Do different web servers suffer from the same types of attacks?

Question

I'm creating a web applications with Yaws. In the past I've worked with tomcat and IIS. Do web servers typically suffer from the same types of vulnerabilities? Do good web security practices generally apply across the board or are most vulnerabilities inherent to the web application themselves?

Answer 1

No, yes, some are -- some are not.

Answer 2

Some vulnerabilities are specific to the web server some are not.

For example a Denial Of Service Attack, would cause a similar problem for any web server.

But that IIS 4 (NT 4) ran the IIS process under the system account allowing an attacker that gained access to the web server to take control of the machine, was a weakness specific to IIS 4.

Answer 3

Others like Cross-Site Scripting and SQL injection are pretty much caused/fixed by the application.