日前，開放Web利用安然項(xiàng)目(OWASP)發(fā)布了2013年十大年夜最關(guān)頭的Web利用安然風(fēng)險(xiǎn)，該列表從2010年開端更新，本年“Broken Authentication and Session Management”排到了第二的位置，同時(shí)“Injection”仍然保留在首位。
OWASP TOP 10 2013
1、Injection(1)
2、Broken Authentication and Session Management(3)
3、Cross-Site Scripting(XSS)(2)
4、Insecure Direct Object References(4)
5、Security Misconfiguration(6)
6、Sensitive Data Exposure(7/9)
7、Missing Function Level Access Control(8)
8、Cross-Site Request Forgery(CSRF)(5)
9、Using Known Vulnerable Components(-)
10、Unvalidated Redirects and Forwards(10)
附OWASP TOP 10 2010
Injection
Cross-Site Scripting(XSS)
Broken Authentication and Session Management
Insecure Direct Object References
Cross-Site Request Forgery(CSRF)
Security Misconfiguration
Insecure Cryptographic Storage
Failure to Restrict URL Access
Insufficient Transport Layer Protection
Unvalidated Redirects and Forwards