Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web script or HTML via the (1) title or (2) text field in the cms_calendar page to cms/index.php; unspecified fields to in (3) the cms_polls page to cms/index.php or (4) a new topic in the topics page to forum/index.php; or (5) a new PT (private topic/private message) in the topics page to forum/index.php.
Monthly Archives: March 2015
CVE-2015-2678
Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
CVE-2015-2679
Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) page parameter to index.php or (2) username parameter to gxadmin/login.php.
CVE-2015-2680
Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
CVE-2015-2681
Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm.
RHBA-2015:0713-1: ceph-common bug fix and enhancement update
Red Hat Enterprise Linux: Updated ceph-common packages that fix several bugs and add various enhancements
are now available for the Red Hat Common channel of Red Hat Enterprise Linux 6
and the Red Hat Common channel of Red Hat Enterprise Linux 7.
RHBA-2015:0712-1: pam_passwdqc bug fix update
Red Hat Enterprise Linux: Updated pam_passwdqc packages that fix one bug are now available for Red Hat
Enterprise Linux 6.
RHBA-2015:0711-1: mgetty bug fix update
Red Hat Enterprise Linux: Updated mgetty packages that fix one bug are now available for Red Hat
Enterprise Linux 6.
RHBA-2015:0710-1: time bug fix update
Red Hat Enterprise Linux: Updated time packages that fix one bug are now available for Red Hat Enterprise
Linux 6.
Smart TVs have become the new target for cyber criminals

Smart TVs bring along benefits that actual televisions can’t offer. Internet access and communication with other devices make possible choose your broadcast program, share your favorite shows, watch YouTube videos and use other apps that we already have on our phones.
As Google couldn’t be less, has already launched Android TV, their small-screen Android operation system. We hope that the giant and the other technological companies are aware that connected TVs not only come loaded with virtues, but also with risks in security issues.
At least for now it doesn’t offer such a wide range of possibilities as smartphones, and it is neither a personal computer, but everything points that in a couple of years they will offer similar benefits. Take for example banking operations, like managing our accounts through the banks virtual platforms or online shopping. A delicious treat for cybercriminals.

A recent research of the European Union Agency for Network and Information Security (ENISA) identifies the cyberattacks as the main threats for Smart Homes, this threat will increase as more and more devices are connected within them and the network.
Apart from banking information, there is much more data at the mercy of the assailants. We just have to take a look into the new controversy that splattered Samsung, accused of listening to their customers conversations through their Smart TV’s microphones.
This is because the service conditions advise that in order to enable Voice Recognition, some voice commands must be captured and analyzed through remote control. The privacy policy states: “Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party.”
Samsung is not the first company accused of recording their viewers. In 2013, a British developer discovered that LG’s Smart TV was gathering information about the user’s television habits via its smart ad feature. Later that year, Malik Mesellem expert in cyber security found a weakness in Samsung TVs that would make them liable to denial-of-service attacks (the famous DDos).

Despite the South Korean company has strongly denied the listening’s accusation, and “third parties” would only be the company responsible of converting the voice commands into orders, suspicions have not disappeared. If they can spy with your phone microphone, why wouldn’t they do it through this one?
Nor should we forget that TVs also incorporate cameras, so making video calls is just around the corner. As we are connected to the Net, digital offenders may have access to images of your living room. Creating a new window for cyberespionage, directly into your home.
These devices also store large amounts of personal data, all kinds of documents stored both in the device’s internal memory and in the cloud. A malware installed in the TV could extract information and miss use it.
Experts admit that we must not fall into alarmism and completely reject smart appliances, but is important that we know the risks and be careful.
So if you have an Android operating system TV, the best thing you can do is protect it with Panda Mobile Security, our antivirus for Android. You will not regret it!
The post Smart TVs have become the new target for cyber criminals appeared first on MediaCenter Panda Security.