I'm not really familiar with the field, is it really trivial to compromise both the database and the application server? And is it really that trivial to gain d

I'm not really familiar with the field, is it really trivial to compromise both the database and the application server? And is it really that trivial to gain data out of memory? Is there a good resource that reviews attacks that actually occurred and analyzes what and how it could have been prevented?