WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

101 Typical Security Pitfalls

Alexander Pirker

Are you trusting your frontend to protect your backend? Uncover five typical security pitfalls—from XSS bypasses to low-level memory leaks—that leave your software open to devastating attacks.

Pause
Mute Enter Fullscreen
#1 about 2 min

Assessing the real state of application security

System vulnerabilities often remain hidden until an attacker finds a way to bypass outer defenses.

#2 about 2 min

Contextual factors determining software security requirements

Security needs vary drastically based on application type, deployment environment, data sensitivity, and performance constraints.

#3 about 2 min

Real-world impact of remote code execution vulnerabilities

Severe flaws like log4shell and spring4shell demonstrate why robust application security must be integrated initially.

#4 about 1 min

Overview of five common software security pitfalls

A structured examination of critical vulnerabilities spanning from frontend bypasses to out-of-bounds memory reading.

#5 about 4 min

Preventing cross-site scripting through backend data sanitization

Relying solely on frontend HTML sanitizers leaves systems exposed to malicious payloads sent directly via curl.

#6 about 4 min

Avoiding remote code execution from unsanitized inputs

Failing to validate command line parameters enables attackers to inject secondary commands and open reverse shells.

#7 about 5 min

Mitigating denial of service attacks from application crashes

Checking cryptographic key lengths prevents unexpected language panics from permanently crashing crucial microservices.

#8 about 5 min

Fixing broken cryptography caused by integer downcasting

Passing oversized index values into smaller integer types causes modular arithmetic overlap and severe data leakage.

#9 about 5 min

Preventing information leakage from out-of-bounds memory reads

Validating array index requests ensures memory-copy operations cannot extract adjacent sensitive data from the stack.

#10 about 3 min

Core principles for input validation and memory safety

Strict input sanitization, careful data type casting, and proactive memory management form the foundation of secure software.

#11 about 2 min

Selecting robust tools for backend HTML sanitization

Implementing tools like dompurify on the backend effectively neutralizes prevalent cross-site scripting threats before database storage.

Matching moments

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

13:13 min

Answering audience questions on practical application security

Thomas Konrad · WWC 2021

2:13 min

Understanding software vulnerabilities and prominent exploits

Mohammad-Ali A'râbi Mohammad-Ali A'râbi · WWC Europe 2026

2:55 min

Identifying common and emerging application injection attack vectors

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

7:16 min

Addressing developer adoption and future software security risks

Anna Fritsch-Weninger · LIVE

5:30 min

Identifying non-coding software vulnerabilities and organizational risks

Tino Sokic · WWC 2023

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
almost 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
about 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
about 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
about 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
about 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
about 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Practical Threat Modeling for Software Developers

Mudassir Syed

Lead Security Software Engineer

Mudassir Syed
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

The Things Your AI Isn't Telling You

Desmond Lamptey

Lead Software Engineer @ Capital One

Desmond Lamptey
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali

Related videos

Software Security 101: Secure Coding Basics thumbnail
1:58:48
WWC 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski thumbnail
38:44
Coffee With Developers • 5 months ago

How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Bozidar Spirovski, Wekoslav Stefanovski

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
WWC Europe 2026 • about 1 month ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

Security Pitfalls for Software Engineers thumbnail
27:32
WWC 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

Programming secure C#/.NET Applications: Dos & Don'ts thumbnail
33:29
WWC 2024 • almost 2 years ago

Programming secure C#/.NET Applications: Dos & Don'ts

Sebastian Leuer

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.