New answers tagged

0

There are hundreds of web-apps based vulnerabilities and can be categorized into these: Input Validation (XSS, SQL Injection) Authentication (weak password, user enumeration) Authorization (privilege escalation, insecure direction object reference) Session Management (session fixation, absent logout button) Disclosure of Information (Detailed error ...


1

I am the lead architect of a very popular vulnerability database and we face similar problems. At the moment we have nearly 90'000 vulnerability entries with a CVSSv2 base and temp score. We are adding CVSSv3 scores and trying to convert most of the old data. I am going to discuss this transformation only to illustrate the basic principle of such. The most ...


1

This is highly opinionated and controversial, but I wanted to provide food-for-thought for you to make your own decision. There's OWASP, CWE, and WASC. I don't like any of them. Why shouldn't I use any of these categorization methods? OWASP Top 10 attempts to provide a most common list at a high-level view of what has happened in the last two years. But ...


-1

Just use Open FAIR instead of CVSS and the Owasp Risk Rating Methodology. Forgo any old ratings you have and definitely avoid the vendor-driven scores. There are some nice facets of the OWASP Risk Rating Methodology (a major consultancy I worked for a few years back used it to great success with our clients) as well as CVSS (especially v3), but I think FAIR ...


0

When ZAP start the scanner is off.I take a screenshot so i can tell you the basic of ZAP. http://imgur.com/9xBebTK select the profile for scan Target to scan Here is where the scanner put the results



Top 50 recent answers are included