The vulnerabilities of the get_absolute_path() and validate_absolute_path() methods in the Tornado asynchronous networking library allow attackers to read arbitrary files.

The vulnerability of the getabsolutepath and validateabsolutepath methods in the Tornado asynchronous networking library is related to incorrect definition of links before accessing files. Exploiting this vulnerability allows an attacker to read arbitrary files remotely...

Open Redirect

tornado is vulnerable to Open Redirect. The vulnerability exists in the validateabsolutepath function of web.py because it does not properly validate the requests paths that start with double slashes"\", which allows an attacker to redirect users to malicious websites by providing a maliciously...