4 ms·
> What is "most critical security risks" if not "order of severity"? Is "most critical" not a judgement of severity? It might just be an unordered list of the
by sodality2 4y ago
> What is "most critical security risks" if not "order of severity"? Is "most critical" not a judgement of severity?
It might just be an unordered list of the most critical security risks. "Top ten" isn't necessarily in order.
- swyx 4y agoexcept it is. OWASP’s page mentions that Injection vulns got bumped down a notch from #2 to #3 this year
- sodality2 4y agoThis is the last time I comment without RTFA :P
- tptacek 4y agoThis is based on a survey and on data vendors send to them from scans and things like that. It very obviously isn't ranked by severity (just look at it, right). My recommendation is (1) never to take the "top 10" seriously at all, and (2) to just stop saying SQLI is the "third worst" vulnerability (it's hard to see how it could ever be third in any ranking). This is a total nit, though! It's a good article, and you don't need to change a thing.