Learn which end uses of biochar are eligible for carbon credits.

origination

carbon_partner_plus

internal

member

free

Biochar: Eligible End Uses for Carbon Credits Across Standards

ProjectSupplyChainStageDesc

ProjectTechnologyStageDesc

ProjectBiocharOfftakeStageeDesc

ProjectOffsetPurchaseStageDesc

ProjectCarbonPartnerStageDesc

Internal High Impact

Internal Scan and/or Medium Impact

External - Low impact

External - DNS Query Only

Server-Side Request Forgery (SSRF)

Unsafe Cross-Origin Resource Sharing

HTTP Request Smuggling

Path Traversal

Sensitive Data Exposure

Non-Sensitive Data Exposure

Directory Listing Enabled

Same-Site Scripting

SSL Attack (BREACH, POODLE etc.)

Using Default Credentials

Basic Subdomain Takeover

High Impact Subdomain Takeover

Zone Transfer

Missing Certification Authority Authorization (CAA) Record

Misconfigured DNS

No Spoofing Protection on Email Domain

Email Spoofing to Inbox due to Missing or Misconfigured DMARC on Email Domain

Email Spoofing to Spam Folder

Missing or Misconfigured SPF and/or DKIM

Email Spoofing on Non-Email Domain

Mail Server Misconfiguration

Excessively Privileged User / DBA

Database Management System (DBMS) Misconfiguration

Change Email Address

Change Password

Delete Account

Manage 2FA

Lack of Password Confirmation

Registration

Login

Email-Triggering

SMS-Triggering

No Rate Limiting on Form

No Antivirus

No Size Limit

File Extension Filter Bypass

Unsafe File Upload

Cookie Scoped to Parent Domain

Session Token

Non-Session Cookie

Missing Secure or HTTPOnly Cookie Flag

Sensitive Click-Based Action

Form Input

Non-Sensitive Action

Clickjacking

Account Takeover

Account Squatting

Missing/Broken State Parameter

Insecure Redirect URI

OAuth Misconfiguration

Implementation Vulnerability

Brute Force

Missing

CAPTCHA

To Internet

Exposed Admin Portal

Missing DNSSEC

Fingerprinting/Banner Disclosure

Username/Email Enumeration

OPTIONS

TRACE

Potentially Unsafe HTTP Method Enabled

Lack of Forward Secrecy

Insecure Cipher Suite

Certificate Error

Insecure SSL

Reflected File Download (RFD)

X-Frame-Options

Cache-Control for a Non-Sensitive Page

X-XSS-Protection

Strict-Transport-Security

X-Content-Type-Options

Content-Security-Policy

Public-Key-Pins

X-Content-Security-Policy

X-Webkit-CSP

Content-Security-Policy-Report-Only

Cache-Control for a Sensitive Page

Lack of Security Headers

Direct Server Access

Web Application Firewall (WAF) Bypass

Race Condition

Cache Poisoning

Bitsquatting

Server Security Misconfiguration

Local

File Inclusion

Social Media Sharing Buttons

Parameter Pollution

Remote Code Execution (RCE)

LDAP Injection

SQL Injection

XML External Entity Injection (XXE)

Response Splitting (CRLF)

HTTP Response Manipulation

iframe Injection

Impersonation via Broken Link Hijacking

External Authentication Injection

Flash Based External Authentication Injection

HTML Content Injection

Email HTML Injection

Email Hyperlink Injection Based on Email Provider

Text Injection

Homograph/IDN-Based

Right-to-Left Override (RTLO)

Content Spoofing

Basic

Custom

Server-Side Template Injection (SSTI)

Server-Side Injection

Authentication Bypass

Second Factor Authentication (2FA) Bypass

Privilege Escalation

Cleartext Transmission of Session Token

Not Operational or Intended Public Access

Other Plaintext Protocol with no Secure Alternative

Over HTTP

Weak Login Function

Remote Attack Vector

Local Attack Vector

Session Fixation

On Logout (Client and Server-Side)

On Permission Change

On Logout (Server-Side Only)

On Password Reset and/or Change

Concurrent Sessions On Logout

On Email Change

On 2FA Activation/Change

Long Timeout

Failure to Invalidate Session

Concurrent Logins

Weak Registration Implementation

Broken Authentication and Session Management

For Publicly Accessible Asset

PII Leakage/Exposure

For Internal Asset

Pay-Per-Use Abuse

Intentionally Public, Sample or Invalid

Data/Traffic Spam

Non-Corporate User

Disclosure of Secrets

Automatic User Enumeration

Manual User Enumeration

EXIF Geolocation Data Not Stripped From Uploaded Images

Detailed Server Configuration

Full Path Disclosure

Descriptive Stack Trace

Visible Detailed Error/Debug Page

Disclosure of Known Public Information

Trusted 3rd Party

Untrusted 3rd Party

Token Leakage via Referer

User Facing

In the Background

On Password Reset

Sensitive Token in URL

Non-Sensitive Token in URL

Password Reset Token Sent Over HTTP

Token Leakage via Host Header Poisoning

Weak Password Reset Implementation

Mixed Content (HTTPS Sourcing HTTP)

OAuth Secret

File Paths

Sensitive Data Hardcoded

Internal IP Disclosure

Cross Site Script Inclusion (XSSI)

JSON Hijacking

Sensitive Token

Non-Sensitive Token

Via localStorage/sessionStorage

Non-Privileged User to Anyone

Privileged User to Privilege Elevation

Privileged User to No Privilege Elevation

CSRF/URL-Based

Self

Stored

Non-Self

Reflected

Flash-Based

Cookie-Based

IE-Only

Referer

TRACE Method

Universal (UXSS)

Data URI

Off-Domain

Cross-Site Scripting (XSS)

Grain

Downloads