CVE-2010-2010

Multiple cross-site scripting XSS vulnerabilities in the Chaos Tool Suite aka CTools module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title...

CVE-2010-1548

The CVE concerns the Chaos Tool Suite (CTools) Drupal module (6.x) prior to 6.x-1.4. The autocomplete functionality does not enforce access restrictions, allowing remote authenticated users with the 'access content' privilege to read the title of unpublished nodes via a query like q=ctools/autoco...

CVE-2010-1547

CVE-2010-1547 concerns CSRF vulnerabilities in the Drupal Chaos Tool Suite (CTools) module, version 6.x prior to 6.x-1.4. The issue allows remote attackers to hijack administrator sessions by issuing requests that enable or disable a page via specific q parameters (q=admin/build/pages/nojs/enable...

CVE-2010-2010

The CVE-2010-2010 entry refers to multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (CTools) module for Drupal, affecting the 6.x line prior to 6.x-1.4. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a node title. Affected component:...