The Web Application Security Consortium / Threat Classification
WASC finished the second version of their web application threat classification document, which contains a nice categorization of vulnerabilities to web-based applications.
The Web Application Security Consortium / Threat Classification
They provide examples and methods of identifying possible vulnerabilities, as well as methods of mitigating various attacks.