Appsec Knowledge Base

COMMON WEB APPLICATION VULNERABILITIES

The following is an extensive library of security solutions, articles and guides that are meant to be helpful and informative resources on a range of Web vulnerability types, including, but not limited to, Cross-Site Scripting, SQL injection, CSRF injection and insufficient transport layer weaknesses. Web application vulnerabilities are some of the most common flaws leading to modern data breaches. 

Ask A Qualified Appsec Expert

Struggling with fixing a code weakness? Knowledgeable consultants at Veracode can help you out.

Ask in the Community

Application Vulnerabilities - Software system flaws or weaknesses in an application that could be exploited to compromise the security of the application. Learn More

Buffer Overflow - Buffer Overflows occur when there is more data in a buffer than it can handle, causing data to overflow into adjacent storage. Learn More

CRLF Injection - CRLF Injection attacks refer to the special character elements "Carriage Return" and "Line Feed." Exploits occur when an attacker is able to inject a CRLF sequence into an HTTP stream. Learn More

Cross-Site Request Forgery - Cross-Site Request Forgery (CSRF) is a malicious attack that tricks the user’s web browser to perform undesired actions so that they appear as if an authorized user is performing those actions. Learn More

Cross-Site Scripting - XSS vulnerabilities target scripts embedded in a page that are executed on the client-side (in the user’s web browser) rather than on the server-side. Learn More

Directory Traversal - Directory traversal is a type of HTTP exploit that is used by attackers to gain unauthorized access to restricted directories and files. Learn More

Encapsulation - Encapsulation refers to a programming approach that revolves around data and functions contained, or encapsulated, within a set of operating instructions. Learn More 

Failure to Restrict URL Access - One of the common vulnerabilities listed on the Open Web Application Security Project’s (OWASP) Top 10. The OWASP Top 10 details the most critical vulnerabilities in web applications. Learn More

Format String - Format String attacks occur when an application interprets data as a command and allows an attacker to access the underlying code base. Learn More

Insecure Cryptographic Storage - Insecure Cryptographic Storage is a common vulnerability that occurs when sensitive data is not stored securely from internal users. Learn More

Insufficient Transport Layer Protection - Insufficient transport layer protection is a security weakness caused by applications not taking any measures to protect network traffic. Learn More

LDAP Injection - LDAP injection is the technique of exploiting web applications that use client-supplied data in LDAP statements without first stripping potentially harmful characters from the request. Learn More

Malicious Code - Analysis tools are designed to uncover any code in any part of a software system or script that is intended to cause undesired effects, security breaches or damage to a system. Learn More

OS Command Injection - Command injection refers to a class of critical application vulnerabilities involving dynamically generated content. Attackers execute arbitrary commands on a host operating system using a vulnerable application. Learn More

SQL Injection - SQL injection is a type of web application security vulnerability in which an attacker is able to submit a database SQL command, which is executed by a web application, exposing the back-end database. Learn More

Secure Coding Handbook

Learn best practices from the pros at Veracode.

Get the Handbook

 

 

contact menu