Top 10 software vulnerability list for 2019

In a perfect world, all software would be without flaws or weaknesses. Or at least the different types of software vulnerabilities would be definitively ranked in terms of frequency; ease, likelihood, and business and technical impact of exploitation; and tools and resources needed to detect and remediate. That way, developers would know exactly what to focus their resources on and when to consider the job done.

Why to target these types of software vulnerabilities

In the real world, there isn’t a definitive list of the top security vulnerabilities. Every application at every organization has its own set of unique security issues. But the high-risk and common weaknesses and flaws described by OWASP (including the OWASP Top 10 2017 and the OWASP Top 10 Mobile) and MITRE (CWE Top 25), among others, are a good start. These lists cover a range of software environments, including web apps and mobile apps, which account for the majority of enterprise applications. Types of vulnerabilities are chosen based on many criteria, such as how common the threats are, how easy they are to detect and remediate, and their potential technical and business impacts.

We can’t tell you which software flaws will pose the most threat to your business in 2019. And we can’t tell you which ones are most likely to cause the next data breach. Instead, we’ve chosen 10 common types of security vulnerabilities where you’ll see a high rate of return for your remediation efforts. These application risks are widespread among web apps and mobile apps and are easy to exploit. But many can be detected using automated tools such as static analysis, without the need for extensive manual code review. And with the right guidance, they can be cheap to remediate. In other words, these common software flaws and weaknesses are low-hanging fruit not only for attackers but also for developers—even those with limited application security resources.

In no particular order, here’s our top 10 software vulnerability list for 2019.

Buffer overflow

Buffer overflows are among the most well-known types of software vulnerabilities. When you try to put something that’s too big into memory that’s too small, of course unpredictable things happen. The most popular web app languages (e.g., Java) protect against this type of security vulnerability. But many mobile apps are written in C/C++, a language family that’s famously vulnerable to buffer overflow and incorrect buffer size calculation.

RELATED: How to detect, prevent, and mitigate buffer overflow attacks

Directory traversal

Also known as “path traversal,” this type of security vulnerability allows attackers to gain access to files and directories that aren’t part of your website. The attacker simply sends a file or directory request with the character sequence “../” (hence the alternative name “dot dot slash attack”), which points to the parent directory. This software flaw is especially treacherous when combined with others, such as the insecure storage of sensitive data. See path traversal.

Failure to protect sensitive data

Loss of connectivity threatens customers temporarily. But loss of sensitive data threatens customers for the rest of their lives—and can have severe consequences for your business. Admittedly, protecting data in transit is hard. But at least you can use strong encryption on all data at rest (i.e., stored data). See insecure data storage, insufficient cryptography, sensitive data exposure, missing encryption, and broken or risky cryptography.

Issues with libraries, components, and dependencies

No one writes code from complete scratch these days. All modern codebases contain some existing code, whether in the form of frameworks, self-contained modules, or snippets “borrowed” from other sources. But the convenience of code reuse comes with threats: New security vulnerabilities are discovered all the time. Malicious actors can take over trusted components. And if you don’t know what’s in your codebase, you can’t track it or fix it. See using components with known vulnerabilities.

RELATED: NPM dependencies, supply chain attacks, and Bitcoin wallets

Issues with web services and APIs

While the use of web services and APIs is exploding, API security hasn’t kept up with this growth. Threat actors can access sensitive data directly via unsecure services and APIs. But organizations must also be sure to implement web service and API calls securely in their own mobile apps. Otherwise, those applications become another interface by which an attacker can access their systems. See improper platform usage.

Issues with logging (too little / too much)

If you control access to your log files (e.g., the ones on your web server), thorough logging is a plus. It can help you detect an attack and determine its scope and potential damage after the fact. But sometimes you don’t control access to the log files (e.g., the ones on your users’ devices). In that case, the “more is more” paradigm doesn’t necessarily apply. All the information that helps you trace security vulnerabilities can help an attacker do it too—especially if it’s unencrypted. See insufficient logging and extraneous functionality.

Cross-site scripting

Cross-site scripting refers to a family of software weaknesses that allow attackers execute their own code in the browsers of your website visitors. XSS attacks can also occur in your mobile apps if they display webpages, such as FAQs and Help pages. It’s the second most prevalent issue on the OWASP Top 10 2017, and an earlier version of the CWE/SANS Top 25 said it’s “one of the most prevalent, obstinate, and dangerous vulnerabilities in web applications.”

RELATED: Remediating XSS: Does a single fix work?

Missing or broken authentication

Authentication refers to ensuring that users are—and continue to be—who they say they are. Initial authentication usually takes place at log-in. Continued authentication occurs through session management. Some types of authentication software flaws take more effort to detect than others (e.g., weak password requirements vs. session timeouts). See missing authentication, excessive authentication attempts, broken authentication, and insecure authentication.

Missing or broken authorization (access control)

Authorization refers to creating policies for users, their roles, and the actions they may perform. And access control is how a system ensures that users cannot perform unauthorized actions. As with authentication issues, some access control software flaws are easier to find than others (e.g., missing authorization vs. poorly defined access lists). See broken access control, insecure authorization, missing authorization, and incorrect authorization.