Open Web Application Security Project (OWASP) has released the first draft of the 2007 edition of the Ten Most Critical Web Application Security Vulnerabilities. Over the years, this document has turned into a de facto web application vulnerability checklist. Briefly, this is the 2007 Ten Most Critical Web Application Security Vulnerabilities: A1 – Cross Site Scripting (XSS) A2 – Injection Flaws A3 – Malicious File Execution A4 – Insecure Direct Object Reference A5 – Cross Site Request Forgery (CSRF) A6 – Information Leakage and Improper Error Handling A7 – Broken Authentication and Session Management A8 – Insecure Cryptographic Storage A9 – Insecure Communications A10 – Failure to Restrict URL Access You can download it here