Don't forget about the Open Web Application Security Project has another great source:

http://www.owasp.org/