A1-Broken Access Control

1. Insecure Direct Object Reference (IDOR)
2. Privilege Escalation
3. CORS Misconfiguration
4. Cross-Site Request Forgery
5. Open Redirection
6. Parameter Pollution
7. Mass Assignment

Remediation

• Appropriate access control model (e.g. DAC, MAC, RBAC)
• Principle of least privilege
• Deny by default
• Defense in depth strategy
• Fine grained authorization

A2-Cryptographic Failures

1. Expired SSL/TLS Certificate
2. Improper key management
3. Backdated hashing
4. Low entropy tokens
5. Weak Encryption