Skip to content

Latest commit

 

History

History
511 lines (462 loc) · 33.2 KB

CHANGELOG.md

File metadata and controls

511 lines (462 loc) · 33.2 KB
Raw

Change Log

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning

[Unreleased]

Added

Removed

Changed

v1.14.1 - 2024-07-18

Changed

  • vulnerability-rating-taxononomy.json correction

v1.14 - 2024-07-09

Added

  • Server Security Misconfiguration - Email verification bypass - P5
  • Server Security Misconfiguration - Missing Subresource Integrity - P5
  • Sensitive Data Exposure - Token Leakage via Referer - Password Reset Token - P5
  • Server Security Misconfiguration - Software Package Takeover - VARIES
  • Broken Access Control (BAC) - Privilege Escalation - VARIES
  • Data Biases - Representation Bias - VARIES
  • Data Biases - Pre-existing Bias - VARIES
  • Algorithmic Biases - Processing Bias - VARIES
  • Algorithmic Biases - Aggregation Bias - VARIES
  • Societal Biases - Confirmation Bias - VARIES
  • Societal Biases - Systemic Bias - VARIES
  • Misinterpretation Biases - Context Ignorance - VARIES
  • Developer Biases - Implicit Bias - VARIES

Removed

  • Broken Authentication and Session Management - Privilege Escalation - VARIES

v1.13 - 2024-04-02

Added

  • Physical Security Issues - Bypass of physical access control - VARIES
  • Physical Security Issues - Weakness in physical access control - Clonable Key - VARIES
  • Physical Security Issues - Weakness in physical access control - Master Key Identification - VARIES
  • Physical Security Issues - Weakness in physical access control - Commonly Keyed System - P2
  • Insecure OS/Firmware - Weakness in Firmware Updates - Firmware cannot be updated - VARIES
  • Insecure OS/Firmware - Weakness in Firmware Updates - Firmware does not validate update integrity- P3
  • Insecure OS/Firmware - Weakness in Firmware Updates - Firmware is not encrypted- P5
  • Insecure OS/Firmware - Kiosk Escape or Breakout - VARIES
  • Insecure OS/Firmware - Poorly Configured Disk Encryption - VARIES
  • Insecure OS/Firmware - Shared Credentials on Storage - P3
  • Insecure OS/Firmware - Over-Permissioned Credentials on Storage - P2
  • Insecure OS/Firmware - Local Administrator on default environment - P2
  • Insecure OS/Firmware - Poorly Configured Operating System Security - VARIES
  • Insecure OS/Firmware - Recovery of Disk Contains Sensitive Material - VARIES
  • Insecure OS/Firmware - Failure to Remove Sensitive Artifacts from Disk - VARIES
  • Insecure OS/Firmware - Data not encrypted at rest - Sensitive - VARIES
  • Insecure OS/Firmware - Data not encrypted at rest - Non sensitive - P5

v1.12 - 2023-12-18

Added

  • Application Level DoS - Excessive Resource Consumption - Injection (Prompt) - VARIES
  • AI Application Security - Large Language Model (LLM) Security - Prompt Injection - P1
  • AI Application Security - Large Language Model (LLM) Security - LLM Output Handling - P1
  • AI Application Security - Large Language Model (LLM) Security - Training Data Poisoning - P1
  • AI Application Security - Large Language Model (LLM) Security - Excessive Agency/Permission Manipulation - P2

v1.11 - 2023-11-20

Added

  • Sensitive Data Exposure - Disclosure of Secrets - PII Leakage/Exposure: VARIES
  • Server-Side Injection - Content Spoofing - HTML Content Injection: P5
  • Broken Authentication and Session Management - Failure to invalidate session - Permission change: VARIES
  • Server Security Misconfiguration - Request Smuggling: VARIES
  • Server-Side Injection - LDAP Injection: VARIES
  • Cryptographic Weakness - Insufficient Entropy - Limited Random Number Generator (RNG) Entropy Source: P4
  • Cryptographic Weakness - Insufficient_Entropy - Use of True Random Number Generator (TRNG) for Non-Security Purpose: P5
  • Cryptographic Weakness - Insufficient_Entropy - Pseudo-Random Number Generator (PRNG) Seed Reuse: P5
  • Cryptographic Weakness - Insufficient_Entropy - Predictable Pseudo-Random Number Generator (PRNG) Seed: P4
  • Cryptographic Weakness - Insufficient_Entropy - Small Seed Space in Pseudo-Random Number Generator (PRNG): P4
  • Cryptographic Weakness - Insufficient_Entropy - Initialization Vector (IV) Reuse: P5
  • Cryptographic Weakness - Insufficient_Entropy - Predictable Initialization Vector (IV): P4
  • Cryptographic Weakness - Insecure Implementation - Missing Cryptographic Step: VARIES
  • Cryptographic Weakness - Insecure Implementation - Improper Following of Specification (Other): VARIES
  • Cryptographic Weakness - Weak Hash - Lack of Salt: VARIES
  • Cryptographic Weakness - Weak Hash - Use of Predictable Salt: P5
  • Cryptographic Weakness - Weak Hash - Predictable Hash Collision: VARIES
  • Cryptographic Weakness - Insufficient Verification of Data Authenticity - Integrity Check Value (ICV): P4
  • Cryptographic Weakness - Insufficient Verification of Data Authenticity - Cryptographic Signature: VARIES
  • Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Prime Selection: VARIES
  • Cryptographic Weakness - Insecure Key Generation - Improper Asymmetric Exponent Selection: VARIES
  • Cryptographic Weakness - Insecure Key Generation - Insufficient Key Stretching: VARIES
  • Cryptographic Weakness - Insecure Key Generation - Insufficient Key Space: P3
  • Cryptographic Weakness - Insecure Key Generation - Key Exchage Without Entity Authentication: P3
  • Cryptographic Weakness - Key Reuse - Lack of Perfect Forward Secrecy: P4
  • Cryptographic Weakness - Key Reuse - Intra-Environment: P5
  • Cryptographic Weakness - Key Reuse - Inter-Environment: P2
  • Cryptographic Weakness - Side-Channel Attack - Padding Oracle Attack: P4
  • Cryptographic Weakness - Side-Channel Attack - Timing Attack: P4
  • Cryptographic Weakness - Side-Channel Attack - Power Analysis Attack: P5
  • Cryptographic Weakness - Side-Channel Attack - Emanations Attack: P5
  • Cryptographic Weakness - Side-Channel Attack - Differential Fault Analysis: VARIES
  • Cryptographic Weakness - Use of Expired Cryptographic Key (or Certificate): P4
  • Cryptographic Weakness - Incomplete Cleanup of Keying Material: P5
  • Cryptographic Weakness - Broken Cryptography - Use of Broken Cryptographic Primitive: P3
  • Cryptographic Weakness - Broken Cryptography - Use of Vulnerable Cryptographic Library: P4
  • Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Non-Sensitive Information: P5
  • Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information/GUID/Complex Object Identifiers: P4
  • Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read Sensitive Information/Iterable Object Identifiers: P3
  • Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Edit/Delete Sensitive Information/Iterable Object Identifiers: P2
  • Broken Access Control (BAC) - Insecure Direct Object References (IDOR) - Read/Edit/Delete Sensitive Information (PII)/Iterable Object Identifier: P1

Changed

FROM:

  • Cross-Site Scripting (XSS) - IE-Only - Older Version (< IE11): P5

TO:

  • Cross-Site Scripting (XSS) - IE-Only: P5

FROM:

  • Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
  • Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
  • Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - External: P4
  • Broken Access Control (BAC) - Server-Side Request Forgery (SSRF) - DNS Query Only : P5

TO:

  • Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal High Impact: P2
  • Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - Internal Scan and/or Medium Impact: P3
  • Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - Low impact: P5
  • Server Security Misconfiguration - Server-Side Request Forgery (SSRF) - External - DNS Query Only: P5

FROM:

  • Automotive Security Misconfiguration - Infotainment, Radio Head Unit - PII Leakage: P1

TO:

  • Automotive Security Misconfiguration - Infotainment, Radio Head Unit - Sensitive data Leakage/Exposure: P1

Removed

  • Cross-Site Scripting (XSS) - IE-Only - IE11: P4
  • Cross-Site Scripting (XSS) - XSS Filter Disabled: P5
  • Broken Cryptography - Cryptographic Flaw - Incorrect Usage: P1

v1.10.1 - 2021-03-29

Changed

  • renamed secure code warriors mapping to secure code warrior

v1.10 - 2021-03-18

Added

  • insufficient_security_configurability.verification_of_contact_method_not_required
  • insufficient_security_configurability.weak_two_fa_implementation.two_fa_code_is_not_updated_after_new_code_is_requested
  • insufficient_security_configurability.weak_two_fa_implementation.old_two_fa_code_is_not_invalidated_after_new_code_is_generated
  • broken_authentication_and_session_management.weak_login_function.over_http
  • server_security_misconfiguration.oauth_misconfiguration.account_squatting
  • Third-party mapping to Secure Code Warrior trainings
  • automotive_security_misconfiguration.can.injection_battery_management_system
  • automotive_security_misconfiguration.can.injection_steering_control
  • automotive_security_misconfiguration.can.injection_pyrotechnical_device_deployment_tool
  • automotive_security_misconfiguration.can.injection_headlights
  • automotive_security_misconfiguration.can.injection_sensors
  • automotive_security_misconfiguration.can.injection_vehicle_anti_theft_systems
  • automotive_security_misconfiguration.can.injection_powertrain
  • automotive_security_misconfiguration.can.injection_basic_safety_message
  • automotive_security_misconfiguration.battery_management_system
  • automotive_security_misconfiguration.battery_management_system.firmware_dump
  • automotive_security_misconfiguration.battery_management_system.fraudulent_interface
  • automotive_security_misconfiguration.gnss_gps
  • automotive_security_misconfiguration.gnss_gps.spoofing
  • automotive_security_misconfiguration.immobilizer
  • automotive_security_misconfiguration.immobilizer.engine_start
  • automotive_security_misconfiguration.abs
  • automotive_security_misconfiguration.abs.unintended_acceleration_brake
  • automotive_security_misconfiguration.rsu
  • automotive_security_misconfiguration.rsu.sybil_attack
  • automotive_security_misconfiguration.infotainment_radio_head_unit
  • automotive_security_misconfiguration.infotainment_radio_head_unit.pii_leakage
  • automotive_security_misconfiguration.infotainment_radio_head_unit.ota_firmware_manipulation
  • automotive_security_misconfiguration.infotainment_radio_head_unit.code_execution_can_bus_pivot
  • automotive_security_misconfiguration.infotainment_radio_head_unit.code_execution_no_can_bus_pivot
  • automotive_security_misconfiguration.infotainment_radio_head_unit.unauthorized_access_to_services
  • automotive_security_misconfiguration.infotainment_radio_head_unit.source_code_dump
  • automotive_security_misconfiguration.infotainment_radio_head_unit.dos_brick
  • automotive_security_misconfiguration.infotainment_radio_head_unit.default_credentials

Removed

  • insufficient_security_configurability.lack_of_verification_email
  • broken_authentication_and_session_management.weak_login_function.https_not_available_or_http_by_default
  • broken_authentication_and_session_management.weak_login_function.http_and_https_available
  • broken_authentication_and_session_management.weak_login_function.lan_only
  • cross_site_request_forgery_csrf.flash_based.high_impact
  • cross_site_request_forgery_csrf.flash_based.low_impact
  • automotive_security_misconfiguration.infotainment
  • automotive_security_misconfiguration.infotainment.pii_leakage
  • automotive_security_misconfiguration.infotainment.code_execution_can_bus_pivot
  • automotive_security_misconfiguration.infotainment.code_execution_no_can_bus_pivot
  • automotive_security_misconfiguration.infotainment.unauthorized_access_to_services
  • automotive_security_misconfiguration.infotainment.source_code_dump
  • automotive_security_misconfiguration.infotainment.dos_brick
  • automotive_security_misconfiguration.infotainment.default_credentials

Changed

  • server_security_misconfiguration.lack_of_security_headers.cache_control_for_a_non_sensitive_page updated remediation advice
  • server_security_misconfiguration.lack_of_security_headers.cache_control_for_a_sensitive_page updated remediation advice
  • cross_site_scripting_xss.flash_based priority changed from P4 to P5
  • cross_site_request_forgery_csrf.flash_based priority changed from null to P5 (due to children removal)
  • using_components_with_known_vulnerabilities.rosetta_flash priority changed from P4 to P5

v1.9 - 2020-05-22

Added

  • sensitive_data_exposure.disclosure_of_secrets.for_publicly_accessible_asset
  • sensitive_data_exposure.disclosure_of_secrets.for_internal_asset
  • sensitive_data_exposure.disclosure_of_secrets.pay_per_use_abuse
  • sensitive_data_exposure.disclosure_of_secrets.intentionally_public_sample_or_invalid
  • sensitive_data_exposure.disclosure_of_secrets.data_traffic_spam
  • sensitive_data_exposure.disclosure_of_secrets.non_corporate_user
  • server_side_injection.ssti.basic
  • server_side_injection.ssti.custom
  • sensitive_data_exposure.via_localstorage_sessionstorage.sensitive_token
  • sensitive_data_exposure.via_localstorage_sessionstorage.non_sensitive_token
  • mobile_security_misconfiguration.auto_backup_allowed_by_default
  • server_security_misconfiguration.no_rate_limiting_on_form.change_password
  • server_side_injection.content_spoofing.impersonation_via_broken_link_hijacking
  • cross_site_request_forgery_csrf.flash_based.high_impact
  • cross_site_request_forgery_csrf.flash_based.low_impact
  • insufficient_security_configurability.password_policy_bypass

Removed

  • sensitive_data_exposure.critically_sensitive_data.password_disclosure
  • sensitive_data_exposure.critically_sensitive_data.private_api_keys
  • sensitive_data_exposure.critically_sensitive_data

v1.8 - 2019-09-25

Added

  • server_security_misconfiguration.race_condition
  • server_security_misconfiguration.cache_poisoning
  • indicators_of_compromise
  • broken_authentication_and_session_management.failure_to_invalidate_session.on_two_fa_activation_change

Removed

  • mobile_security_misconfiguration.clipboard_enabled.on_sensitive_content
  • mobile_security_misconfiguration.clipboard_enabled.on_non_sensitive_content

Changed

  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_non_email_domain name changed from "Email Spoofing on non-email domain" to "Email Spoofing on Non-Email Domain"
  • mobile_security_misconfiguration.clipboard_enabled priority changed from null to P5 (due to children removal)

v1.7.1 - 2019-04-15

Added

  • Remediation Advice and CVSS mappings for automotive_security_misconfiguration

v1.7 - 2019-03-13

Added

  • sensitive_data_exposure.weak_password_reset_implementation.token_leakage_via_host_header_poisoning
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_non_email_domain
  • broken_access_control.username_enumeration.non_brute_force
  • insufficient_security_configurability.weak_two_fa_implementation.two_fa_secret_cannot_be_rotated
  • insufficient_security_configurability.weak_two_fa_implementation.two_fa_secret_remains_obtainable_after_two_fa_is_enabled
  • insufficient_security_configurability.weak_two_fa_implementation
  • sensitive_data_exposure.token_leakage_via_referer.trusted_third_party
  • sensitive_data_exposure.token_leakage_via_referer.untrusted_third_party
  • cross_site_scripting_xss.ie_only.ie_eleven
  • cross_site_scripting_xss.ie_only.older_version_ie_eleven
  • automotive_security_misconfiguration
  • automotive_security_misconfiguration.infotainment
  • automotive_security_misconfiguration.infotainment.pii_leakage
  • automotive_security_misconfiguration.infotainment.code_execution_can_bus_pivot
  • automotive_security_misconfiguration.infotainment.code_execution_no_can_bus_pivot
  • automotive_security_misconfiguration.infotainment.unauthorized_access_to_services
  • automotive_security_misconfiguration.infotainment.source_code_dump
  • automotive_security_misconfiguration.infotainment.dos_brick
  • automotive_security_misconfiguration.infotainment.default_credentials
  • automotive_security_misconfiguration.rf_hub
  • automotive_security_misconfiguration.rf_hub.key_fob_cloning
  • automotive_security_misconfiguration.rf_hub.can_injection_interaction
  • automotive_security_misconfiguration.rf_hub.data_leakage_pull_encryption_mechanism
  • automotive_security_misconfiguration.rf_hub.unauthorized_access_turn_on
  • automotive_security_misconfiguration.rf_hub.roll_jam
  • automotive_security_misconfiguration.rf_hub.replay
  • automotive_security_misconfiguration.rf_hub.relay
  • automotive_security_misconfiguration.can
  • automotive_security_misconfiguration.can.injection_disallowed_messages
  • automotive_security_misconfiguration.can.injection_dos
  • server_side_injection.content_spoofing.email_hyperlink_injection_based_on_email_provider

Removed

  • broken_access_control.username_enumeration.data_leak
  • insufficient_security_configurability.weak_2fa_implementation
  • sensitive_data_exposure.token_leakage_via_referer.trusted_3rd_party
  • sensitive_data_exposure.token_leakage_via_referer.untrusted_3rd_party
  • cross_site_scripting_xss.ie_only.ie11
  • cross_site_scripting_xss.ie_only.older_version_ie11

Changed

  • server_security_misconfiguration.username_enumeration name changed from "Username Enumeration" to "Username/Email Enumeration"
  • broken_access_control.username_enumeration name changed from "Username Enumeration" to "Username/Email Enumeration"
  • updated Remediation Advice reference URLs for OWASP

v1.6 - 2018-09-13

Added

  • broken_access_control.server_side_request_forgery_ssrf.internal_high_impact
  • broken_access_control.server_side_request_forgery_ssrf.internal_scan_and_or_medium_impact
  • server_security_misconfiguration.mail_server_misconfiguration.no_spoofing_protection_on_email_domain
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_to_inbox_due_to_missing_or_misconfigured_dmarc_on_email_domain
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_to_spam_folder
  • server_security_misconfiguration.mail_server_misconfiguration.missing_or_misconfigured_spf_and_or_dkim

Removed

  • broken_access_control.server_side_request_forgery_ssrf.internal
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_email_domain
  • server_security_misconfiguration.mail_server_misconfiguration.missing_spf_on_non_email_domain
  • server_security_misconfiguration.mail_server_misconfiguration.spf_uses_a_soft_fail
  • server_security_misconfiguration.mail_server_misconfiguration.spf_includes_10_lookups
  • server_security_misconfiguration.mail_server_misconfiguration.missing_dmarc

v1.5 - 2018-09-13

Added

  • unvalidated_redirects_and_forwards.open_redirect.flash_based
  • cross_site_scripting_xss.flash_based
  • server_side_injection.content_spoofing.flash_based_external_authentication_injection
  • broken_authentication_and_session_management.session_fixation.remote_attack_vector
  • broken_authentication_and_session_management.session_fixation.local_attack_vector
  • broken_authentication_and_session_management.cleartext_transmission_of_session_token
  • broken_access_control.server_side_request_forgery_ssrf.dns_query_only
  • mobile_security_misconfiguration.clipboard_enabled
  • mobile_security_misconfiguration.clipboard_enabled.on_sensitive_content
  • mobile_security_misconfiguration.clipboard_enabled.on_non_sensitive_content
  • server_security_misconfiguration.waf_bypass.direct_server_access
  • broken_authentication_and_session_management.two_fa_bypass
  • server_security_misconfiguration.no_rate_limiting_on_form.sms_triggering
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofing_on_email_domain
  • server_security_misconfiguration.insecure_ssl.certificate_error
  • cross_site_scripting_xss.stored.privileged_user_to_privilege_elevation
  • cross_site_scripting_xss.stored.privileged_user_to_no_privilege_elevation
  • server_security_misconfiguration.clickjacking.form_input
  • server_security_misconfiguration.misconfigured_dns.basic_subdomain_takeover
  • server_security_misconfiguration.misconfigured_dns.high_impact_subdomain_takeover
  • server_security_misconfiguration.captcha
  • server_security_misconfiguration.captcha.missing
  • cross_site_request_forgery_csrf.csrf_token_not_unique_per_request

Removed

  • server_security_misconfiguration.mail_server_misconfiguration.missing_spf_on_email_domain
  • server_security_misconfiguration.mail_server_misconfiguration.email_spoofable_via_third_party_api_misconfiguration
  • cross_site_scripting_xss.stored.admin_to_anyone
  • server_security_misconfiguration.misconfigured_dns.subdomain_takeover
  • server_security_misconfiguration.captcha_bypass

Changed

  • broken_authentication_and_session_management.failure_to_invalidate_session.on_password_change updated remediation advice
  • CWE mapping default changed from [CWE-2000] to null
  • Updated python version to 3.6
  • cross_site_scripting_xss.stored.non_admin_to_anyone name changed from "Non-Admin to Anyone" to "Non-Privileged User to Anyone"
  • server_security_misconfiguration.clickjacking.sensitive_action name changed from "Sensitive Action" to "Sensitive Click-Based Action"
  • server_security_misconfiguration.captcha_bypass.implementation_vulnerability moved via subcategory change to server_security_misconfiguration.captcha.implementation_vulnerability
  • server_security_misconfiguration.captcha_bypass.brute_force moved via subcategory change to server_security_misconfiguration.captcha.brute_force

v1.4 - 2018-04-13

Added

  • insufficient_security_configurability.weak_password_reset_implementation.token_is_not_invalidated_after_login
  • server_side_injection.content_spoofing.rtlo
  • mapping of VRT to CWE
  • server_security_misconfiguration.dbms_misconfiguration.excessively_privileged_user_dba
  • cross_site_scripting_xss.stored.url_based
  • server_security_misconfiguration.oauth_misconfiguration.insecure_redirect_uri
  • server_security_misconfiguration.oauth_misconfiguration.account_takeover
  • client_side_injection.binary_planting.non_default_folder_privilege_escalation
  • broken_authentication_and_session_management.weak_login_function.not_operational
  • broken_authentication_and_session_management.weak_login_function.other_plaintext_protocol_no_secure_alternative
  • broken_authentication_and_session_management.weak_login_function.lan_only
  • broken_authentication_and_session_management.weak_login_function.http_and_https_available
  • broken_authentication_and_session_management.weak_login_function.https_not_available_or_http_by_default
  • cross_site_scripting_xss.ie_only.ie11
  • cross_site_scripting_xss.ie_only.older_version_ie11
  • broken_authentication_and_session_management.failure_to_invalidate_session.on_logout_server_side_only
  • sensitive_data_exposure.sensitive_token_in_url.user_facing
  • sensitive_data_exposure.sensitive_token_in_url.in_the_background
  • sensitive_data_exposure.sensitive_token_in_url.on_password_reset
  • mapping of VRT to Remediation Advice

Removed

  • server_side_injection.sql_injection.error_based
  • server_side_injection.sql_injection.blind
  • broken_authentication_and_session_management.weak_login_function.over_http
  • cross_site_scripting_xss.ie_only.older_version_ie_10_11
  • cross_site_scripting_xss.ie_only.older_version_ie10
  • broken_authentication_and_session_management.failure_to_invalidate_session.on_password_reset
  • network_security_misconfiguration.telnet_enabled.credentials_required
  • server_security_misconfiguration.using_default_credentials.production_server
  • server_security_misconfiguration.using_default_credentials.staging_development_server

Changed

  • Use unittest for vrt validations
  • broken_authentication_and_session_management.failure_to_invalidate_session.all_sessions name changed from "All Sessions" to "Concurrent Sessions On Logout"
  • server_security_misconfiguration.oauth_misconfiguration.missing_state_parameter name changed from "Missing State Parameter" to "Missing/Broken State Parameter"
  • server_security_misconfiguration.oauth_misconfiguration.missing_state_parameter priority changed from P4 to null
  • server_security_misconfiguration.no_rate_limiting_on_form.login priority changed from P3 to P4
  • client_side_injection.binary_planting.privilege_escalation name changed from "Privilege Escalation" to "Default Folder Privilege Escalation" priority changed from P4 to P3
  • server_security_misconfiguration.lack_of_password_confirmation.change_email_address priority changed from P4 to P5
  • server_security_misconfiguration.lack_of_password_confirmation.change_password priority changed from P4 to P5
  • server_security_misconfiguration.unsafe_file_upload.no_antivirus priority changed from P4 to P5
  • server_security_misconfiguration.unsafe_file_upload.no_size_limit priority changed from P4 to P5
  • broken_authentication_and_session_management.failure_to_invalidate_session.on_logout name changed from "On Logout" to "On Logout (Client and Server-Side)"
  • broken_authentication_and_session_management.failure_to_invalidate_session.on_password_change name changed from "On Password Change" to "On Password Reset and/or Change"
  • network_security_misconfiguration.telnet_enabled priority changed from null to P5 (due to children removal)
  • server_security_misconfiguration.using_default_credentials priority changed from null to P1 (due to children removal)

v1.3.1 - 2017-10-31

Changed

  • references to the invalid insufficient_security_configurability.weak_password_policy.no_password_policy updated to insufficient_security_configurability.no_password_policy

v1.3.0 - 2017-09-22

Added

  • insecure_data_transport.cleartext_transmission_of_sensitive_data
  • broken_access_control
  • broken_access_control.idor
  • mobile_security_misconfiguration.tapjacking
  • server_security_misconfiguration.misconfigured_dns.missing_caa_record
  • mapping of VRT to CVSS V3
  • server_security_misconfiguration.bitsquatting

Removed

  • missing_function_level_access_control
  • insecure_direct_object_references_idor

Changed

  • missing_function_level_access_control.server_side_request_forgery_ssrf moved via category change to broken_access_control.server_side_request_forgery_ssrf
  • missing_function_level_access_control.server_side_request_forgery_ssrf.internal moved via category change to broken_access_control.server_side_request_forgery_ssrf.internal
  • missing_function_level_access_control.server_side_request_forgery_ssrf.external moved via category change to broken_access_control.server_side_request_forgery_ssrf.external
  • missing_function_level_access_control.username_enumeration moved via category change to broken_access_control.username_enumeration
  • missing_function_level_access_control.username_enumeration.data_leak moved via category change to broken_access_control.username_enumeration.data_leak
  • missing_function_level_access_control.exposed_sensitive_android_intent moved via category change to broken_access_control.exposed_sensitive_android_intent
  • missing_function_level_access_control.exposed_sensitive_ios_url_scheme moved via category change to broken_access_control.exposed_sensitive_ios_url_scheme
  • cross_site_request_forgery_csrf.application_wide name changed from Applicaton-Wide to Application-Wide

v1.2.0 - 2017-08-04

Added

  • sensitive_data_exposure.visible_detailed_error_page.descriptive_stack_trace
  • sensitive_data_exposure.visible_detailed_error_page.detailed_server_configuration
  • unvalidated_redirects_and_forwards.open_redirect.get_based
  • sensitive_data_exposure.internal_ip_disclosure
  • sensitive_data_exposure.visible_detailed_error_page.full_path_disclosure
  • server_security_misconfiguration.cookie_scoped_to_parent_domain
  • client_side_injection.binary_planting
  • client_side_injection.binary_planting.privilege_escalation
  • client_side_injection.binary_planting.no_privilege_escalation
  • sensitive_data_exposure.token_leakage_via_referer.trusted_3rd_party
  • sensitive_data_exposure.token_leakage_via_referer.untrusted_3rd_party
  • server_security_misconfiguration.fingerprinting_banner_disclosure
  • server_security_misconfiguration.lack_of_password_confirmation.manage_two_fa
  • sensitive_data_exposure.json_hijacking
  • cross_site_request_forgery_csrf.action_specific.logout
  • broken_authentication_and_session_management.privilege_escalation
  • insecure_data_transport.executable_download
  • insecure_data_transport.executable_download.no_secure_integrity_check
  • insecure_data_transport.executable_download.secure_integrity_check
  • server_security_misconfiguration.rfd
  • sensitive_data_exposure.xssi
  • server_security_misconfiguration.misconfigured_dns.zone_transfer
  • insufficient_security_configurability.no_password_policy (changelog text corrected in v1.4.0 #100)
  • insecure_data_storage.server_side_credentials_storage
  • insecure_data_storage.server_side_credentials_storage.plaintext

Removed

  • unvalidated_redirects_and_forwards.open_redirect.get_based_all_users
  • unvalidated_redirects_and_forwards.open_redirect.get_based_authenticated
  • unvalidated_redirects_and_forwards.open_redirect.get_based_unauthenticated
  • sensitive_data_exposure.token_leakage_via_referer.over_https
  • sensitive_data_exposure.mixed_content.sensitive_data_disclosure
  • sensitive_data_exposure.mixed_content.requires_being_a_man_in_the_middle
  • broken_authentication_and_session_management.session_token_in_url
  • broken_authentication_and_session_management.session_token_in_url.over_http
  • broken_authentication_and_session_management.session_token_in_url.over_https
  • broken_authentication_and_session_management.authentication_bypass.vertical
  • broken_authentication_and_session_management.authentication_bypass.horizontal
  • insecure_data_storage.credentials_stored_unencrypted
  • insecure_data_storage.credentials_stored_unencrypted.on_external_storage
  • insecure_data_storage.credentials_stored_unencrypted.on_internal_storage
  • insecure_data_storage.insecure_data_storage
  • insecure_data_storage.insecure_data_storage.password
  • insufficient_security_configurability.weak_password_policy.complexity_both_length_and_char_type_not_enforced
  • insufficient_security_configurability.weak_password_policy.complexity_length_not_enforced
  • insufficient_security_configurability.weak_password_policy.complexity_char_type_not_enforced
  • insufficient_security_configurability.weak_password_policy.allows_reuse_of_old_passwords
  • insufficient_security_configurability.weak_password_policy.allows_password_to_be_same_as_email_username

Changed

  • sensitive_data_exposure.visible_detailed_error_page name changed from 'Visible Detailed Error Page' to 'Visible Detailed Error/Debug Page'
  • server_security_misconfiguration.mail_server_misconfiguration.missing_dmarc name changed from 'Missing DMARC' to 'Missing DKIM/DMARC'
  • insecure_data_transport.ssl_certificate_pinning moved via category change to mobile_security_misconfiguration.ssl_certificate_pinning
  • insecure_data_transport.ssl_certificate_pinning.absent moved via category change to mobile_security_misconfiguration.ssl_certificate_pinning.absent
  • insecure_data_transport.ssl_certificate_pinning.defeatable moved via category change to mobile_security_misconfiguration.ssl_certificate_pinning.defeatable
  • sensitive_data_exposure.mixed_content name changed from 'Mixed Content' to 'Mixed Content (HTTPS Sourcing HTTP)'
  • sensitive_data_exposure.mixed_content priority changed from null to P5 (due to children removal)
  • broken_authentication_and_session_management.authentication_bypass priority changed from null to P1 (due to children removal)
  • insufficient_security_configurability.weak_password_policy priority changed from null to P5 (due to children removal)

v1.1.0 - 2017-04-13

Added

  • directory_listing_enabled
  • directory_listing_enabled.sensitive_data_exposure
  • directory_listing_enabled.non_sensitive_data_exposure
  • server_security_misconfiguration.path_traversal
  • cross_site_scripting_xss.reflected.self
  • cross_site_scripting_xss.reflected.non_self
  • cross_site_request_forgery_csrf.application_wide
  • cross_site_request_forgery_csrf.application_specific
  • cross_site_request_forgery_csrf.authenticated_action
  • cross_site_request_forgery_csrf.unauthenticated_action

Removed

  • poor_physical_security
  • social_engineering

Changed

  • cross_site_scripting_xss.cookie_based priority changed from P4 to P5

[1.0.0] - 2017-03-06