This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Category:Vulnerability"
From OWASP
| (4 intermediate revisions by 3 users not shown) | |||
| Line 1: | Line 1: | ||
| − | + | This category is for tagging common types of software vulnerabilities. | |
| − | + | ==What is a vulnerability?== | |
| + | <categorytree hideroot="on" style="float:right; clear:right; margin-left:1ex; border:1px solid gray; padding:0.7ex; background-color:white;">Vulnerability</categorytree> | ||
| + | A vulnerability is a hole or a weakness in the application, which can be a design flaw or an implementation bug, that allows an attacker to cause harm to the stakeholders of an application. Stakeholders include the application owner, application users, and other entities that rely on the application. The term "vulnerability" is often used very loosely. However, here we need to distinguish [[:Category:Threat|threats]], [[:Category:Attack|attacks]], and [[:Category:Countermeasure|countermeasures]]. | ||
| − | + | Please '''do not post any actual vulnerabilities''' in products, services, or web applications. Those disclosure reports should be posted to bugtraq or full-disclosure mailing lists. | |
| − | |||
| − | |||
| − | |||
| − | + | ==Examples of vulnerabilities== | |
| + | * Lack of input validation on user input | ||
| + | * Lack of sufficient logging mechanism | ||
| + | * Fail-open error handling | ||
| + | * Not closing the database connection properly | ||
| − | + | For a great overview, check out the [[OWASP Top Ten Project]]. You can read about the top vulnerabilities and download a paper that covers them in detail. Many organizations and agencies use the Top Ten as a way of creating awareness about application security. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | {{Template:PutInCategory}} | |
| − | + | '''NOTE:''' Before you add a vulnerability, please search and make sure there isn't an equivalent one already. You may want to consider creating a redirect if the topic is the same. Every vulnerability article has a defined structure. Please read the details of [[How To Add a Vulnerability]] before creating a new article. | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Latest revision as of 19:23, 6 June 2016
This category is for tagging common types of software vulnerabilities.
What is a vulnerability?
A vulnerability is a hole or a weakness in the application, which can be a design flaw or an implementation bug, that allows an attacker to cause harm to the stakeholders of an application. Stakeholders include the application owner, application users, and other entities that rely on the application. The term "vulnerability" is often used very loosely. However, here we need to distinguish threats, attacks, and countermeasures.
Please do not post any actual vulnerabilities in products, services, or web applications. Those disclosure reports should be posted to bugtraq or full-disclosure mailing lists.
Examples of vulnerabilities
- Lack of input validation on user input
- Lack of sufficient logging mechanism
- Fail-open error handling
- Not closing the database connection properly
For a great overview, check out the OWASP Top Ten Project. You can read about the top vulnerabilities and download a paper that covers them in detail. Many organizations and agencies use the Top Ten as a way of creating awareness about application security.
How to add a new Vulnerability article
You can follow the instructions to make a new Vulnerability article. Please use the appropriate structure and follow the Tutorial. Be sure to paste the following at the end of your article to make it show up in the Vulnerability category:
[[Category:Vulnerability]]
NOTE: Before you add a vulnerability, please search and make sure there isn't an equivalent one already. You may want to consider creating a redirect if the topic is the same. Every vulnerability article has a defined structure. Please read the details of How To Add a Vulnerability before creating a new article.
Subcategories
This category has the following 20 subcategories, out of 20 total.
A
C
E
G
I
L
P
S
U
Pages in category "Vulnerability"
The following 63 pages are in this category, out of 63 total.
C
I
P
U
- Unchecked Error Condition
- Unchecked Return Value: Missing Check against Null
- Undefined Behavior
- Unreleased Resource
- Unrestricted File Upload
- Unsafe function call from a signal handler
- Unsafe JNI
- Unsafe Mobile Code
- Unsafe use of Reflection
- Use of hard-coded password
- Use of Obsolete Methods
- Using a broken or risky cryptographic algorithm
- Using freed memory
