日前，開放Web應(yīng)用安全項目（OWASP）公布了2013年十大最關(guān)鍵的Web應(yīng)用安全風(fēng)險，該列表從2010年開始更新，今年“Broken Authentication and Session Management”排到了第二的位置，同時“Injection”仍然保留在首位。

OWASP ***0 2013

1、Injection(1)

2、Broken Authentication and Session Management(3)

3、Cross-Site Scripting(XSS)(2)

4、Insecure Direct Object References(4)

5、Security Misconfiguration(6)

6、Sensitive Data Exposure(7/9)

7、Missing Function Level Access Control(8)

8、Cross-Site Request Forgery(CSRF)(5)

9、Using Known Vulnerable Components(-)

10、Unvalidated Redirects and Forwards(10)

附OWASP ***0 2010

Injection

Cross-Site Scripting(XSS)

Broken Authentication and Session Management

Insecure Direct Object References

Cross-Site Request Forgery(CSRF)

Security Misconfiguration

Insecure Cryptographic Storage

Failure to Restrict URL Access

Insufficient Transport Layer Protection

Unvalidated Redirects and Forwards