Quilombo Project

• Advisory ID: DRUPAL-SA-2008-047
• Project: Drupal core
• Version: 5.x, 6.x
• Date: 2008-August-13
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Multiple vulnerabilities

read more

• Advisory ID: DRUPAL-SA-2008-046
• Project: Drupal core
• Version: 5.x
• Date: 2008-July-23
• Security risk: Less critical
• Exploitable from: Remote
• Vulnerability: Session fixation

read more

• Advisory ID: DRUPAL-SA-2008-045
• Project: OpenID (third-party module)
• Version: 5.x
• Date: 2008-July-9
• Security risk: Less critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting, Cross site request forgeries

read more

• Advisory ID: DRUPAL-SA-2008-044
• Project: Drupal core
• Version: 5x, 6.x
• Date: 2008-July-9
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Multiple vulnerabilities

read more

• Advisory ID: DRUPAL-SA-2008-043
• Project: Outline designer (third-party module)
• Version: 5.x
• Date: 2008-July-2
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Privilege escalation

read more

• Advisory ID: DRUPAL-SA-2008-042
• Project: Tinytax taxonomy block (third-party module)
• Version: 5.x
• Date: 2008-July-2
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting

read more

• Advisory ID: DRUPAL-SA-2008-041
• Project: Taxonomy autotagger (third-party module)
• Version: 5.x
• Date: 2008-July-2
• Security risk: Critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting and SQL injection

read more

• Advisory ID: DRUPAL-SA-2008-040
• Project: Organic Groups (third-party module)
• Versions: 5.x and 6.x
• Date: 2008-July-02
• Security risk: Less Critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting and information disclosure

read more

• Advisory ID: SA-2008-039
• Project: Suggested terms (third-party module)
• Versions: 5.x
• Date: 2008-June-25
• Security risk: Moderately critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting

read more

• Advisory ID: DRUPAL-SA-2008-038
• Project: Services (third-party module)
• Versions: 5.x and 6.x
• Date: 2008-June-18
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Arbitrary code execution

read more

• Advisory ID: DRUPAL-SA-2008-037
• Project: TrailScout (third-party module)
• Version: 5.x
• Date: 2008-June-18
• Security risk: Higly critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting and SQL injection

read more

• Advisory ID: SA-2008-036
• Project: Profile Search (third-party module)
• Versions: 5.x
• Date: 2008-July-18
• Security risk: Critical
• Exploitable from: Remote
• Vulnerability: Multiple vulnerabilities

read more

• Advisory ID: SA-2008-035
• Project: Aggregation (third-party module)
• Versions: 5.x
• Date: 2008-June-11
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Multiple vulnerabilities

read more

• Advisory ID: SA-2008-034
• Project: Node Hierarchy (third-party module)
• Versions: 5.x and 6.x
• Date: 2008-June-11
• Security risk: Less critical
• Exploitable from: Remote
• Vulnerability: Access bypass

read more

• Advisory ID: SA-2008-033
• Project: Taxonomy Image (third-party module)
• Versions: 5.x and 6.x
• Date: 2008-June-11
• Security risk: Less critical
• Exploitable from: Remote
• Vulnerability: Cross site scripting

read more

• Advisory ID: SA-2008-032
• Project: Magic Tabs (third-party module)
• Versions: 5.x
• Date: 2008-June-11
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Arbitrary code execution

read more

• Advisory ID: SA-2008-031
• Project: Pblog (third-party module)
• Versions: none
• Date: 2008-June-11
• Security risk: Not critical
• Exploitable from: Remote
• Subject: Incorrect vulnerability report

read more

• Advisory ID: DRUPAL-SA-2008-030
• Project: Site Documentation (third-party module)
• Versions: 5.x and 6.x
• Date: 2008-May-14
• Security risk: Highly critical
• Exploitable from: Remote
• Vulnerability: Privilege escalation

read more

I am using civicspace 0.8.5. Drupal just released three critical cross-site-scripting security advisories (Advisory IDs DRUPAL-SA-2006-024 to 26) - is civicspace vulnerable to these? If so, how can I fix this?

kkk