API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. C1:2018-Define Security Requirements
2. A7:2017-Cross-Site Scripting (XSS)
3. A10:2017-Insufficient Logging & Monitoring
4. A8:2017-Insecure Deserialization
5. API10:2023 - Unsafe Consumption of APIs
6. C2:2018-Leverage Security Frameworks and Libraries
7. A7:2013-Missing Function Level Access Control
8. A9:2013-Using Components with Known Vulnerabilities
9. A1:2017-Injection
10. API1:2023 - Broken Object Level Authorization
11. API5:2023 - Broken Function Level Authorization
12. A4:2013-Insecure Direct Object References
13. API8:2023 - Security Misconfiguration
14. A8:2013-Cross-Site Request Forgery (CSRF)
15. A2:2017-Broken Authentication
16. A1:2013-Injection
17. A6:2017-Security Misconfiguration
18. A3:2013-Cross-Site Scripting (XSS)
19. API3:2023 - Broken Object Property Level Authorization
20. A4:2017-XML External Entities (XXE)
21. A3:2017-Sensitive Data Exposure
22. API6:2023 - Unrestricted Access to Sensitive Business Flows
23. A2:2013-Broken Authentication and Session Management
24. API2:2023 - Broken Authentication
25. A9:2017-Using Components with Known Vulnerabilities
26. A5:2013-Security Misconfiguration
27. API4:2023 - Unrestricted Resource Consumption
28. C4:2018-Encode and Escape Data
29. A6:2013-Sensitive Data Exposure
30. A5:2017-Broken Access Control
31. A10:2013-Unvalidated Redirects and Forwards
32. C3:2018-Secure Database Access
33. API9:2023 - Improper Inventory Management
34. API6:2023 - Unrestricted Access to Sensitive Business Flows