The Heartbleed vulnerability affects all web servers that use OpenSSL versions 1.0.1-1.0.1f and permits an attacker to read up to 64k of server memory. This memory could contain:
HTTP requests made by other users to the server, which may include:
Session cookies
Usernames and passwords sent in form fields
User agent and other headers sent by the client
HTTP responses sent by the server to other users containing sensitive information
SSL encryption keys
Email messages (in case of SMTP, IMAP or POP3)
Other sensitive data stored in server memory.