Injection flaws are a broad category of vulnerabilities where an attacker can supply untrusted data to an application, which is then processed by an interpreter. Common examples include SQL injection (manipulating database queries), NoSQL injection (targeting NoSQL databases), OS command injection (executing operating system commands), and LDAP injection (manipulating LDAP queries). The root cause is typically insufficient input validation and sanitization, allowing malicious data to be interpreted as commands or queries.

Broken Authentication refers to vulnerabilities that allow attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users' identities, either temporarily or permanently. This can include weak password policies, predictable session IDs, improper session expiration, or insecure credential storage. Attackers might exploit these to gain administrative access or steal user data.

Sensitive Data Exposure happens when an application or system fails to protect sensitive data, such as credit card numbers, passwords, health records, or personally identifiable information (PII). This can occur due to weak encryption, lack of encryption altogether, or improper handling of data in transit or at rest. Attackers can exploit this to steal valuable information, leading to identity theft, financial fraud, and reputational damage.

XML External Entities (XXE) are a vulnerability that occurs when an application parses XML input that contains references to external entities. If the XML parser is configured to resolve external entities, an attacker can craft malicious XML to access internal files, perform denial-of-service attacks, or even execute remote requests (Server-Side Request Forgery - SSRF).

Broken Access Control means that restrictions on what authenticated users are allowed to do are not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as accessing other users' accounts, viewing sensitive files, modifying other users’ data, or changing access rights. This is often due to insecure direct object references (IDOR) or missing function-level access control.

Security Misconfiguration is a common vulnerability that arises from insecure default configurations, incomplete configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. It can also include not patching or upgrading systems promptly. Attackers can exploit these misconfigurations to gain unauthorized access or compromise the system.

Cross-Site Scripting (XSS) attacks occur when an application includes untrusted data in a new web page without proper validation or escaping. XSS allows attackers to execute scripts in the victim's browser which can hijack user sessions, deface the web site, or redirect the user to malicious sites. There are three main types: Stored XSS, Reflected XSS, and DOM-based XSS.

Insecure Deserialization occurs when an application deserializes untrusted data, allowing attackers to manipulate serialized objects. This can lead to remote code execution, privilege escalation, or denial-of-service attacks. The vulnerability arises when the deserialization process does not properly validate the data, allowing attackers to inject malicious payloads.

Using Components with Known Vulnerabilities means that the application relies on libraries, frameworks, or other software modules that contain publicly disclosed security flaws. Attackers can easily find and exploit these known vulnerabilities to compromise the application or system. This highlights the importance of regular patching and dependency management.

Insufficient Logging & Monitoring refers to the lack of comprehensive logging and effective monitoring of security events. This makes it difficult to detect attacks, investigate breaches, and respond to incidents in a timely manner. Attackers can exploit this to maintain persistence, escalate privileges, or exfiltrate data without being detected.