Web Security & OWASP
What does XSS stand for?
Cross-Site Scripting
Which CWE involves trusting user input without validating its type, length, or format?
CWE-20: Improper Input Validation
Which algorithm is symmetric: AES or RSA?
AES
In the CIA Triad, which principle ensures information is only accessible to authorized users?
Confidentiality
What does CVE stand for?
Common Vulnerabilities and Exposures.
Which OWASP vulnerability allows attackers to modify or steal database data using malicious input?
SQL Injection
Which CWE involves writing past the end of a buffer?
CWE-787: Out-of-Bounds Write
In asymmetric encryption, what key does a sender use to ensure confidentiality when sending a message to a recipient?
The recipient’s public key
A weakness that can be exploited by a threat actor—such as an unpatched system or weak password—is known as what?
Vulnerability
A vulnerability with a CVSS score of 9.8 falls under what severity rating?
Critical
An attacker embeds harmful code into a website so future visitors get infected. What type of XSS is this?
Stored XSS
What CWE occurs when a program uses memory after freeing it?
CWE-416: Use-After-Free
A digital signature verifies integrity and authenticity. Which key is used to create the signature, and which key verifies it?
Created with private key, verified with public key
What term describes any event or actor that could cause harm by exploiting a vulnerability?
Threat
What does a CVSS score of 3.5 represent?
Low severity
Which OWASP category covers broken user role checks that allow privilege escalation?
Broken Access Control
What CWE occurs when sensitive credentials (e.g. passwords or API keys) are hardcoded in the source code?
CWE-798: Hardcoded Credentials
What cryptographic concept allows two parties to create a shared secret over an insecure channel?
Diffie–Hellman key exchange
If a system fails but its backup copy remains accessible and operational, which security property is preserved?
Availability
In a CVE record, what does the “CWE” field describe?
The underlying weakness that caused the vulnerability
What security feature prevents a website from making requests to a different domain unless allowed?
Same-Origin Policy
Accessing a file like ../../../etc/passwd is an example of what CWE?
CWE-22: Path Traversal
Which attack exploits hash collisions to create two different inputs with the same hash output?
A Collision Attack (related to the Birthday Attack)
What type of control is “mandatory annual cybersecurity training”?
Administrative control
A vulnerability where the attacker must be within the same network segment (like shared Wi-Fi) has which Attack Vector?
Adjacent Network (AV:A)