Sample JAVA application

[Chris Vanden Berghe <Chris () VandenBerghe org>]

Hi all,

I'm working on practical security of Web Applications and Web Services,
especially on applications written in Java.

You find a lot of information about the typical WA vulnerabilities (SQL
inj, XSS, session handling errors, ...).  Information that is more
difficult to find is on which vulnerabilities are more likely in
applications written in certain programming languages (or developed
using a particular framework, concepts or tools).

For my work it would be interesting to have an idea about which
vulnerabilities are often encountered in WA or WS written in Java (using
JSP, Servlets and EJB's).

Is there anybody on this list who has seen some results of penetration
tests or audits of Java WA/WS?  What are the most common vulnerabilities
discovered?

Kind regards and thank you in advance,
Chris.