- Insufficiently protected credentials: Credentials, such as usernames and passwords, are a valuable target for attackers. If credentials are not properly protected, attackers can use them to gain unauthorized access to systems and data.
- Incorrect Permission Assignment for Critical Resource: Critical resources, such as databases and servers, should be protected with appropriate permissions. If permissions are not assigned correctly, attackers may be able to access or modify these resources without authorization.
- Improper Restriction of XML External Entity Reference (XXE): XXE is a vulnerability that allows attackers to inject malicious XML code into an application. This can lead to a variety of attacks, such as data theft and denial-of-service.
- Server-Side Request Forgery (SSRF): SSRF is a vulnerability that allows attackers to trick an application into making unauthorized requests to other servers. This can be used to steal data, execute arbitrary code, or pivot to other systems on the network.
- Improper Neutralization of Special Elements used in a Command (Command Injection): Command injection is a vulnerability that allows attackers to inject arbitrary commands into an application. This can lead to a variety of attacks, such as remote code execution and system takeovers.
- Out-of-bounds Write
- Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- Use After Free
- Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
- Improper Input Validation
- Out-of-bounds Read
- Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
- Cross-Site Request Forgery (CSRF)
- Unrestricted Upload of File with Dangerous Type
- Missing Authorization
- NULL Pointer Dereference
- Improper Authentication
- Integer Overflow or Wraparound
- Deserialization of Untrusted Data
- Improper Restriction of Operations within the Bounds of a Memory Buffer
- Missing Authentication for Critical Function
- Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)
- Improper Privilege Management
- Improper Control of Generation of Code (Code Injection)
- Incorrect Authorization
Senselearner Technologies Pvt. Ltd.
