Unvalidated Data Buffer Overflows Integer Arithmetic Vulnerabilities Unvalidated Data: Crossing Trust Boundaries Defending Trust Boundaries Whitelisting vs Blacklisting A1: Injection Injection Flaws SQL Injection Attacks Evolve Drill Down on Stored Procedures Other Forms of Injection Minimizing Injection Flaws A2: Broken Authentication Quality and Protection of Authentication Data Handling Passwords on Server Side SessionID Risk Reduction HttpOnly and Security Headers A3: Sensitive Data Exposure Protecting Data Can Mitigate Impact In-Memory Data Handling Secure Pipes Failures in TLS/SSL Framework A4: XML External Entities (XXE) XML Parser Coercion XML Attacks: Structure XML Attacks: Injection Safe XML Processing A5: Broken Access Control Access Control Issues Excessive Privileges Insufficient Flow Control Unprotected URL/Resource Access Examples of Shabby Access Control Sessions and Session Management Lab: Spotlight: Verizon