API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. C4:2018-Encode and Escape Data
2. A2:2017-Broken Authentication
3. API2:2023 - Broken Authentication
4. API10:2023 - Unsafe Consumption of APIs
5. A8:2013-Cross-Site Request Forgery (CSRF)
6. A8:2017-Insecure Deserialization
7. API4:2023 - Unrestricted Resource Consumption
8. A3:2013-Cross-Site Scripting (XSS)
9. A1:2013-Injection
10. A9:2017-Using Components with Known Vulnerabilities
11. C2:2018-Leverage Security Frameworks and Libraries
12. A6:2013-Sensitive Data Exposure
13. API9:2023 - Improper Inventory Management
14. API3:2023 - Broken Object Property Level Authorization
15. A7:2013-Missing Function Level Access Control
16. A3:2017-Sensitive Data Exposure
17. API5:2023 - Broken Function Level Authorization
18. A6:2017-Security Misconfiguration
19. A5:2013-Security Misconfiguration
20. A1:2017-Injection
21. C3:2018-Secure Database Access
22. A9:2013-Using Components with Known Vulnerabilities
23. API6:2023 - Unrestricted Access to Sensitive Business Flows
24. A7:2017-Cross-Site Scripting (XSS)
25. A10:2017-Insufficient Logging & Monitoring
26. API6:2023 - Unrestricted Access to Sensitive Business Flows
27. API8:2023 - Security Misconfiguration
28. A2:2013-Broken Authentication and Session Management
29. A4:2013-Insecure Direct Object References
30. A5:2017-Broken Access Control
31. C1:2018-Define Security Requirements
32. A4:2017-XML External Entities (XXE)
33. A10:2013-Unvalidated Redirects and Forwards
34. API1:2023 - Broken Object Level Authorization