In IIS, an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).

Buffer overflow in FTP server in Microsoft IIS 3.0 and 4.0 allows local and sometimes remote attackers to cause a denial of service via a long NLST (ls) command.

When IIS 2 or 3 is upgraded to IIS 4, ism.dll is inadvertently left in /scripts/iisadmin, which does not restrict access to the local machine and allows an unauthorized user to gain access to sensitive server information, including the Administrator's password.

Buffer overflow in fpcount.exe in IIS 4.0 with FrontPage Server Extensions allows remote attackers to execute arbitrary commands.

IIS 4.0 and Apache log HTTP request methods, regardless of how long they are, allowing a remote attacker to hide the URL they really request.

Information from SSL-encrypted sessions via PKCS #1.

In IIS, remote attackers can obtain source code for ASP files by appending "::$DATA" to the URL.

Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names.

IIS newdsn.exe CGI script allows remote users to overwrite files.

Denial of service in IIS using long URLs.