Microsoft IIS 4.0 metabase can reveal plaintext passwords. Microsoft has been informed, but no patch has been released.