API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. C3:2018-Secure Database Access
2. A3:2013-Cross-Site Scripting (XSS)
3. A5:2013-Security Misconfiguration
4. A1:2013-Injection
5. A6:2013-Sensitive Data Exposure
6. API10:2023 - Unsafe Consumption of APIs
7. API5:2023 - Broken Function Level Authorization
8. C2:2018-Leverage Security Frameworks and Libraries
9. A6:2017-Security Misconfiguration
10. A9:2013-Using Components with Known Vulnerabilities
11. A3:2017-Sensitive Data Exposure
12. API6:2023 - Unrestricted Access to Sensitive Business Flows
13. A8:2013-Cross-Site Request Forgery (CSRF)
14. A8:2017-Insecure Deserialization
15. API9:2023 - Improper Inventory Management
16. API8:2023 - Security Misconfiguration
17. API3:2023 - Broken Object Property Level Authorization
18. A2:2013-Broken Authentication and Session Management
19. A7:2017-Cross-Site Scripting (XSS)
20. A1:2017-Injection
21. A4:2013-Insecure Direct Object References
22. A7:2013-Missing Function Level Access Control
23. A4:2017-XML External Entities (XXE)
24. API6:2023 - Unrestricted Access to Sensitive Business Flows
25. API4:2023 - Unrestricted Resource Consumption
26. C1:2018-Define Security Requirements
27. C4:2018-Encode and Escape Data
28. A2:2017-Broken Authentication
29. A10:2013-Unvalidated Redirects and Forwards
30. A9:2017-Using Components with Known Vulnerabilities
31. A10:2017-Insufficient Logging & Monitoring
32. API1:2023 - Broken Object Level Authorization
33. A5:2017-Broken Access Control
34. API2:2023 - Broken Authentication