Security Cheat Sheets
Comprehensive security cheat sheets for Web, API, Mobile, and LLM vulnerabilities
Historical reference for OWASP Top 10 vulnerabilities from 2017
Current reference standard for web application security
Latest OWASP Top 10 recommendations and best practices
Critical security risks to web applications and services
Vulnerabilities specific to REST and GraphQL APIs
Android and iOS application security vulnerabilities
Large Language Model and AI security risks
The most critical security risks to web applications and APIs
Users can access data or functionality beyond their assigned permissions, leading to unauthorized information disclosure and manipulation.
View DetailsWeak or missing encryption exposes sensitive data in transit and at rest, allowing attackers to steal or modify information.
View DetailsUntrusted data sent to interpreters (SQL, OS, LDAP) allows attackers to inject malicious code and compromise data integrity.
View DetailsMissing or ineffective security controls in the design phase lead to fundamental security vulnerabilities in applications.
View DetailsInsecure default configurations, incomplete deployments, and unnecessary features leave applications vulnerable to exploitation.
View DetailsUsing components with known vulnerabilities puts applications at risk of exploitation through dependency chains.
View DetailsBroken authentication and session management allow attackers to compromise user accounts and gain unauthorized access.
View DetailsCode and infrastructure without integrity verification allows malicious updates and supply chain attacks.
View DetailsInsufficient logging and monitoring prevent detection and response to security incidents and breaches.
View DetailsSSRF vulnerabilities allow attackers to make the server perform unintended requests to internal or external resources.
View DetailsCritical security risks specific to REST and GraphQL APIs
APIs expose endpoints that allow direct access to object resources without proper authorization checks.
View DetailsAuthentication mechanisms in APIs lack proper protection against credential compromise and exploitation.
View DetailsAPIs fail to properly enforce authorization on individual object properties, exposing sensitive data.
View DetailsAPIs lack rate limiting and request size restrictions, enabling DoS attacks and resource exhaustion.
View DetailsAPIs enforce function-level authorization incorrectly, allowing users to access administrative functions.
View DetailsAPIs lack controls on sensitive business operations like payments, registrations, and administrative functions.
View DetailsAPIs make requests to user-supplied URLs without proper validation, allowing internal system exploitation.
View DetailsImproper API configuration, weak authentication, and debugging enabled in production expose vulnerabilities.
View DetailsFailure to track and manage API versions, endpoints, and deployments leads to exposure of deprecated and vulnerable APIs.
View DetailsApplications trust third-party APIs without proper validation and security measures, introducing supply chain risks.
View DetailsCritical security risks for Android and iOS applications
Mobile apps store, transmit, or use credentials insecurely, allowing attackers to steal authentication tokens.
View DetailsMobile apps depend on vulnerable third-party libraries and frameworks that introduce security risks.
View DetailsWeak authentication mechanisms and authorization flaws allow attackers to impersonate users or escalate privileges.
View DetailsMobile apps fail to validate user input and output, leading to injection attacks and data corruption.
View DetailsData transmitted between mobile apps and backends lacks proper encryption, exposing sensitive information.
View DetailsMobile apps collect and handle user data insecurely, violating privacy regulations and user expectations.
View DetailsMobile app binaries lack protections against reverse engineering, allowing attackers to analyze and modify code.
View DetailsInsecure default configurations and unnecessary features in mobile apps create security vulnerabilities.
View DetailsSensitive data stored insecurely on mobile devices can be accessed by attackers with physical or logical access.
View DetailsMobile apps use weak encryption algorithms or improper key management, compromising data confidentiality.
View DetailsCritical security risks for Large Language Models and AI applications
Attackers manipulate LLM inputs with malicious prompts to bypass security controls and manipulate model behavior.
View DetailsApplications fail to properly validate and sanitize LLM outputs, leading to injection and XSS vulnerabilities.
View DetailsAttackers inject malicious data into training datasets, causing LLMs to behave unintentionally or harmfully.
View DetailsAttackers overwhelm LLM systems with computationally expensive inputs, degrading performance and availability.
View DetailsThird-party models, plugins, and training data introduce security risks and vulnerabilities in LLM supply chains.
View DetailsLLMs may inadvertently leak sensitive training data, credentials, or proprietary information in their responses.
View DetailsLLM plugins lack proper input validation and access controls, enabling attackers to exploit integrations.
View DetailsLLMs granted too many permissions or capabilities can be manipulated to perform unintended harmful actions.
View DetailsApplications blindly trust LLM outputs without verification, leading to incorrect decisions and security breaches.
View DetailsAttackers attempt to extract and steal LLM models through prompt injection, membership inference, or extraction attacks.
View Details