Unvalidated Data Buffer Overflows Integer Arithmetic Vulnerabilities Unvalidated Data: Crossing Trust Boundaries Defending Trust Boundaries Whitelisting vs Blacklisting Lab: Defending Trust Boundaries A1: Injection Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Injection Minimizing Injection Flaws Lab: Defending Against SQL Injection A2: Broken Authentication Quality and Protection of Authentication Data Handling Passwords on Server Side SessionID Risk Reduction HttpOnly and Security Headers Lab: Defending Authentication A3: Sensitive Data Exposure Protecting Data Can Mitigate Impact In-Memory Data Handling Secure Pipes Failures in TLS/SSL Framework Lab: Defending Sensitive Data A4: XML External Entities (XXE) XML Parser Coercion XML Attacks: Structure XML Attacks: Injection