Question

During a security audit of a company's customer portal, a penetration tester discovers that the web application transmits session tokens over an unencrypted HTTP connection and stores passwords in the database in plaintext. The tester must categorize this finding accurately for the remediation report. Which vulnerability category best describes this finding?

Accepted Answer

Missing or improper use of encryption ciphers for data in transit and at rest

Answer

Buffer overflow caused by unbounded memory writes

Answer

Hardcoded credentials embedded in application source code

Answer

Path traversal allowing access to files outside the web root