// staticdata.dev — owaspTop10
// Generated file. Do not edit by hand.
// SPDX-License-Identifier: MIT

export const owaspTop10 = [
  {
    "rank": 1,
    "id": "A01:2021",
    "name": "Broken Access Control",
    "description": "Restrictions on what authenticated users are allowed to do are not properly enforced. Attackers can exploit these flaws to access unauthorized functionality or data, such as accessing other users' accounts, viewing sensitive files, modifying other users' data, or changing access rights."
  },
  {
    "rank": 2,
    "id": "A02:2021",
    "name": "Cryptographic Failures",
    "description": "Failures related to cryptography (or lack thereof) that often lead to exposure of sensitive data. This includes use of weak algorithms, improper key management, transmitting data in cleartext, and failing to enforce HTTPS or other encryption for sensitive data in transit or at rest."
  },
  {
    "rank": 3,
    "id": "A03:2021",
    "name": "Injection",
    "description": "User-supplied data is not validated, filtered, or sanitized by the application, allowing hostile data to be sent to an interpreter. SQL, NoSQL, OS, LDAP, and other injection attacks occur when untrusted data is sent to an interpreter as part of a command or query."
  },
  {
    "rank": 4,
    "id": "A04:2021",
    "name": "Insecure Design",
    "description": "Missing or ineffective control design representing weaknesses in the architecture and design of an application. Insecure design differs from insecure implementation; a securely implemented insecure design cannot be fixed by a perfect implementation."
  },
  {
    "rank": 5,
    "id": "A05:2021",
    "name": "Security Misconfiguration",
    "description": "The application is missing appropriate security hardening, has improper permissions, unnecessary features are enabled, default accounts and passwords remain unchanged, error handling reveals overly informative stack traces, or the latest security features are not configured."
  },
  {
    "rank": 6,
    "id": "A06:2021",
    "name": "Vulnerable and Outdated Components",
    "description": "Components such as libraries, frameworks, and software modules run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications using components with known vulnerabilities may undermine defenses."
  },
  {
    "rank": 7,
    "id": "A07:2021",
    "name": "Identification and Authentication Failures",
    "description": "Confirmation of the user's identity, authentication, and session management are critical to protect against authentication-related attacks. Failures include permitting automated attacks like credential stuffing, allowing weak passwords, missing multi-factor authentication, and improper session management."
  },
  {
    "rank": 8,
    "id": "A08:2021",
    "name": "Software and Data Integrity Failures",
    "description": "Code and infrastructure that does not protect against integrity violations. Applications relying on plugins, libraries, or modules from untrusted sources, repositories, and CDNs, or CI/CD pipelines without integrity verification are vulnerable to unauthorized modification of software or data."
  },
  {
    "rank": 9,
    "id": "A09:2021",
    "name": "Security Logging and Monitoring Failures",
    "description": "Insufficient logging, detection, monitoring, and active response allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show detection time exceeds 200 days, typically by external parties rather than internal processes."
  },
  {
    "rank": 10,
    "id": "A10:2021",
    "name": "Server-Side Request Forgery",
    "description": "SSRF flaws occur whenever a web application fetches a remote resource without validating the user-supplied URL. An attacker can coerce the application to send a crafted request to an unexpected destination, even when protected by a firewall, VPN, or another type of network access control list."
  }
] as const;

export type OwaspRisk = (typeof owaspTop10)[number];