API OWASP Bingo - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.

1. C2:2018-Leverage Security Frameworks and Libraries
2. C4:2018-Encode and Escape Data
3. API5:2023 - Broken Function Level Authorization
4. C1:2018-Define Security Requirements
5. A1:2017-Injection
6. API8:2023 - Security Misconfiguration
7. A8:2017-Insecure Deserialization
8. API9:2023 - Improper Inventory Management
9. C3:2018-Secure Database Access
10. API3:2023 - Broken Object Property Level Authorization
11. A7:2013-Missing Function Level Access Control
12. A6:2013-Sensitive Data Exposure
13. API1:2023 - Broken Object Level Authorization
14. A1:2013-Injection
15. API4:2023 - Unrestricted Resource Consumption
16. A10:2017-Insufficient Logging & Monitoring
17. API6:2023 - Unrestricted Access to Sensitive Business Flows
18. A2:2013-Broken Authentication and Session Management
19. A2:2017-Broken Authentication
20. API10:2023 - Unsafe Consumption of APIs
21. A9:2017-Using Components with Known Vulnerabilities
22. A4:2013-Insecure Direct Object References
23. A9:2013-Using Components with Known Vulnerabilities
24. A7:2017-Cross-Site Scripting (XSS)
25. A5:2017-Broken Access Control
26. A8:2013-Cross-Site Request Forgery (CSRF)
27. API2:2023 - Broken Authentication
28. A3:2017-Sensitive Data Exposure
29. A10:2013-Unvalidated Redirects and Forwards
30. A3:2013-Cross-Site Scripting (XSS)
31. API6:2023 - Unrestricted Access to Sensitive Business Flows
32. A4:2017-XML External Entities (XXE)
33. A6:2017-Security Misconfiguration
34. A5:2013-Security Misconfiguration