We have had two sites report this now.
Add //z--><qss> to the url on a site and it throws a runtime error
Server Error in '/' Application.
Runtime Error
Description: An exception occurred while processing your request. Additionally, another exception occurred while executing the custom error page for the first exception. The request has been terminated.
(This is with CustomErrors On)

With CustomErrors off, it is
Server Error in '/' Application.
A potentially dangerous Request.Path value was detected from the client (>).
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (>).

Source Error:

This is causing PCI compliance to fail. I know it is a default IIS message, but scans are saying it discloses too much info. I had researched it the first time it came up and couldn't find where I could change the error message in IIS.
The only thing I could think of was to change the customerror pages to plain .html and see if that helps.
Any ideas? You will probably be seeing more sites report this.

Sites are Gold, but I tested it on an AC9 older than 9.10
Here is the first report I had seen of it, then it started happening on our sites:
https://www.ablecommerce...ling-PCI-Compliance-Test
What change in the web.config prevents this? I don't have a 9.10 site to test on.
I see three changes and if I remember correctly, I think you had to remove the nosniff? I don't think any of these changes would have fixed the issue?
<customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN"/>
<add name="Strict-Transport-Security" value="max-age=31536000;includeSubDomains;preload" />
<add name="X-Content-Type-Options" value="nosniff" />
</customHeaders>