Summary
| Detail | |||
|---|---|---|---|
| Vendor | Chaos Tool Suite Project | First view | 2010-05-21 |
| Product | Ctools | Last view | 2017-08-07 |
| Version | 6.x-1.0 | Type | Application |
| Update | alpha3 | ||
| Edition | * | ||
| Language | * | ||
| Sofware Edition | * | ||
| Target Software | drupal | ||
| Target Hardware | * | ||
| Other | * | ||
| CPE Product | cpe:2.3:a:chaos_tool_suite_project:ctools | ||
Activity : Overall
Related : CVE
| Date | Alert | Description | |
|---|---|---|---|
| 7.5 | 2017-08-07 | CVE-2015-7875 | ctools 6.x-1.x before 6.x-1.14 and 7.x-1.x before 7.x-1.8 in Drupal does not verify the "edit" permission for the "content type" plugins that are used on Panels and similar systems to place content and functionality on a page. |
| 4.3 | 2015-08-24 | CVE-2015-6665 | Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag. |
| 5.8 | 2015-06-16 | CVE-2015-4398 | Open redirect vulnerability in the Chaos tool suite (ctools) module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages. |
| 2.6 | 2012-12-03 | CVE-2012-5559 | Cross-site scripting (XSS) vulnerability in the page manager node view task in the Chaos tool suite (ctools) module 6.x-1.x before 6.x-1.10 for Drupal allows remote authenticated users with permissions to submit or edit nodes to inject arbitrary web script or HTML via the page title. |
| 4.3 | 2010-05-21 | CVE-2010-2010 | Multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title. |
| 3.5 | 2010-05-21 | CVE-2010-1548 | The auto-complete functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal does not follow access restrictions, which allows remote authenticated users, with "access content" privileges, to read the title of an unpublished node via a q=ctools/autocomplete/node/ value accompanied by the first character of the node's title. |
| 6.8 | 2010-05-21 | CVE-2010-1547 | Multiple cross-site request forgery (CSRF) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable a page via a q=admin/build/pages/nojs/enable/ value or (2) disable a page via a q=admin/build/pages/nojs/disable/ value. |
| 6 | 2010-05-21 | CVE-2010-1546 | Multiple eval injection vulnerabilities in the import functionality in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote authenticated users, with "administer page manager" privileges, to execute arbitrary PHP code via input to a text area, related to (1) the page_manager_page_import_subtask_validate function in page_manager/plugins/tasks/page.admin.inc and (2) the page_manager_handler_import_validate function in page_manager/page_manager.admin.inc. |
CWE : Common Weakness Enumeration
| % | id | Name |
|---|---|---|
| 42% (3) | CWE-79 | Failure to Preserve Web Page Structure ('Cross-site Scripting') |
| 28% (2) | CWE-264 | Permissions, Privileges, and Access Controls |
| 14% (1) | CWE-352 | Cross-Site Request Forgery (CSRF) |
| 14% (1) | CWE-94 | Failure to Control Generation of Code ('Code Injection') |
Open Source Vulnerability Database (OSVDB)
| id | Description |
|---|---|
| 64767 | Chaos Tool Suite Module for Drupal ctools/autocomplete/node URI Access Restri... |
| 64766 | Chaos Tool Suite Module for Drupal Administrative Forms CSRF |
| 64765 | Chaos Tool Suite Module for Drupal admin/build/pages object Parameter Arbitra... |
| 64764 | Chaos Tool Suite Module for Drupal admin/build/pages/import object Parameter ... |
| 64763 | Chaos Tool Suite Module for Drupal Node Titles XSS |
OpenVAS Exploits
| id | Description |
|---|---|
| 2012-12-14 | Name : Fedora Update for drupal6-ctools FEDORA-2012-19449 File : nvt/gb_fedora_2012_19449_drupal6-ctools_fc16.nasl |
| 2012-12-14 | Name : Fedora Update for drupal6-ctools FEDORA-2012-19464 File : nvt/gb_fedora_2012_19464_drupal6-ctools_fc17.nasl |
Nessus® Vulnerability Scanner
| id | Description |
|---|---|
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13916.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13917.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14329.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14330.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14331.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14442.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14443.nasl - Type: ACT_GATHER_INFO |
| 2015-09-08 | Name: The remote Fedora host is missing a security update. File: fedora_2015-14444.nasl - Type: ACT_GATHER_INFO |
| 2015-09-02 | Name: The remote Debian host is missing a security-related update. File: debian_DSA-3346.nasl - Type: ACT_GATHER_INFO |
| 2015-08-28 | Name: The remote Fedora host is missing a security update. File: fedora_2015-13915.nasl - Type: ACT_GATHER_INFO |
| 2015-08-26 | Name: The remote web server is running a PHP application that is affected by multip... File: drupal_7_39.nasl - Type: ACT_GATHER_INFO |
| 2013-01-14 | Name: The remote Fedora host is missing a security update. File: fedora_2012-19508.nasl - Type: ACT_GATHER_INFO |
| 2012-12-13 | Name: The remote Fedora host is missing a security update. File: fedora_2012-19449.nasl - Type: ACT_GATHER_INFO |
| 2012-12-13 | Name: The remote Fedora host is missing a security update. File: fedora_2012-19464.nasl - Type: ACT_GATHER_INFO |
