications security constantly changes. Key factors in this evolution are advances made by attackers, the release of new technologies with new weaknesses as well as more built in defenses, and the deployment of increasingly complex systems. To keep pace, we periodically update the OWASP Top 10. In this 2013 release, we made the following changes:
 <ol>
@@ Line 62: / Line 64: @@
 |}
 </center>
-{{Top_10_2013:BottomTemplate|usenext=2013NextLink|useprev=2013PrevLink|prev=Introduction|next=Risk}}
+{{Top_10_2013:BottomTemplate

@@ Line 6: / Line 6: @@
 }}
-{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|title=What Changed From 2010 to 2013?|number=whole|width=100%|year=2013}}
+{{Top_10:SubsectionTableBeginTemplate|type=main}}{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|position=firstWhole|title=What Changed From 2010 to 2013?|width=100%|year=2013}}
 The threat landscape for applications security constantly changes. Key factors in this evolution are advances made by attackers, the release of new technologies with new weaknesses as well as more built in defenses, and the deployment of increasingly complex systems. To keep pace, we periodically update the OWASP Top 10. In this 2013 release, we made the following changes:
 <ol>
@@ Line 21: / Line 21: @@
 +&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This issue was mentioned as part of 2010-A6 – Security Misconfiguration, but now deserves a category in its own right as the growth and depth of component based development has significantly increased the risk of using known vulnerable components.</p></li>
 </ol>
-</td></tr/></table>
+{{Top_10:SubsectionTableEndTemplate}}
 <center>