Fedora 16 : drupal7-ctools-1.0-1.fc16 (2012-5078)

Update to upstream release 1.0, including fix for SA-CONTRIB-2012-054 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 15 : drupal7-ctools-1.0-1.fc15 (2012-5094)

Update to upstream release 1.0, including fix for SA-CONTRIB-2012-054 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Drupal Panels 5.x-1.2 XSS Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Description of Vulnerability: - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL. The Drupal Panels module http://drupal.org/project/panels "allows a site administrator to create...

CVE-2010-2010

Multiple cross-site scripting XSS vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title...

CVE-2010-1547

Multiple cross-site request forgery CSRF vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable a page via a q=admin/build/pages/nojs/enable/ value or 2 disable a page...

CVE-2010-1546

Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable a page via a q=admin/build/pages/nojs/enable/ value or 2 disable a page...

Code injection

The auto-complete functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title...

CVE-2010-2010

The CVE-2010-2010 entry refers to multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (CTools) module for Drupal, affecting the 6.x line prior to 6.x-1.4. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a node title. Affected component:...

CVE-2010-1547

Multiple cross-site request forgery CSRF vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable a page via a q=admin/build/pages/nojs/enable/ value or 2 disable a page...

CVE-2010-2010

Multiple cross-site scripting XSS vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title...

CVE-2010-1546

Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to 1 the...

CVE-2010-1548

The auto-complete functionality in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value...

CVE-2010-1547

CVE-2010-1547 concerns CSRF vulnerabilities in the Drupal Chaos Tool Suite (CTools) module, version 6.x prior to 6.x-1.4. The issue allows remote attackers to hijack administrator sessions by issuing requests that enable or disable a page via specific q parameters (q=admin/build/pages/nojs/enable...

CVE-2010-1548

The CVE concerns the Chaos Tool Suite (CTools) Drupal module (6.x) prior to 6.x-1.4. The autocomplete functionality does not enforce access restrictions, allowing remote authenticated users with the 'access content' privilege to read the title of unpublished nodes via a query like q=ctools/autoco...

CVE-2010-1546

CVE-2010-1546 affects Drupal's Chaos Tool Suite (CTools) module 6.x, prior to 6.x-1.4. An eval injection in the import functionality allows a remote authenticated user with "administer page manager" privileges to execute arbitrary PHP code via input to a text area, via the page_manager_page_impor...