They found 2 issues (according to them), as I am not an expert on security, I am not sure if they are really problems or not, and if they can be fixed or not. 1. As an anonnymous user: I can go to _vti_bin/DWS.asmx, and see the contract of the services...