Drupal 6.x

• Advisory ID: DRUPAL-SA-CONTRIB-2015-073
• Project: Trick Question (third-party module)
• Version: 6.x, 7.x
• Date: 2015-March-04
• Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
• Vulnerability: Cross Site Scripting

• Advisory ID: DRUPAL-SA-CONTRIB-2015-071
• Project: Simple subscription (third-party module)
• Version: 6.x, 7.x
• Date: 2015-March-04
• Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
• Vulnerability: Cross Site Scripting

I have migrated a Drupal site to a new hosting environment and am trying to get it configured to match the original site. I have not yet changed the DNS details for the domain, so the dev site is accessed with a temporary URL, e.g., http://###.###.###.###/~account. I can bring up the site itself (images are missing because of that temp URL) but cannot enable Clean URLs. The 'enable' button is not enabled, and I'm seeing a message that they cannot be activated because the server doesn't support it. I have the .htaccess file in place, and see that the server is running PHP5.4x.

• Advisory ID: DRUPAL-SA-CONTRIB-2015-070
• Project: Mover (third-party module)
• Version: 6.x
• Date: 2015-March-04
• Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
• Vulnerability: Cross Site Scripting

• Advisory ID: DRUPAL-SA-CONTRIB-2015-069
• Project: Taxonomy Accordion (third-party module)
• Version: 6.x, 7.x
• Date: 2015-March-04
• Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
• Vulnerability: Cross Site Scripting

• Advisory ID: DRUPAL-SA-CONTRIB-2015-067
• Project: Finder (third-party module)
• Version: 6.x, 7.x
• Date: 2015-March-04
• Security risk: 9/25 ( Less Critical) AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All
• Vulnerability: Open Redirect