4 ms·
To quote from the page https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/ > It represents a broad consensus about the most critical
by TheDong 4y ago
To quote from the page https://owasp.org/www-project-top-ten/ https://owasp.org/www-project-top-ten/
> It represents a broad consensus about the most critical security risks to web applications.
What is "most critical security risks" if not "order of severity"? Is "most critical" not a judgement of severity?
Anyway, the original author used the phrasing of just "3rd worst", and "worst" is such a vague word that it could mean anything from "most individual impact" to "prevalence".
Whatever pedantic point you're trying to make, I do not get it, and I think the author's phrasing was perfectly fine. OWASP's top 10 is ordered with more bad things higher up, by some definition of bad. The author's phrasing is only acknowledging that more bad things are higher up, and not really commenting on what "more bad" actually means, deferring to OWASP. Seems like perfectly fine phrasing.
- sodality2 4y ago> What is "most critical security risks" if not "order of severity"? Is "most critical" not a judgement of severity? It might just be an unordered list of the most critical security risks. "Top ten" isn't necessarily in order.
- swyx 4y agoexcept it is. OWASP’s page mentions that Injection vulns got bumped down a notch from #2 to #3 this year
- sodality2 4y agoThis is the last time I comment without RTFA :P
- tptacek 4y agoThis is based on a survey and on data vendors send to them from scans and things like that. It very obviously isn't ranked by severity (just look at it, right). My recommendation is (1) never to take the "top 10" seriously at all, and (2) to just stop saying SQLI is the "third worst" vulnerability (it's hard to see how it could ever be third in any ranking). This is a total nit, though! It's a good article, and you don't need to change a thing.