WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

101 Typical Security Pitfalls

Alexander Pirker

Are you trusting your frontend to protect your backend? Uncover five typical security pitfalls—from XSS bypasses to low-level memory leaks—that leave your software open to devastating attacks.

Pause
Mute Enter Fullscreen
#1 about 2 min

Assessing the real state of application security

System vulnerabilities often remain hidden until an attacker finds a way to bypass outer defenses.

#2 about 2 min

Contextual factors determining software security requirements

Security needs vary drastically based on application type, deployment environment, data sensitivity, and performance constraints.

#3 about 2 min

Real-world impact of remote code execution vulnerabilities

Severe flaws like log4shell and spring4shell demonstrate why robust application security must be integrated initially.

#4 about 1 min

Overview of five common software security pitfalls

A structured examination of critical vulnerabilities spanning from frontend bypasses to out-of-bounds memory reading.

#5 about 4 min

Preventing cross-site scripting through backend data sanitization

Relying solely on frontend HTML sanitizers leaves systems exposed to malicious payloads sent directly via curl.

#6 about 4 min

Avoiding remote code execution from unsanitized inputs

Failing to validate command line parameters enables attackers to inject secondary commands and open reverse shells.

#7 about 5 min

Mitigating denial of service attacks from application crashes

Checking cryptographic key lengths prevents unexpected language panics from permanently crashing crucial microservices.

#8 about 5 min

Fixing broken cryptography caused by integer downcasting

Passing oversized index values into smaller integer types causes modular arithmetic overlap and severe data leakage.

#9 about 5 min

Preventing information leakage from out-of-bounds memory reads

Validating array index requests ensures memory-copy operations cannot extract adjacent sensitive data from the stack.

#10 about 3 min

Core principles for input validation and memory safety

Strict input sanitization, careful data type casting, and proactive memory management form the foundation of secure software.

#11 about 2 min

Selecting robust tools for backend HTML sanitization

Implementing tools like dompurify on the backend effectively neutralizes prevalent cross-site scripting threats before database storage.

Matching moments

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

13:13 min

Answering audience questions on practical application security

Thomas Konrad · World Congress 2021

2:13 min

Understanding software vulnerabilities and prominent exploits

Mohammad-Ali A'râbi Mohammad-Ali A'râbi · World Congress 2026 Europe

2:55 min

Identifying common and emerging application injection attack vectors

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

7:16 min

Addressing developer adoption and future software security risks

Anna Fritsch-Weninger · LIVE

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · World Congress 2023

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
about 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
over 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
over 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
over 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
over 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
over 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

How We Cut Our API's p99 Latency from Minutes to Under a Second

  • Deepak Agrawal

    Atlassian

    Principal Software Engineer

Open session

What I Got Wrong Shipping an MCP Server for Live Infrastructure

  • Pritesh Kiri

    Harness

    Developer Relations Engineer

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

Autopsy of an Autonomous Incident: When the Agent Made It Worse

  • Navin Pai

    StackGen

    Director of Engineering

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • over 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 7 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
World Congress 2026 Europe • 3 months ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Security Pitfalls for Software Engineers thumbnail
27:32
World Congress 2023 • about 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Programming secure C#/.NET Applications: Dos & Don'ts thumbnail
33:29
World Congress 2024 • about 2 years ago

Programming secure C#/.NET Applications: Dos & Don'ts

Sebastian Leuer

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.