SecurityInnovation/TMContentReview — Issue #64: Do Not Place Sensitive Data in Parameters
Author: SergeTruth
Created: 2011-11-07 22:28:15+00:00
State: open

You need to talk about padding oracle attacks. Also if id's are encrypted they can be reused for parameter tampering attacks on other pages.