OWASP Top 10:
Protection Against All

Injection flaws (i.e. SQL, OS and LDAP injection) happen when untrusted data is transmitted to an interpreter as part of either a command or a query. The hostile data can trick the interpreter into executing unwanted commands or accessing data without authorization.

Cross Site Scripting (XSS) flaws happen when applications take untrusted data and sends it to a web browser without the proper validation. XSS give attackers the ability to execute scripts in browsers, hijack sessions, vandalize websites and redirect traffic.

Many applications do nothing to protect sensitive user information. Without encryption, an attacker can eavesdrop on connections made with the app, steal and manipulate information in transit and then use it to commit fraud and other crimes.

Many web applications verify function level access right before that functionality is made visible via UI. Those applications will need to perform the same control checks on the server when accessing each function. Without proper verification attackers can forge requests.

Many applications use components that are known to have vulnerabilities. The components are often given full privileges as well. If a vulnerable component can be exploited it could lead to serious data loss or even loss of control over the server.

Installing cyber security software is only one step, servers and security implementations still need to be configured properly. Without proper configuration, even the most robust of security solutions can be exploited, penetrated and defeated.

Direct Object References occur when developers expose references to internal implementation objects, like files, directories and databases. Without the proper control check, attackers can exploit these references to access sensitive data.

Authentication and session management functions are crucial, yet many companies and organizations do not implement them correctly. This allows attackers to compromise passwords and keys, and exploit other implementations.

Cross Site Request Forgery (CSRF) forces a victim’s browser to send a fake HTTP request that includes sensitive information (such as cookies and authentication information) to a vulnerable web application. The app then thinks all future requests from the browser are legitimate.

Web applications regularly forward users to and from various websites and pages using untrusted data to determine the destination. Without the proper validation, an attacker can redirect victims to a malicious website or use forwards to access unauthorized pages.