SQL Injection
WCF named pipes
Limiting WCF service access to localhost