Claim: Application security can be vulnerable to threats categorized as either Injection or Broken authentication.
Evidence: Broken authentication Injection Sensitive data exposure XML external entities Broken access control Security misconfiguration Cross-site scripting (XSS) Insecure deserialization Using components with known vulnerabilities Insufficient logging & monitoring