These documents have several useful tips for securing your IIS 4 or IIS 5 installation. You can also find IIS related fixes published by Microsoft here . There are several security issues related to Allaire's ColdFusion web development product. Please visit Allaire's security zone for more information. Allaire also has a Security Bulletin service.
Security exploits are common in example code.
Here is a document that describes a number of IIS exploits.