API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. API9:2023 - Improper Inventory Management
2. API1:2023 - Broken Object Level Authorization
3. API2:2023 - Broken Authentication
4. A6:2017-Security Misconfiguration
5. A1:2017-Injection
6. API4:2023 - Unrestricted Resource Consumption
7. API10:2023 - Unsafe Consumption of APIs
8. API8:2023 - Security Misconfiguration
9. C2:2018-Leverage Security Frameworks and Libraries
10. A3:2013-Cross-Site Scripting (XSS)
11. C4:2018-Encode and Escape Data
12. A8:2017-Insecure Deserialization
13. API3:2023 - Broken Object Property Level Authorization
14. A10:2017-Insufficient Logging & Monitoring
15. A4:2013-Insecure Direct Object References
16. A7:2013-Missing Function Level Access Control
17. API6:2023 - Unrestricted Access to Sensitive Business Flows
18. A6:2013-Sensitive Data Exposure
19. A2:2017-Broken Authentication
20. C3:2018-Secure Database Access
21. A9:2017-Using Components with Known Vulnerabilities
22. A4:2017-XML External Entities (XXE)
23. API5:2023 - Broken Function Level Authorization
24. A1:2013-Injection
25. A2:2013-Broken Authentication and Session Management
26. A5:2017-Broken Access Control
27. A3:2017-Sensitive Data Exposure
28. A9:2013-Using Components with Known Vulnerabilities
29. A5:2013-Security Misconfiguration
30. A7:2017-Cross-Site Scripting (XSS)
31. API6:2023 - Unrestricted Access to Sensitive Business Flows
32. A8:2013-Cross-Site Request Forgery (CSRF)
33. A10:2013-Unvalidated Redirects and Forwards
34. C1:2018-Define Security Requirements