Lucene search
+L

1133 matches found

OSV
OSV
added 2024/06/06 9:41 p.m.19 views

GHSA-753J-MPMX-QQ6G Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

Summary When Tornado receives a request with two Transfer-Encoding: chunked headers, it ignores them both. This enables request smuggling when Tornado is deployed behind a proxy server that emits such requests. Pound does this. PoC 0. Install Tornado. 1. Start a simple Tornado server that echoes...

5.3CVSS5.9AI score
SaveExploits0References3
Chainguard
Chainguard
added 2024/06/06 9:41 p.m.14 views

GHSA-753J-MPMX-QQ6G vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines-visualization-server, dask-gateway, py3-tornado, airflow...

5.9AI score
SaveExploits0
Github Security Blog
Github Security Blog
added 2024/06/06 9:41 p.m.50 views

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

Summary When Tornado receives a request with two Transfer-Encoding: chunked headers, it ignores them both. This enables request smuggling when Tornado is deployed behind a proxy server that emits such requests. Pound does this. PoC 0. Install Tornado. 1. Start a simple Tornado server that echoes...

7AI score
SaveExploits0References3Affected Software1
Tenable Nessus
Tenable Nessus
added 2024/06/03 12:00 a.m.16 views

RHEL 7 : python-tornado (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-tornado: XSRF cookie allows side-channel attack against TLS BREACH CVE-2014-9720 Note that Nessus has not...

6.5CVSS7.3AI score0.0251EPSS
SaveExploits0References1
The Hacker News
The Hacker News
added 2024/05/15 8:28 a.m.24 views

Dutch Court Sentences Tornado Cash Co-Founder to 5 Years in Prison for Money Laundering

A Dutch court on Tuesday sentenced one of the co-founders of the now-sanctioned Tornado Cash cryptocurrency mixer service to 5 years and 4 months in prison. While the name of the defendant was redacted in the verdict, it's known that Alexey Pertsev, a 31-year-old Russian national, had been awaiti...

7.1AI score
SaveExploits0
Wired Threat Level
Wired Threat Level
added 2024/05/13 2:12 p.m.20 views

The $2.3 Billion Tornado Cash Case Is a Pivotal Moment for Crypto Privacy

Tuesday’s verdict in the trial of Alexey Pertsev, a creator of crypto-privacy service Tornado Cash, is the first in a string of cases that could make it much harder to skirt financial surveillance...

7.2AI score
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2024/05/11 12:00 a.m.17 views

RHEL 7 : python-tornado (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations CVE-2023-28370 Note...

8AI score0.01142EPSS
SaveExploits0References1
OpenVAS
OpenVAS
added 2024/03/04 12:00 a.m.27 views

openSUSE: Security Advisory for SUSE Manager Client Tools (SUSE-SU-2023:3144-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

6.1CVSS6.7AI score0.01142EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2024/02/29 12:00 a.m.28 views

CentOS 9 : python-tornado-6.1.0-9.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- tornado-6.1.0-9.el9 build changelog. - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an...

6.1CVSS6.4AI score0.01142EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2023/12/01 7:15 p.m.8 views

Security Bulletin: Tornado is vulnerable to 263690 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses tornado, which is vulnerable to 263690. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details IBM X-Force ID: 263690 DESCRIPTION: Tornado Web Server is vulnerable to HTTP request smuggling, caus...

6.1AI score
SaveExploits0Affected Software1
Tenable Nessus
Tenable Nessus
added 2023/11/16 12:00 a.m.21 views

Oracle Linux 9 : python-tornado (ELSA-2023-6523)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6523 advisory. 6.1.0-9 - Fix an open redirect in StaticFileHandler Resolves: CVE-2023-28370 Tenable has extracted the preceding description block directly from the Oracle Linu...

6.1CVSS6.2AI score0.01142EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2023/11/07 8:54 a.m.11 views

python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations

A vulnerability was found in the python-tornado library. This flaw causes an open redirect vulnerability that allows a remote, unauthenticated attacker to redirect a user to an arbitrary website and conduct a phishing attack by having the user access a specially crafted URL...

6.1CVSS7.4AI score0.01142EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2023/11/07 8:54 a.m.20 views

Moderate: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

6.1CVSS6.5AI score0.01142EPSS
SaveExploits0References3
AlmaLinux
AlmaLinux
added 2023/11/07 12:00 a.m.41 views

Moderate: python-tornado security update

Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and tools. Security Fixes: python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations CVE-2023-28370 For more details...

6.1CVSS7.1AI score0.01142EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2023/11/07 12:00 a.m.20 views

RHEL 9 : python-tornado (RHSA-2023:6523)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6523 advisory. Tornado is a Python web framework and asynchronous networking library that provides an open source version of scalable, non-blocking web server and...

6.1CVSS6.3AI score0.01142EPSS
SaveExploits0References6
IBM Security Bulletins
IBM Security Bulletins
added 2023/11/02 11:47 a.m.33 views

Security Bulletin: Vulnerabilities in urllib3, Python and Tornado can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore [CVE-2023-43804,CVE-2023-40217,263690]

Summary IBM Storage Protect Plus Microsoft File Systems Backup and Restore can be affected by vulnerabilities in urllib3, Python and Tornado which include obtaining sensitive information, bypass security restrictions and bypass web application firewall protection, and conduct XSS attacks, as...

8.1CVSS6.6AI score0.01207EPSS
SaveExploits0Affected Software1
Photon
Photon
added 2023/10/07 12:00 a.m.25 views

Moderate Photon OS Security Update - PHSA-2023-3.0-0663

Updates of 'tornado' packages of Photon OS have been released...

6.1CVSS7.3AI score0.01142EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2023/09/18 9:56 a.m.79 views

Security Bulletin: Vulnerabilities in Certifi, cryptography, python-requests and Tornado can affect IBM Storage Protect Plus Microsoft File Systems Backup and Restore [CVE-2023-37920, CVE-2023-38325, CVE-2023-32681, CVE-2023-28370]

Summary IBM Storage Protect Plus Microsoft File Systems Backup and Restore can be affected by vulnerabilities in Certifi, cryptography, python-requests and Tornado which include obtaining sensitive information, phishing attacks and weaker security, as described by the CVEs in the "Vulnerability...

9.8CVSS7.2AI score0.02974EPSS
SaveExploits3Affected Software1
Wired Threat Level
Wired Threat Level
added 2023/08/26 1:00 p.m.25 views

This Tool Lets Hackers Dox Almost Anyone in the US

The US Secret Service’s relationship with the Oath Keepers gets revealed, Tornado Cash cofounders get indicted, and a UK court says a teen is behind a Lapsus$ hacking spree...

7AI score
SaveExploits0
The Hacker News
The Hacker News
added 2023/08/24 7:38 a.m.57 views

Tornado Cash Founders Charged in Billion-Dollar Crypto Laundering Scandal

The U.S. Justice Department DoJ on Wednesday unsealed an indictment against two founders of the now-sanctioned Tornado Cash cryptocurrency mixer service, charging them with laundering more than $1 billion in criminal proceeds. Both the individuals, Roman Storm and Roman Semenov, have been charged...

6.9AI score
SaveExploits0
Rows per page
Query Builder