CVE-2015-6665

CVE-2015-6665 affects Drupal 7.x up to version 7.39 and the Ctools module 6.x up to 6.x-1.14. The XSS flaw resides in the Ajax handler, allowing remote attackers to inject arbitrary scripts/HTML via a whitelisted HTML element (potentially the A tag). Remediation: upgrade to Drupal 7.39 and Ctools...

CVE-2012-5559

CVE-2012-5559: Drupal ctools 6.x-1.x before 6.x-1.10 contains a cross-site scripting (XSS) vulnerability in the page manager node view task, exploitable by remote authenticated users with permissions to submit or edit nodes to inject arbitrary script via the page title. Fedora advisories and Drup...

CVE-2015-7875

CVE-2015-7875 concerns the Drupal Chaos tool suite (ctools) module. Affected versions: ctools 6.x-1.x prior to 6.x-1.14 and 7.x-1.x prior to 7.x-1.8. The flaw is improper validation of the edit permission for the content type plugin used by Panels and similar systems, allowing a remote authentica...

CVE-2010-1546

CVE-2010-1546 affects Drupal's Chaos Tool Suite (CTools) module 6.x, prior to 6.x-1.4. An eval injection in the import functionality allows a remote authenticated user with "administer page manager" privileges to execute arbitrary PHP code via input to a text area, via the page_manager_page_impor...

CVE-2015-4398

CVE-2015-4398 is an open redirect vulnerability in the Chaos Tool Suite (ctools) Drupal module. Affected versions are CTools 6.x-1.x prior to 6.x-1.12 and 7.x-1.x prior to 7.x-1.7. The root cause is improper sanitization of URLs processed on confirmation delete pages, enabling remote attackers to...

CVE-2013-1925

CVE-2013-1925 affects the Chaos Tool Suite (ctools) for Drupal, specifically 7.x-1.x prior to 7.x-1.3. The vulnerability arises because the module does not properly restrict node access when generating an autocomplete list of suggested node titles, potentially exposing restricted titles to remote...

CVE-2015-4375

The CVE-2015-4375 vulnerability affects the Chaos tool suite (ctools) module for Drupal (7.x-1.x prior to 7.x-1.7 and 6.x-1.x prior to 6.x-1.12). It enables remote attackers to obtain sensitive node titles via two attack paths: (1) an autocomplete search on custom entities without an access query...

CVE-2012-2082

The CVE-2012-2082 issue affects the Chaos Tool Suite (ctools) Drupal module 7.x-1.x prior to 7.x-1.0. The root cause is that the module did not properly filter user signatures when rendering comments, allowing remote authenticated users with the post comments permission to inject arbitrary web sc...

CVE-2010-1547

CVE-2010-1547 concerns CSRF vulnerabilities in the Drupal Chaos Tool Suite (CTools) module, version 6.x prior to 6.x-1.4. The issue allows remote attackers to hijack administrator sessions by issuing requests that enable or disable a page via specific q parameters (q=admin/build/pages/nojs/enable...

CVE-2010-2010

The CVE-2010-2010 entry refers to multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (CTools) module for Drupal, affecting the 6.x line prior to 6.x-1.4. The vulnerability allows remote attackers to inject arbitrary web script or HTML via a node title. Affected component:...

CVE-2010-1548

The CVE concerns the Chaos Tool Suite (CTools) Drupal module (6.x) prior to 6.x-1.4. The autocomplete functionality does not enforce access restrictions, allowing remote authenticated users with the 'access content' privilege to read the title of unpublished nodes via a query like q=ctools/autoco...