Application Security Reference Database
A structured engineering reference for the standards application security findings get measured against — OWASP, CWE, MITRE ATT&CK, CVSS, EPSS, and CISA KEV. Each entry explains a concept in plain terms rather than restating the standard’s own text; the official source is linked from every entry.
Find a Concept
21 of 21 entries
M1M1: Improper Credential Usage
Hardcoded secrets, API keys, and tokens embedded directly in an application binary or source, rather than provisioned at runtime.
M2M2: Inadequate Supply Chain Security
Third-party dependencies and SDKs with known vulnerabilities, malicious packages, or outdated components pulled directly into the app.
M5M5: Insecure Communication
Cleartext traffic, weak TLS configuration, or disabled certificate pinning that exposes data while it moves between the app and its backend.
M9M9: Insecure Data Storage
Sensitive data persisted in plaintext — SharedPreferences, SQLite, external storage, or an unprotected Keychain entry.
V2ASVS V2: Authentication
Requirements for how an application verifies identity — credential handling, multi-factor authentication, and session initiation.
V9ASVS V9: Communications
Requirements for protecting data in transit — TLS version, certificate validation, and cleartext traffic prevention.
V14ASVS V14: Configuration
Requirements covering build and deployment configuration — debug flags, exported components, and backup exposure.
CWE-798CWE-798: Use of Hard-coded Credentials
A weakness where software contains a hardcoded credential (password, key, or token) used for authentication or encryption.
CWE-1104CWE-1104: Use of Unmaintained Third-Party Components
A weakness from depending on a third-party component that is no longer actively maintained or supported.
CWE-319CWE-319: Cleartext Transmission of Sensitive Information
A weakness where sensitive data is transmitted in a way that allows it to be read by an unauthorized actor in transit.
CWE-922CWE-922: Insecure Storage of Sensitive Information
A weakness where sensitive data is stored without sufficient protection against unauthorized access.
T1404T1404: Exploit OS Vulnerability
An adversary technique where an unpatched operating-system vulnerability is used to escalate privileges beyond what the app or attacker should have.
T1476T1476: Deliver Malicious App via Other Means
An adversary technique for distributing a malicious or trojanized application outside of an authorized app store.
T1437T1437: Standard Application Layer Protocol
An adversary technique using standard, blend-in network protocols for command-and-control or data exfiltration once a device is compromised.
CVSS Base Score: Exploitability Metrics
The four CVSS v3.1 Base metrics — Attack Vector, Attack Complexity, Privileges Required, User Interaction — that describe how a vulnerability is reached.
CVSS Base Score: Impact Metrics
The three CVSS v3.1 Base impact metrics — Confidentiality, Integrity, Availability — that describe what happens if a vulnerability is successfully exploited.
CVSS Vector Strings, Explained
How to read a compact CVSS v3.1 vector string like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What EPSS Actually Measures
A 0–1 probability estimating the likelihood a specific CVE will be exploited in the wild within the next 30 days.
EPSS vs. CVSS: Complementary, Not Competing
Why exploitation likelihood (EPSS) and severity (CVSS) answer different questions, and prioritization needs both.
What the CISA KEV Catalog Is
A CISA-maintained catalog of CVEs with confirmed evidence of active, in-the-wild exploitation — not a predictive or theoretical list.
BOD 22-01 and the Federal Remediation Mandate
The CISA Binding Operational Directive that requires federal civilian agencies to remediate KEV-listed vulnerabilities by an assigned due date.
Collections
OWASP Mobile Top 10
The ten most critical mobile application security risks, published by OWASP and refreshed for 2024. Strata maps every applicable finding to one of these ten categories on every Android and iOS scan.
OWASP ASVS Controls
The Application Security Verification Standard defines testable security requirements across 14 chapters and three verification levels. Referenced here at chapter level — exact control IDs shift between ASVS point releases, so verify individual control text against the linked source before citing it in an audit.
CWE Reference
The Common Weakness Enumeration is a community-maintained taxonomy of software weakness types. Every Strata finding maps to a CWE ID where one applies, giving it a stable identifier independent of any single framework's category numbering.
MITRE ATT&CK Reference
Application-security-relevant techniques from the MITRE ATT&CK for Mobile matrix — the attacker behavior a given weakness enables, mapped back to the OWASP Mobile Top 10 category that would prevent it. Scoped to Mobile matrix techniques Strata's own coverage already cites, not a general ATT&CK Enterprise reference.
CVSS Reference
The Common Vulnerability Scoring System, maintained by FIRST, produces a 0–10 severity score from a fixed set of exploitability and impact metrics. Strata calculates a CVSS v3.1 Base Score automatically for every applicable finding.
EPSS Reference
The Exploit Prediction Scoring System estimates the probability that a specific vulnerability will be exploited in the wild in the next 30 days. Unlike CVSS, an EPSS score changes over time as real-world exploitation data accumulates.
CISA Known Exploited Vulnerabilities
CISA's catalog of vulnerabilities with confirmed evidence of active, in-the-wild exploitation. This is an educational overview of how the catalog works and what listing on it means — not a live mirror of catalog entries, which change continuously and are out of scope for a static reference page.