Microsoft IIS unauthorized files access

It's possible to bypass authentication with null.htw template...

CVE-2000-0302: Undefined Security Weakness

Microsoft Index Server allows remote attackers to view the source code of ASP files by appending a %20 to the filename in the CiWebHitsFile argument to the null.htw URL...