Vulnerabilities > Tornadoweb > Tornado > 3.1.1

DATE CVE VULNERABILITY TITLE RISK
2023-05-25 CVE-2023-28370 Open Redirect vulnerability in Tornadoweb Tornado
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
network
low complexity
tornadoweb CWE-601
6.1
6.1
2020-01-24 CVE-2014-9720 Information Exposure Through Discrepancy vulnerability in Tornadoweb Tornado
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests. 		4.3
4.3