Multiple vulnerabilities in BibTex Publications (si_bibtex)

It has been discovered that the extension "BibTex Publications" sibibtex is susceptible to Cross-Site Scripting and SQL Injection. Release Date: December 15, 2014 Bulletin Update: January 9, 2015 added CVEs Component Type: Third party extension. This extension is not a part of the TYPO3 default...

CVE-2014-3758

The CVE refers to a Cross-Site Scripting (XSS) vulnerability in the TYPO3 extension BibTex Publications (si_bibtex) version 0.2.3, exposed through the import functionality. The TYPO3 security bulletin TYPO3-EXT-SA-2014-020 documents affected versions (0.2.3 and below) and lists XSS (alongside SQL...

CVE-2014-3758: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the BibTex Publications sibibtex extension 0.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via vectors related to the import functionality...

CVE-2014-3759: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the BibTex Publications sibibtex extension 0.2.3 for TYPO3 allow remote attackers to execute arbitrary SQL commands via vectors related to the 1 search or 2 list functionality...

SEC Consult SA-20140430-0 :: SQL injection and persistent XSS in the Typo3 3rd party extension si_bibtex

SEC Consult Vulnerability Lab Security Advisory 20140430-0 ======================================================================= title: SQL injection and persistent XSS product: Typo3 3rd party extension sibibtex vulnerable version: sibibtex 0.2.3 fixed version: - impact: critical homepage:...