Injection attacks

When untrusted data is sent to an interpreter, an attacker can inject malicious code.

Broken authentication

If authentication mechanisms are not implemented properly, attackers can expose these vulnerabilities.

Sensitive data exposure

Since many web applications and APIs lack data security, attackers can exploit sensitive financial, healthcare, and personal information.

XML external entities (XXE)

Many legacy XML processors evaluate extremal entities, which can be leveraged to disclose internal files.

Broken access controls

When user access and restrictions are not enforced, unauthorized users can potentially access confidential files.

Security misconfiguration

Default or ad-hoc configurations can lead to security misconfigurations that lead to vulnerabilities.

Cross-site scripting (XSS)

When an application includes untrusted data without validation, XSS flaws occur that can be used to perform attacks.

Insecure deserialization

Leads to remote code execution which can be used to perform attacks.

Using components with known vulnerabilities

Components often run with the same privileges as the application. If a vulnerability occurs, all components and applications can be compromised.

Insufficient logging and monitoring

Logging and monitoring that does not integrate with an incident response technology creates insufficient processes.

Bots

Programs that interact with our applications and often mimic human interaction. Good bots may be allowed to interact with an application, and include: search engines, virtual assistants, and content aggregators (e.g., price comparison sites). Bad bot activity can include: web scraping, competitive data mining, personal and financial data harvesting, account takeover, digital ad fraud, and transaction fraud.

Malicious uploads

Many web applications allow users to upload their own content, which can include a variety of malicious code payloads.

Unknown vulnerabilities

Signature-based solutions cannot protect against newly discovered vulnerabilities. A robust WAF solution must be able to defend against threats for which no signatures exist.

Zero-day attacks

Attacks that target previously unknown flaws in an application. When a threat actor discovers a zero-day vulnerability, they can use it to exploit systems that do not have additional defensive measures in place, such as a WAF.

Distributed Denial of Service (DDoS)

The use of a large number of systems, often a botnet of compromised computers, to overwhelm an application so that it cannot respond to user requests. DDoS attacks can attempt to simply overwhelm the system with traffic or may attempt to exploit a flaw in the application logic to achieve the same result.