OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by the algorithm.

The product does not encrypt sensitive or critical information before storage or transmission.

The product uses a broken or risky cryptographic algorithm or protocol.

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably...

Weaknesses in this category are related to errors in the management of cryptographic keys.

CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top Ten is ...