Penn Information Security: SWAT Top ten Web Application Vulnerabilities


	Saturday, May 25, 2013

	New Resources
	Combating Malware
	SafeDNS
	Phishing Archive
	Cloud Computing and Data Outsourcing
	Best Practices for Applications with Confidential University Data

	Security "Greatest Hits"
	Managing Passwords
	E-mail Harassment & Forgery
	Hoaxes, frauds & scams
	Spam
	Phishing
	Wireless Networking
	Encryption & digital signatures

	Best Practices
	Secure desktop computing
	Secure servers
	Secure data deletion
	Securing printers
	Tips for safe computing
	Computing policies

	More in-depth information for
	Local support providers
	System administrators

	Security initiatives
	Critical host compliance
	Authentication & authorization
	Penn Security & Privacy Assessment (SPIA)
	Security Liaisons (Restricted Access)
	Secure Share
	Secure Space
	Vulnerability Scanner

	Related links
	Electronic privacy
	PennKey
	Viruses
	Worms, trojans, backdoors

Top 10 Web Application Security Vulnerabilities

Customized for Penn by the Secure Web Application Team
Last Updated: August 11, 2006

	Introduction
1.	Unvalidated Input
2.	Broken Access Control
3.	Broken Authentication and Session Management
4.	Cross-Site Scripting (XSS) Flaws
5.	Buffer Overflows
6.	Injection Flaws (Shell Commands and SQL)
7.	Improper Error Handling
8.	Insecure Storage
9.	Denial of Service
10.	Insecure Configuration Management
	Conclusions



Information Systems and Computing University of Pennsylvania Comments & Questions