Apple is now selling refurbished iPad Air 4 models
Apple is now selling refurbished models of the iPad Air 4 on the US Certified Refurbished store, allowing customers to snag savings of up to $100.If you're in the market for an iPad, you may want to head over to the Apple Certified Refurbished store. Starting Monday, Apple has added the iPad Air 4 to its list of iPad models available to purchase second-hand.Initially spotted by 9to5mac, the store page shows that the refurbished Wi-Fi only 64GB iPad Air costs $469. The 256GB models are available starting at $599. While all colors are currently available, there are no Wi-Fi + Cellular models for sale at this time. Read more...

Read more »

iPad Air 4 models now available on the Apple Refurbished Store
Apple on Monday began selling the iPad Air 4, also known as the 2020 iPad Air, in its US Refurbished Store. There, customers can get the previous generation iPad Air for a lower price, which is great for those who don’t need everything the latest iPad Air offers. more… The post appeared first on 9to5Mac.

Read more »

Everything new in iOS 15.5 for iPhone
With iOS 15.5 officially released, we walk you through all of the changes found in this new update for iPhone including improvements to Wallet, Home, and Podcasts.iOS 15.5After the typical rolling waves of betas, Apple has released iOS 15.5 to the masses. Often referred to as "point" updates, they can contain minor new features and help solidify the user experience. Read more...

Read more »

Researchers Devise iPhone Malware That Runs Even When Device Is Turned Off
An anonymous reader quotes a report from Ars Technica: When you turn off an iPhone, it doesn't fully power down. Chips inside the device continue to run in a low-power mode that makes it possible to locate lost or stolen devices using the Find My feature or use credit cards and car keys after the battery dies. Now researchers have devised a way to abuse this always-on mechanism to run malware that remains active even when an iPhone appears to be powered down. It turns out that the iPhone's Bluetooth chip -- which is key to making features like Find My work -- has no mechanism for digitally signing or even encrypting the firmware it runs. Academics at Germany's Technical University of Darmstadt figured out how to exploit this lack of hardening to run malicious firmware that allows the attacker to track the phone's location or run new features when the device is turned off. This video provides a high overview of some of the ways an attack can work. The findings (PDF) have limited real-world value since infections required a jailbroken iPhone, which in itself is a difficult task, particularly in an adversarial setting. Still, targeting the always-on feature in iOS could prove handy in post-exploit scenarios by malware such as Pegasus, the sophisticated smartphone exploit tool from Israel-based NSO Group, which governments worldwide routinely employ to spy on adversaries. Besides allowing malware to run while the iPhone is turned off, exploits targeting LPM could also allow malware to operate with much more stealth since LPM allows firmware to conserve battery power. And of course, firmware infections are already extremely difficult to detect since it requires significant expertise and expensive equipment. Read more of this story at Slashdot.

Read more »

App developers can automatically increase subscription prices in some cases
On Monday, Apple announced that it would allow developers to automatically charge customers when a subscription price increases — but only in certain cases.Currently, if a developer wants to increase a subscription price to their app, users will be unsubscribed and have to resubscribe and consent to the new price. However, Apple notes that this has caused "some services being unintentionally interrupted for users."Now, Apple will allow developers to charge subscribers a new, higher rate automatically and will not require a user to provide consent. Read more...

Read more »

Apple now lets apps charge increased prices for auto-renewable subscriptions with limits
Earlier this year, Apple had been testing a new feature to let developers charge increased prices for auto-renewable subscriptions. Although this “pilot program” was restricted to selected developers, Apple is now rolling out these changes to everyone – although it has some limits. more… The post appeared first on 9to5Mac.

Read more »

Apple Releases Software Updates for Most Products
As expected, Apple released software updates on Monday for most of its products. After several weeks of beta testing, iOS and iPadOS 15.5, watchOS 8.6 and macOS Monterey 12.4 are available for download. The Cupertino-based company also issued new versions of the operating systems for Apple TV and HomePod devices. Not As Feature-Rich as Prior Updates The new versions of the operating systems don’t offer much in the way of new features. They focus primarily on bug fixes and security patches. However, Apple has included a few minor tweaks, especially to iOS 15.5. The most notable change to macOS Monterey 12.4 is the removal of the “beta” label from Universal Control. It’s now an official feature that Apple has decided is mostly issue-free. Cupertino has also issued a firmware update to the Apple Studio Display to improve its webcam quality. To install macOS Monterey 12.4, open System Preferences, choose Software Updates, and follow the prompts. To update your Studio Display, you’ll need to repeat this process after installing macOS Monterey 12.4. Updates to iOS and iPadOS 15.5 Apple now refers to its physical Apple Card as the “Titanium Card” in Wallet. Additionally, Apple Pay Cash is rebranded as just Apple Cash in the Wallet and in Messages. New “Request” and “Send” options in the Apple Cash section of Wallet make it easier to manage your funds there. In an update to the Podcasts app across iOS, iPadOS, and macOS, Apple has switched on the ability to manage how many episodes the app stores on your device. This can help prevent Podcasts from taking up too much storage space on your iPhone, iPad or Mac. Within the Home app, new Wi-Fi signal bars can help you troubleshoot connection issues with your HomePod devices. Apple has also began allowing “External Link Account Entitlement,” to let reader apps include a link to an external website for account creation and management. This means apps like Netflix can make it easier to sign up for an account without using the App Store in-app purchase system. Next, Apple Classical references appear in the code. Variables for "Open in Apple Classical" and "Open this in the new app designed for classical music" are still there. However, Apple has not yet launched that app, rumored to offer a better listening experience for users of the former Primephonic classical music streaming service Apple acquired in 2021. Cupertino continues to add features for SportsKit and HomeKit. Sleuths discovered TV app mentions for reporting scores for different baseball innings. Another fix in iOS 15.5 addresses a bug that could cause home automations triggered by people leaving or arriving to fail. You can wait for Automatic Updates to download and install iOS and iPadOS 15.5. However, this could take a couple of weeks to roll out. A better option is to go into the Settings app on your device, then tap General > Software Update. Follow the instructions, and your device will soon be up to date. What’s New for the Apple Watching Software Updates Apple Watch 8.6 doesn’t really show anything new or exciting for most of us. However, it does expand ECG functionality and irregular heart rhythm detection to users in Mexico. To install the update, just go to the Apple Watch app on your paired iPhone and go to General > Software Update. Your watch needs to be charged to at least 50%, be placed on its charger, and remain in range of your iPhone.

Read more »

Apple Patches Dozens of Security Flaws With iOS 15.5, Over 50 Fixes For macOS 12.4
Apple has released iOS 15.5, macOS 12.4, and more today with updates like new features for Apple Cash, the Podcasts app, and the Studio Display webcam fix. However, a bigger reason to update your devices is the security patches with today's releases. iOS 15.5 includes almost 30 security fixes while macOS 12.4 features over 50. 9to5Mac reports: Apple shared all the details for the security fixes in its latest software for iPhone, iPad, Mac, and more on its support page. For both iOS and Mac, many of the flaws could allow malicious apps to execute arbitrary code with kernel privileges. Another for iOS says "A remote attacker may be able to cause unexpected application termination or arbitrary code execution." Specifically on Mac, one of the 50+ flaws fixed was that "Photo location information may persist after it is removed with Preview Inspector." Important security updates are also available for macOS Big Sur with 11.6.6, macOS Catalina, Xcode 13.4, and watchOS 8.6. Read more of this story at Slashdot.

Read more »

iOS 15.5 expands Communication Safety in Messages to these countries
Apple last year launched the new Communication Safety in Messages feature to protect children from viewing or sharing nude content. It was initially only available in the United States, but Apple has now expanded the feature to more countries with iOS 15.5. more… The post appeared first on 9to5Mac.

Read more »

Method Found to Run Malware on iPhone Even When It’s Turned Off
Here’s a scary thought. There’s a way to tamper with the firmware on your iPhone when you think you've turned your device off. In a first-of-its-kind security analysis of the iOS Find My function, researchers discovered the flaw. It’s possible to run malware on the iPhone even when it’s off. Leaving Chips Powered to Enable Certain Functions This new attack surface takes advantage certain chips on the iPhone remaining powered even after you shut down iOS. These wireless chips, related to Bluetooth, Near-Field Communication (NFC), and ultra-sideband (UWB) keep operating even in the “power reserve” Low Power Mode (LPM). Since the release of iOS 15, we've been able to locate a lost iPhone with Find My even after powering the device off. On iPhone 11, iPhone 12, and iPhone 13 models, the UWB chip helps keep the device findable even if you've shut off your iPhone or the battery dies. This also allows the iPhone’s Express Transit mode to keep working, but The Hacker News reports that researchers have found a problem with this. Academics from the Secure Mobile Networking Lab at the Technical University of Darmstadt outlined the threat in a recent study. They’ll be presenting their findings at the ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec 2022) this week in San Antonio. Wireless Chips Have Direct Access to Secure Element Apple hardwires the Bluetooth and UWB chips to the Secure Element in the iPhone’s NFC chip, the researchers found. This allows them to store “secrets that should be available in LPM.” The researchers found that the Bluetooth firmware remains unsigned and unencrypted. This provides a loophole, they say, that gives an attacker privileged access to the iPhone to inject malware via the Bluetooth chip even after powering the device off. Since Apple implements Low Power Mode at the hardware level, the tech giant can’t just turn it off in iOS. Therefore, you can’t trust all of your wireless chips to be turned off when you shut down your iPhone. The only good news here is that such an attack vector wouldn’t be easy. The researchers say for such a firmware compromise to happen, the attacker needs to find a way to communicate. They say one way to do this is through the operating system (meaning while the iPhone is running). Attackers could also modify the firmware image, requiring physical access to the iPhone. The third method would be to gain code execution on an LPM-enabled chip using an existing flaw like BrakTooth. "Since LPM support is based on the iPhone's hardware, it cannot be removed with system updates," the researchers said. "Thus, it has a long-lasting effect on the overall iOS security model." Design of LPM features seems to be mostly driven by functionality, without considering threats outside of the intended applications. Find My after power off turns shutdown iPhones into tracking devices by design, and the implementation within the Bluetooth firmware is not secured against manipulation.

Read more »

Apple and Google’s outdated apps ban would cut each store by a third
Estimates have Google Play cutting 869,000 apps and Apple removing 650,000.

Read more »

Apple hosts premiere event for 'Prehistoric Planet'
Apple hosted a premiere event for its highly anticipated Apple TV+ natural history event series, "Prehistoric Planet," ahead of the series premiere on May 23.The event took place on Monday at the AMC Century City IMAX Theatre in Los Angeles. Attendees included executive producers Jon Favreau and Mike Gunton, showrunner/series producer Tim Walker, and lead scientific consultant Dr. Darren Naish.Also in attendance were directors and series animation supervisors Adam Valdez and Andrew R. Jones and score composers Anze Rozman and Kara Talve. Read more...

Read more »

The best wireless chargers for iPhone
Over the last few years wireless charging has gone from novelty concept to a conventional function of any modern iPhone. We won’t pretend that wireless charging is always an ideal substitute for plugging in, but it’s a very hassle-free way to keep your phone topped off throughout the day. Freed from the bother of plugging and unplugging, a wireless charger on your desk is as good a place as any to set your phone, knowing the battery is being steadily replenished, ready for your next outing. A wireless charger by your bed makes it easy to grab and go in the morning or to “just check one thing” without fussing with the lightning cable. We’ve tested a big heap of wireless chargers, and these are some of our favorites. Update 05/16/22: We’ve cleaned up our guide by removing some old produces and double-checking our recommendations. MagSafe, the next generation Apple officially gave up on its ambition to bring the AirPower wireless charger to market back in 2019. Instead, the company has moved ahead with a far more useful and intriguing idea: MagSafe. It debuted on the iPhone 12 (every model) but we expect it to continue to be available on future iPhones. MagSafe combines a ring of magnets for secure attachment, an single-coil NFC to identify accessories, and a magnetometer to know when an item is attached, all around a more powerful Qi-based wireless charging coil (up to 15 watts, up from 7.5 watts in other iPhones). Note that a lot of devices are being billed as “MagSafe compatible,” but that doesn’t mean they support the faster charging or NFC—they merely have a ring of magnets in them. MagSafe compatible is not necessarily real MagSafe. iPhones with MagSafe still work with regular Qi wireless chargers, they are just limited to the same 7.5-watt charging rate as earlier iPhones with them. And MagSafe is used for more than just charging—the magnetic attachment feature will make it possible to snap on all sorts of accessories. Since MagSafe accessories are not all just for charging, and require an iPhone 12 or later, we have a separate article for them. Read more about MagSafe in our guide. The best wireless chargers Wireless chargers tend to come in three variants: stands, pads, and multi-device chargers. There are times when a stand makes more sense. In particular, they’re useful for iPhones with Face ID, as a good stand with a steep angle will point your phone at your face enough for Face ID to work. This makes it a lot easier to unlock your phone to quickly check something without taking it off the charger. Stands are great for reading your phone while it charges, but sometimes you want it to lie flat. It’s less conspicuous on your desk or bedside table, and easier to just plop it down in any direction. Wireless charging pads tend to be a little less expensive than stands, too. Now that AirPods have an optional wireless charging case and the Apple Watch is so popular, we’ve also seen an explosion of 2-in-1 and 3-in-1 chargers meant to charge several Apple devices at once. These are our picks for the best pad, stand, and multi-device charger, but there are a great many such products out there; you may find a different device at a different price better suits your priorities. Logitech Powered 3-in-1 Dock MSRP: $129.99 Best Prices Today: $129.99 at Logitech | $199.00 at Amazon Most iPhone users don’t really need a 3-in-1 wireless charging dock. It’s only of use if you have an iPhone, Apple Watch, and AirPods with the wireless charging case, and you really want to charge them all in the same place.If you want something clean and simple to put on your bedside table or desk to charge all that stuff at once, Logitech’s Powered 3-in-1 dock is a quality solution, though at $129, it’s going to cost you.The dock is a little on the large side, but with clean lines and a nice matte finish that keep it from being an eyesore. It also includes its own Apple Watch charger, while many similar docks require you to insert your own.The steep angle of the phone stand makes it easy to use your phone while it charges, and is well-placed to ensure Face ID works without requiring you to pick up your phone. The wide flat area to the left of the stand can charge any Qi-compatible device, including other phones or AirPods.I had no trouble charging my phone with a thick case on it, either on the stand or the pad area, and you don’t have to be too precise with the placement. The charging lights are tiny and dim, so as not to be distracting next to your bed at night.The charging cable is a proprietary DC barrel connector, which is more annoying than USB-C, but not uncommon on these multi-device chargers. The cable is at least thin and flexible, with a nice matte finish, and a built-in cable management tie.Logitech basically gets everything right about a dock that combines an iPhone charging stand, Apple Watch charger, and charging pad for AirPods (or other devices). The only real gripe I have is the price. If you see it listed for less than $100, it’s a good buy. Otherwise, there are other options that might not be quite as nice, but are a lot easier on the wallet. Moshi Otto Q MSRP: $39.95 Best Prices Today: $39.95 at Moshi | Not Available at Amazon Moshi’s Otto Q is meant to look like furniture. Moshi says it is “Inspired by Danish furniture” and the name is meant to invoke its purpose: it’s like an ottoman for your phone. That might be a bit of a stretch, but the subdued grey fabric and slim profile does look good on almost any end table or nightstand.The charger uses a USB-C connection (yay!) and Moshi supplies a USB-A to USB-C cable (yay!) that is about a foot shorter than it really should be (boo!). The price—around $40—is reasonable but as there is no power adapter included, you’ll have to either use one of the many USB-A power adapter you probably have lying around or add the price of buying a new one.With the right adapter (one with 9V output like most Quick Charge adapters), the pad supports fast 7.5W charging for iPhones and 10W charging for supported Android phones. In fact, Moshi says it has been tested to be the fastest wireless charger by the German magazine Mac&I. I don’t know about that (we don’t test charging speed of all wireless chargers), but it definitely charged up my iPhone quickly and reliably, even with a relatively thick case on it.This is a great wireless charger, it just needs to cost a little less given that it doesn’t come with a power adapter and the included cable is shorter than I’d like. Belkin Boost Charge Wireless Charging Stand MSRP: $49.99 Best Prices Today: $11.99 at Amazon | $24.99 at Belkin Belkin’s Boost Up wireless charging stand always worked well, but we weren’t really fans of its high price and proprietary AC adaptor. Also, it’s not exactly pretty.With the new Boost Charge wireless charging stand, Belkin has made a couple of welcome tweaks. Instead of a proprietary power adapter that ends in a barrel plug, it uses a standard USB power adapter with micro-USB cable. That’s a great shift—there’s no real need for devices like this to give us yet another cable and plug we can’t use with any of our other gear.Unfortunately, the design is nearly identical. A couple of small LED charging indicator lights are gone, and the finish is matte instead of glossy, but that weird retro-future circular pod design is the same as it ever was. It’s comfortable and easy, but it doesn’t exactly look good on your desk.The stand supports 7.5W charging on iPhones, and for Android phones up to 10W, so you get the fastest charging available. I had no trouble getting a solid charging connection with a relatively thick case on my iPhone XS Max, too.The price is a lot more reasonable this time around. Where the previous model retailed for an extravagant $70, the new one tops out at $50, and it’s not unusual to find it listed for half that price. Other wireless chargers tested While these other chargers weren’t our favorites, they may suit your own needs. There are only so many different ways you can wrap a copper coil in a hunk of plastic, so it’s safe to say that your own personal sense of style and pricing sensitivity might a different charger the right choice for you. Nomad Base Station Pro MSRP: $199.95 Best Prices Today: $199.95 at Nomad At $200, the Base Station Pro costs several times more than most wireless charging pads. The included 30W USB-C power adapter and braided cable are certainly nice touches, and the hefty aluminum frame and leather pad have excellent build quality. But neither of those are reason enough to pay such a steep price.Rather, the price is meant to be justified by the 18 overlapping coils and custom power delivery hardware and software that allow you to charge three devices at a time, no matter where on the pad you place them.That’s handy and convenient, but you still can’t charge your Apple Watch on the pad. And no matter how fancy the design or materials, it’s hard to recommend paying $200 for the mild convenience of placing your device anywhere on the charger. Not when a decent charging stand effectively solves that issue as well. Read our full Nomad Base Station Pro review Modula5 wireless charging system MSRP: 79.99 Best Prices Today: $79.99 at Amazon Each of the ‘pods’ of this system can charge either a phone/AirPods or an Apple Watch. Just buy as many pods as you need and snap them together on the left or right edge, then plug a single USB-C power cable into any one of them. Mix and match in whatever order you wish, up to 7 devices (with a maximum of 5 phones). You’ll need a fairly beefy USB-C power adaptor if you want to charge three or more iPhones at once, but you only need one – one plug, one cable. The premium price and somewhat utilitarian design are not worth it for individuals or couples with just a few devices, but families dealing with severe cable clutter are going to be very happy with this. The best value is the bundle with two phone pods and a 30W USB-C power adapter for about $80. Read our full Modula5 wireless charging system review Sette Q wireless charging pad MSRP: 99.95 Best Prices Today: $99.95 at Moshi | Not Available at Amazon Moshi’s Sette Q is a generously big, high-speed, dual-charging pad. It’s available on its own for $90, but it’s only $10 more to get it with a 30W USB-C power adapter that has nice cable management cutouts, so the choice there is obvious. It’s bigger than it appears in a photo; large enough to easily put two Plus Max-size iPhones next to each other without jostling for perfect placement. And it’s got the nice grey fabric design of the reset of Moshi’s ‘Q’ product line, including the matching USB-C cable. The pads support the Qi extended power profile (EPP) up to 15 watts, which is well in excess of what most phones are capable of. iPhones max out at 7.5 watts, and even Android phones with higher-rate wireless charging usually top out at 10-12W. The bundled power adapter will charge two iPhones at 7.5W just fine, but if you want to charge two phone at 15W you need to use a 45W power adapter that supplies at least 15V at 3A. There’s a USB-A port along the front edge that seems all but dedicated charging an Apple Watch, as that’s one of the last remaining popular USB-A charging devices. Moshi even sells a little compact folding Apple Watch charger for $50 called Flekto that is made to fit right in. That’s a bit pricey and it’s hard to recommend, but if you have need to charge two iPhones at the same time and want a nice big, reliable, attractive charging pad, the Settle Q (with power adapter) is not a bad choice. Moshi Lounge Q MSRP: $69.95 Best Prices Today: $69.95 at Moshi | Not Available at Amazon Like the Otto Q charging pad, the Lounge Q stand is “Inspired by Danish furniture.” They’re quite obviously parts of the same line, with dark brushed metal accents and muted grey fabric. It’s industrial, but not cold and harsh-looking. I like the design a lot, and think it would look good on most desks or bedside tables.Like the Otto Q, the Lounge Q uses a proprietary coil design that Moshi says delivers the fastest wireless charging performance out there. With the right USB-C power adapter (not included) it can wirelessly charge up to 15W, but the iPhone wireless standard tops out at 7.5W.I don’t know if it’s the fastest you can buy—frankly all wireless charging is slow compared to plugging in. It does deliver a solid charge with multiple iPhones I tested, including those with a pretty substantial case on them. The pad slides up and down on the metal stand, so you can better place the coils to suit your phone. Move it up for a big phone, down for a smaller one, or all the way to the bottom if you want to turn your phone to landscape orientation to watch video while you charge.The included USB-C charging cable can’t be detached from the charger, which is kind of annoying, but it’s a nice matching grey color and a reasonable four-foot length, though I would prefer it be a little longer.You’ll need to supply your own USB-C power adapter, though. That’s not necessarily a bad thing, especially if you have a lot of them lying around, but it brings us to the Loungue Q’s biggest drawback: it’s price. $60 is a lot to spend on a wireless charger that doesn’t include a power adapter, despite the excellent design and build quality.This is a good buy if you can find it on sale. But with so many perfectly good wireless chargers out there, and not enough difference in performance between them, it’s not worth paying a premium for this one.  Logitech Powered Pad MSRP: $39.99 Best Prices Today: $39.99 at Logitech | Not Available at Amazon Logitech’s Powered Pad is a perfectly suitable no-frills wireless charging pad. At $40 it’s not exactly a bargain, but it’s not overpriced, either.It’s a simple slab that wirelessly charges your iPhone or Android phone (up to 7.5W on iPhones, or 10W on compatible Android phones). I like that there are four matte colors—white, black, blue sage, and lilac—which might help match your decor if you plan to have this is a more open location like your living room.I had no trouble charging my AirPods or iPhone with this, even when I put a relatively thick case on my phone. Your placement doesn’t have to be very precise, though the pad is perhaps smaller than you’d imagine.The Powered Pad comes with its own power adapter, which attaches to the pad via a barrel connector. That’s understandable on multi-device chargers that need more current, but on a simple single-device pad I prefer some sort of USB plug that could be used for other devices as well.The $40 asking price is a little on the steep side for a wireless charging pad, especially when the included power adapter can’t be used for your other devices. But this is a quality product that’s easy to recommend if you can find it on sale. Anker PowerWave 7.5 Stand MSRP: $49.99 Best Prices Today: $18.36 at Amazon | $19.49 at Anker Anker’s new PowerWave products greatly improve quality over its older wireless chargers, but they bump up the price to match.The new stand looks good, as long as you’re okay with the white color. A small blue charge indicator on the front is subtle enough to use on your bedside table. The angle is steep enough to make it suitable for unlocking your iPhone X with Face ID while your phone is resting on your desk.Anker includes a Quick Charge 3.0 compatible power adapter and a matching white microUSB cable, but the cable is way too short. Anker’s spec sheet says it’s three feet long, already a little on the short side, and we measured it at 34 inches. The charger supports 7.5W charging on Apple devices and the 10W fast charge mode on the latest Samsung flagship phones.The power coils inside cover the entire back of the stand, so we had no trouble charging our iPhones in either portrait or landscape orientation. A little cooling fan blows air out a vent in the rear to keep the charge coils cool, which keeps the charge rate from slowing down. If it’s especially quiet and you put your ear up next to it, you can hear the gentle whirring sound. Aircore 2-in-1 Wireless Charging Stand MSRP: 29.99 Best Prices Today: $26.99 at Aukey Aukey’s Aircore 2-in-1 stand is well-priced at around $30, though you’ll have to supply your own Quick Charge 3.0 compatible power adapter (it comes with a USB-A to USB-C cable).Available in black or white, it’s not the most attractive wireless charging stand, but it gets the job done. It easily charges an iPhone at up to 7.5 watts in either landscape or portrait orientation, and reliably charged my iPhone 12 even with a fairly thick case on it.On the back of the stand is an area for charing AirPods or AirPods Pro, which is a little more finicky about placement (but then, that’s typical of AirPods wireless charging).The downside to this stand is its light weight and small rubber feet. It tipped and slid around pretty easily when plunking my phone down or grabbing it in a hurry. While this does a good job of charging, I’d recommend a stand with a bit more heft to it. Prismo Wireless Charging Pad MSRP: $29.99 Best Prices Today: $27.99 at Amazon | $29.99 at RapidX Most wireless charging pads go out of their way to be unobtrusive, especially since they’re commonly used on nightstands and dressers. RapidX’s Prismo charger goes the other way.Its main distinguishing feature is a ring of RGB LED lights around the base. A small button on the bottom toggles it between nine different modes, including five solid colors and various pulsing and rotating variants. Though it’s not in the instructions, a long-press of the button will thankfully turn the light off.Ironically, this RGB LED ring never has anything to do with actually charging your phone. Instead, there’s a separate pinhole charging light on the top of the pad, which is quite dim.The pad is large and works well, with a good non-slip grip surface. And the $30 price isn’t bad, though you’ll need to supply your own QC 2.0 or 3.0 power adapter. AirUnleashed MSRP: $99 Best Prices Today: $99.00 at AirUnleashed Some multi-device chargers are trying to mimic AirPower with a wink and a nod. AirUnleashed owns it’s AirPower knock-off status. The site proudly proclaims, “By taking the technical design of the AirPower, and radically simplifying it, we managed to make a wireless charging mat that can deliver what Apple originally promised.” The simple white pill-shaped design and soft-touch finish sure look like AirPower. The box looks like something from Apple, too; clean white with a simple product photo on top and the product name in Helvetica along the side. But it’s not quite AirPower. There are design compromises, to start. An annoying seam around the edge where the felt-like bottom material meets the sleek top material. It has a permanently-attached charging cable that ends in a USB-A plug, for which you have to supply your own power adapter. It only works with adapters that have an output current of at least 2A at 5V, so you can’t use the adapter that came with your iPhone. The company will happily sell you a Qualcomm Quick Charge 3.0 compatible 18W adapter for $19, or you can use an iPad adapter. There are feature compromises, too. AirPower promised to let you place any Apple device that can be wirelessly charged at any place. AirUnleashed deliberately simplifies the design by requiring specific placement—phone on the left, watch in a little divot just right of center, and AirPods on the right. It works, in that it charged my iPhone XS Max, Apple Watch series 4, and second-generation AirPods just fine. But if I have to put my watch in a specific spot, I’d rather have a vertical stand, because laying it flat doesn’t work well with loop-style bands like the Sport Loop or Milanese Loop. And if the power cable is going to be USB, making it permenantly attached seems like a mistake. This is a reasonable cut-rate facsimile of AirPower, and the $99 price isn’t terrible, but if you aren’t going to have charge-anything-anywhere capability, there are better multi-device chargers that don’t require you to supply your own power adapter. Samsung Wireless Charging Pad MSRP: $51.50 Best Prices Today: $31.89 at Amazon If you’re not opposed to the big Samsung logo staring up at you from your desk, you could do a lot worse than this inexpensive pad. For less than $30 you get a solid, no-slip pad with a generous size—it’s easy to drop your phone on and start a wireless charging connection without needing to be too fussy about placement.Best of all, Samsung throws in a 2A micro USB power adapter, so you don’t need to repurpose one of your own or buy a new one. While this is not a “fast charging” wireless pad, it wasn’t really much slower than the fastest chargers we tested; at least, not when charging iPhones. Some Android phones can handle faster wireless charging speeds. This is one of the uglier charging pads we’ve used, but it’s inexpensive, solid, and works well. Aircore 3-in-1 Wireless Charging Stand MSRP: 28.99 Best Prices Today: $24.64 at Aukey The Aircore 3-in-1 is a lot like the AirCore 2-in-1, only made for those who need to charge their Apple Watch as well. It’s well priced under $30, but it’s hard to recommend unless you can live with a bit of wobble and a light that never turns off.The phone charging stand is like that on the 2-in-1, well-suited to iPhones with thick cases and capable of charging in portrait or landscape orientation. Next to it you’ll find a spot to charge AirPods and a stand for your Apple Watch. As with many such stands, you’ll have to supply your own Apple Watch charging puck, routing the cable through the base.You’ll also need to supply your own power adapter, as the stand only comes with a USB-A to USB-C cable.While the charging itself works fine, the stand would tip back precariously every time I plunked my phone down on it. This wobbling wasn’t enough to dislodge AirPods or an Apple Watch, but it’s pretty sloppy-feeling. I’m also not in love with the way the LED lights shine blue continuously (or green if a device is charging). They’re not too bright, but I wouldn’t want it on my bedside table. Mophie Wireless Charge Pad MSRP: $59.99 Best Prices Today: $18.35 at Amazon One of the very few wireless charging pads sold at Apple Stores ($59.95), Mophie’s wireless charging base is a quality piece of gear. But I still don’t like it all that much. It’s a good size, heavy, with a nice rubberized outer coating that prevents slipping. It’s easy to drop your iPhone on it and get a good charging connection without thinking about it. And it supports 7.5W charging, too. But it has two big strikes against it. First, it’s sixty bucks. You can get good quality wireless charging pads, with adapter, for half that price. Second, the AC adapter connects to a little round DC barrel connector, while most other wireless charging pads use micro USB. Using USB would be far more flexible and convenient—you could plug into dozens of different products, like your laptop, and micro USB cables are everywhere. We have a drawers full of them. Belkin BOOST UP Wireless Charging Pad MSRP: $59.99 Best Prices Today: $36.00 at Amazon Belkin’s Boost Up shares a lot in common with Mophie’s Wireless Charging Base. Both started off at as Apple Store exclusive. Both are large, with a rubberized non-slip bottom (the Mophie has non-slip coating all over). Both support 7.5W charging on your iPhone, too. But the Boost Up shares the Mophie’s downsides, too. It costs about $60, nearly double the price of many other wireless chargers. And it includes an AC power adapter that connects to the charger via DC barrel connector rather than micro USB. Again, USB would be far more convenient. The main difference between the Belkin and the Mophie, then, is your own personal sense of aesthetics. Do you like the matte black rubberized circle of the Mophie base, or do you like the glossy white Belkin, with its reversed slope giving it a sort of “floating” look? It’s really up to you, but we wouldn’t recommend either, based purely on the price and lack of USB connection. Letscom W01 3-in-1 Wireless Charger MSRP: $23.99 Letscom’s 3-in-1 charger will charge your iPhone, AirPods, and Apple Watch all for the bargain-basement price of about $27 (and it’s often on sale for even less). Too good to be true? Not when you take a closer look! First, while this does come with a fairly short USB-to-USB-C cable, it does not come with a power adapter. And to get proper charge, you need to plug it into a power adapter that supports the Quick Charge 2.0 or 3.0 standard—you can’t use a basic 5V/1A USB adapter. So you can add that to the cost. It also doesn’t come with an Apple Watch charger. There’s a special cutout for you to slot in your Apple-made Watch charger, coil up the loose cable, and plug it in to the internal USB-A port. Once you get that sorted, the charging pad does work well enough. The charging “sweet spot” for the phone and AirPods spots is a little on the small side, but once you set your gear down in the right place, it will charge fine.This thing is also incredibly cheaply made. It’s lightweight, cheap plastic all the way, with obvious plastic seams and a chintzy plastic door for the Apple Watch compartment.But it is really inexpensive (if you don’t count the costs of the power adapter and Apple Watch charger you need to supply) and it does work. If you want a 3-in-1 charger on the cheap, here you go. Qimini Pocket Wireless Charger MSRP: $59.95 Best Prices Today: $59.95 at Qimini We’re not entirely sure who this product is for, exactly. It’s a wireless charging pad with an integrated USB cable that tucks away inside. That’s sort of neat and makes it a little more portable, but you still need something to plug the USB plug into. If you’re on the go, you can plug it into your laptop or something like that, but do you really need a wireless charger for that? The Qimini site proclaims it to be, “The world’s thinnest wireless charger plate to date,” but the Anker Powerport Wireless 10 is definitely thinner. It sells for $59.95, without a power adapter, which easily twice what it’s worth. Oh, and it maxes out at 5W output, so it’s one of the slower wireless chargers out there. The Qimini Pocket works, and it’s not a bad design, but it’s slow, expensive, and frankly a bit too large to fit in many pockets. We like the idea of an integrated USB cable, but that’s about all we like about this. Are you interested in a charger you don’t see listed here? That’s not surprising—while we try to cover the most popular brands, there are literally hundreds of wireless chargers on the market. We can still help make sure you get a product you’re happy with, though. The next page contains some helpful general advice to consider when deciding which wireless charger to buy. Qi vs. PMA There are two major standards for wireless charging: PMA (Power Matters Alliance) and Qi (pronounced “chee”). If you see a charger that only supports PMA, keep moving. The new iPhones only support Qi. Fortunately, Qi is by far the most common standard for consumers, so you shouldn’t have much trouble finding a compatible charger. What’s more, every Qi compatible charger should work just fine with every iPhone from the iPhone 8 onward, even if it doesn’t specifically list support for them on its packaging or marketing materials.  5W vs. 7.5W performance The new iPhones shipped with initial wireless charging limited to just 5 watts. That’s pretty slow, but then again, the in-box power adapter is also only 5 watts. So wireless charging really isn’t any slower than the (admittedly pitiful) power adapter that comes in the box. The iOS 11.2 update increased the maximum wireless charging speed to 7.5 watts. That’s 50 percent faster, but charging speeds vary, and they slow down a lot as the battery gets full. Still, if you want the best performance in a wireless charger, look for one that can support 7.5 watts or more. Some pads support faster charging speeds only on some Android phones, but are limited to 5 watts on iPhones. For pads that don’t come with fast-charging adapters, you’ll want to look at the store pages to see what is required to enable higher-speed charging. Some enable faster charging only when using an adapter with Qualcomm’s Quick Charge technology, some work with any high-wattage USB power adapter (like the iPad adapter Apple sells). See what is required before buying a new adapter. Flat or standing? You’ll see two types of wireless chargers on the market: flat pads, and angled stands. A flat pad is simple and easy, but you might want to consider a stand. With a stand it’s a lot easier to use your phone while it’s charging up. And with iPhones that have Face ID, a standing charger makes it easy to unlock your phone without picking it up. Portrait and landscape orientation If you get a stand instead of a flat charger, you’d be wise to make sure it’s made to work with your phone in both landscape and portrait orientation. Most of the time, you’ll plop down your phone standing upright. And Face ID on iPhones will only work when the phone is upright, too. But a charger that works well with your phone in landscape mode makes it easy to play certain games, and of course watch videos, without taking your phone away from those precious free electrons. Case concerns If you keep a case on your phone, you shouldn’t worry too much about whether it will work with a wireless charging pad or stand. The vast majority of cases will work just fine. There are three types of cases that can pose problems, however: The first is a case with a metal back (or a battery case). That battery case may seem attractive with its extra 5,200 mAh of extra juice, but it won’t work with wireless chargers. The second is a wallet case. A particularly thin one might actually work, but electromagnetic induction and credit card magnetic stripes just don’t mix. If you don’t want to screw up your cards, don’t put them between your phone and a wireless charger. The third is especially thick cases. Most chargers will work fine with any case up to about 3mm thick, and some can go through a 5mm case with ease. But maybe you’re a demolition derby racer and also work construction plus you’re a rodeo clown on the weekends. Maybe you have an extra-rugged case. If so, it’s probably too thick to get a wireless charge going, even if it doesn’t have a metal back (as many extra-rugged cases do).

Read more »

Lumen metabolic analyzer iOS app gets overhauled food logging and macro tracking
Lumen, the pocket-sized device that measures your metabolism to help you achieve health and fitness goals is out with a nice update. The iOS-supported device with Apple Health integration has received a refresh for its built-in food log and macro tracker that lets you see the impact your nutrition has on metabolism in real-time. more… The post appeared first on 9to5Mac.

Read more »

New video: Hand on with next-gen iPhone 14 Pro Max replica
A hands-on look at the "iPhone 14 Pro Max," a replica created by third-party case makers with access to detailed schematics and dimensions… The post appeared first on MacDailyNews.

Read more »

Become a certified coding pro for less than $3 a course
Whether you crave an exciting new career in tech or just want to boost the skills on your résumé, learning to code is one of the most valuable specialties you can have. You can master various in-demand programming languages from home with The 2022 All-in-One Learn to Code Certification Bundle. Usually $3,000, it’s on sale […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Former Apple Employees Help Unionization Efforts As Deirdre O’Brien Visits Stores to ‘Listen’
Several Apple retail stores have begun unionization efforts in the past few months. They’ve gotten help from two high-profile former Apple employees, along with organizers of Google’s recent walkout. Showing the Cupertino-based tech giant is taking the sentiment seriously, VP of retail Deirdre O’Brien visited one of the stores to “listen” to what employees want. Apple Whistleblowers and Activists Help With Unionization Efforts Former Apple employees Cher Scarlett and Janneke Parrish have been helping retail store employees organize. Scarlett, formerly a software engineer at Apple, ran an employee pay survey and helped found the #AppleToo campaign. She left the company after reaching a settlement with Cupertino. Parrish worked together with Scarlett before she was fired from her position. At the Austin location, Parrish worked on the Apple Maps team before her termination. After that, she toured every retail store in Texas, listening to employee experiences and continuing to help make many of them public. Employees at many Apple Store locations are unhappy with wages and benefits. In addition to the Grand Central store, employees have also begun organizing in Towson, Maryland and Atlanta. Employees at the Atlanta Apple Store have already filed a petition for union election. In an interview with Wired, both Scarlett and Parrish outlined what they’ve done to help Apple retail employees organize unionization efforts. They played key roles in forming Fruit Stand Workers United at the Grand Central Terminal Apple Store in New York. Apple Retail Head Visits Unionizing Store ‘To Listen’ In other news, reports have surfaced of Apple’s VP of retail Deirdre O’Brien visiting a Maryland retail location. Employees there are unionizing, and store managers have responded by posting a summary of the company’s staff benefits. Store employees there don’t seem impressed by Apple’s response or O’Brien’s visit. At least one employee pointed out that Apple’s recent grant of additional sick time comes at a cost. When I got my COVID shot and had some side affects a day after, I called in because they said they would totally excuse it. Yeah, that didn’t happen. “You calling in still negatively impacts the business, so this is counted against you…” like ok. Thx. Bye. Apple has recently issued a list of “talking points” for store managers to use when responding to union organizers. Among the threats in that memo are suggestions that unionizing efforts could lead to employees losing benefits and career opportunities.

Read more »

Bicycle accessory maker launches AirTag tire holder, but is that a good thing?
Muc-Off, an English bicycle accessory maker, has created a holder for Apple’s AirTag that fits into a bicycle tire. Called the Stealth Tubeless Tag Holder, an AirTag can now go inside the rim of a mountain or gravel bike tire. more… The post appeared first on 9to5Mac.

Read more »

iOS 16 will feature refreshed Apple apps; retain current iOS look and feel
Apple's iOS 16 will introduce many major changes to the mobile operating system, but it will retain the current iOS 15 design language… The post appeared first on MacDailyNews.

Read more »

Apple Releases iOS 15.5, iPadOS 15.5, macOS 12.4, watchOS 8.6, tvOS 15.5, and HomePod Software 15.5
In what may be the final release of the iOS 15/macOS 12 cycle to include more than bug fixes and security updates, Apple has updated all its operating systems with some improvements to Podcasts and Wallet, plus bug fixes and security updates.

Read more »

Apple Testing iPhone With Use USB-C, Other Accessories Might Also Ditch the Lightning Port
Reports surfaced recently of Apple testing new iPhones with USB-C instead of the Lightning charging port. Ming-Chi Kuo also predicted Apple will soon ditch the Lightning charging port in place of the USB-C for other the iPhone and other Apple accessories, making this scenario quite likely. Apple Testing iPhone With USB-C According to Bloomberg's Mark Gurman, Apple is testing new iPhone models that will replace the current Lightning charging port with a USB-C connector. This move will allow Apple to conform to European regulations that require phone and other device makers to adopt USB-C. Additionally, Apple is working on an adapter that will allow accessories designed for the Lightning connector to work with the new iPhone model. It suggests Apple wishes to make sure users who upgrade to new iPhone models will remain able to use current iPhone accessories. Gurman said that Apple will most likely launch this new iPhone in 2023. Streamlining Chargers Used by Various Apple Devices To review, Apple's iPads and Macs already use USB-C instead of a Lightning port. On the other hand, Apple accessories such as AirPods, Apple TV remote, MagSafe battery pack, and MagSafe Duo charger still use the Lightning port. For users with multiple Apple devices, it can become tedious to charge them up, and sometimes even confusing. Hence, it would seem that switching to the USB-C is long overdue. USB-C has become the standard charging port for other manufacturers. If Apple pushes its plan for the iPhone 2023, it would finally be in sync with other smartphone manufacturers. Kuo Predicts Apple Will Release iPhone with USB-C and Other Accessories Ming-Chi Kuo also recently predicted the rumored switch from Lightning charging port to USB-C. On Saturday, he followed that up to predict Apple will also ditch the Lightning port in favor of USB-C for the MagSafe battery pack, AirPods, and Magic Keyboard/Mouse/Trackpad. Kuo tweeted that Apple will do this in the "foreseeable future." How Does iPhone with USB-C Affect Apple and Third-Party Accessory Companies Whether Apple will truly ditch the Lightning port remains uncertain. But if this pushes through, it would mean less Apple control over the iPhone accessories marketplace. For third-party iPhone accessory makers, this would force them to redesign their iPhone accessories to switch to USB-C. It's a good thing that most smartphone accessories used the USB-C. So, manufacturers could simply repurpose their products to mention compatibility with the new iPhones. Another Option for Apple If switching to USB-C poses too much hassle for Apple, it may opt to launch two kinds of iPhones instead. One iPhone model with USB-C can be made available for the European market to comply with EU regulations. And then Apple can release another model with a Lightning port for the U.S. and global market. Whatever Apple decides to do in future iPhone models, don't expect this to happen this year. Both predictions of Kuo and Gurman point to the 2023 iPhone release for the switch.

Read more »

This may be the best look yet at the upcoming iPhone 14 Pro Max
As excitement builds for the iPhone 14 launch expected in about four months, many of the usual suspects are finding ways to stoke it. Case in point, the YouTuber behind Unbox Therapy posted a video Monday in which he “unboxed” what he implied is a CAD design mock-up of an iPhone 14 Pro Max created […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

New Studio Display 15.5 Firmware Update Brings Improved Webcam to All Users
Today Apple has released a new firmware 15.5 update for Studio Display. The major upgrade to arrive with this update is improvements to the performance of the webcam. Users will need to update to the new Monterey 12.4 to receive the firmware update. Those that were relying on the betas to fix their webcam issues can now use an official and stable release. Studio Display 15.5 Firmware Update Brings Webcam Improvements Users may update the Studio Display firmware by connecting the Display to a Mac running macOS Monterey 12.4, which also saw a release today. Once the new Mac Software is installed, Studio Display owners can go to System Preferences > Software Update to install the latest firmware. This new firmware update arrives after Apple has been working on it since March. The primary goal of this update is to address problems concerning the quality of the webcam. The Apple Studio Display features a 12-megapixel Ultra Wide camera that also provides support for Center Stage. However, both reviewers and owners of the Studio Display have noted that the camera consistently produces grainy, washed-out images. The tech giant stated that this is the result of the system not behaving as it should. Apple’s release notes state that the latest firmware refines camera tuning, offering improved noise reduction, contrast and framing. After testing the beta version of the latest update, MacRumors indicated that there is a major difference in camera quality. The largest improvement being in the way framing works. Furthermore, the publisher also stated that colors are not as pale, there is an improvement in contrast and the overall look appears vibrant. Though the publisher also noted that skins tones appear better and there is less noise which provides more clarity, ultimately, Studio Display owners should not expect “dramatic changes”. Additional Updates Along with the latest firmware release being available to everyone, Apple has also provided a new wallpaper for Studio Display users. Additionally, though the new 12.4 update saw a release today, there is not much notable within the update. The latest update primarily focuses on bug fixes and under-the-hood improvements. This is likely due to Apple waiting for WDCC22 to release a new major update. The 2.2GB macOS Monterey 12.4 update is available now. Users can download it via System Preferences > Software Updates.

Read more »

Hands-on: Withings BPM Connect portable blood pressure monitor with Apple Health support
May is Blood Pressure Education Month with May 17 serving as World Hypertension Day to raise awareness and help detect, prevent, and control the health issue. This month we’ve been trying out the most portable blood pressure monitor medically cleared by the FDA, the . Read along for a detailed look at this blood pressure monitor with Apple Health integration plus how far Withings has come in recent years. more… The post appeared first on 9to5Mac.

Read more »

Apple Tap to Pay on iPhone Service Now Being Tested at Apple Park Visitor Center
Apple started testing contactless payments using the iPhone at one of its retail stores. Tap to Pay on iPhone, which gained a second partner last month, allows Apple Stores contactless payment transactions straight from the iPhone without an external card reader. Paving the Way for Contactless Payment We first heard about Apple's Tap to Pay on iPhone feature in February. Back then, payment platform Stripe began beta testing the feature. Afterwards, we did not hear anything more about it. Then, in April, the Tap to Pay on iPhone feature gained a second partner through the financial services firm Adyen. When the Tap to Pay on iPhone feature goes live, it will allow Apple stores to conduct contactless payments with the iPhone serving as POS. Currently, merchants that employ the iPhone for contactless payment used additional hardware, such as the Square reader. This won't be necessary once Apple rolls out Tap to Pay on iPhone feature. Apple Testing Tap to Pay on iPhone Unsurprisingly, Apple seems to be testing the feature in one of its retail locations. In a tweeted video, a customer showed Apple testing the Tap to Pay on iPhone feature at the Apple Park Visitor Center. The video showed that the transaction was done by simply putting the iPhone terminal next to a customer's iPhone. When Apple rolls out the feature in the U.S., it will allow merchants to transact wirelessly with customers using Apple Pay without any additional hardware. Eventually, the feature will be able to use credit and debit cards and other digital wallets beyond Apple Pay. Tap to Pay on iPhone will only require an NFC-equipped iPhone to process the payment. Merchants will be able to accept contactless payment through supported iOS apps. The feature will run even on old iPhones, such as the iPhone XS. Tap to Pay Feature Gains Two Partners to Date With the two financial firms supporting the feature, Apple should start rolling it out so as to attract other payment systems. Unfortunately, Apple has not provided a definite date for the full release of Tap to Pay on iPhone. Still, with the current testing that's being done, we won't be surprised if Apple launches this during the next important Apple event this year.

Read more »

Apple Podcasts Brings New Features Including Download Control, Annual Subscriptions and Distribution System
Today Apple has announced a slew of new features for the Podcasts app. This includes downloaded episode controls, annual subscription plans, partnerships with hosting platforms and more. A Host of New Features The latest iOS 15.5, iPadOS 15.5 and macOS 12.4 will provided a host of new features for Podcasts. One new feature will provide tools that gives users the ability to easily remove accumulated downloads in order to free up storage space. Users will be able to go into the Settings app on iOS and iPadOS under Podcasts, and be able to choose how many recent episodes of shows are downloaded to a device. Users will be able to choose a number of episodes from within a timeframe, or go by number of episodes. Additionally, users will be able to continue to download all new episodes. However, a new option to turn off downloads will provide streaming-only access to podcasts. Users will be able to configure individual shows and provide custom settings for different podcasts. The new update also brings new features such as being able to browse shows by seasons and filter episodes by status. In terms of podcast creators, they will now have the option to provide annual subscription plans for premium podcasts. Monthly subscription options will also be available, with annual subscriptions being the default. Furthermore, annual subscriptions will also show users how much they are saving compared to monthly subscriptions, when applicable. Apple Podcast Delegated Deliver System Lastly, Apple has also introduced The Apple Podcasts Delegated Delivery system, which will allow creators to deliver both free and premium podcast episodes directly to Apple Podcasts through third-party hosting providers. For free episodes, creators will not need to have an Apple Podcasts Program membership to publish episodes. Currently, Acast, ART19, Blubrry, Buzzsprout, Libsyn, Omny Studio, and RSS.com will receive support during the fall launch. Further hosting providers will be added over time. Additional details will be provided concerning the new distribution system when it is closer to launch. The new Apple Podcasts features, including downloaded episode controls and annual podcast subscriptions, will be available in iOS 15.5, iPodOS 15.5 and macOS 12.4. The Delegated Delivery will debut with supported podcast hosting providers this fall.  

Read more »

Apple TV+ announces new kids animated series ‘Eva the Owlet’
Apple TV+ today announced a series order for “Eva the Owlet,” a new animated kids and family series based on the bestselling Scholastic… The post appeared first on MacDailyNews.

Read more »

Apple patches dozens of security flaws with iOS 15.5, over 50 fixes for macOS 12.4
Apple has released iOS 15.5, macOS 12.4, and more today with updates like new features for Apple Cash, the Podcasts app, and the Studio Display webcam fix. However, a bigger reason to update your devices is the security patches with today’s releases. iOS 15.5 includes almost 30 security fixes while macOS 12.4 features over 50. more… The post appeared first on 9to5Mac.

Read more »

HP monitor sports pop-up webcam with Center Stage-like tracking
A new report said HP plans to release a 1440p USB-C monitor with a built-in webcam that pops up and features tracking much like Apple’s Center Stage used in iPad models. The display should serve professionals who want decent pixel density but don’t need the top-shelf visuals a graphics professional might. HP Z24m G3 monitor […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Popular interest in technology is declining, but tech giants aren't going anywhere
Overall interest in Apple products and the technology industry at large have been on a downturn for years. While there is no obvious short-term impact, big tech has already begun shifting away some of its financial power and focus away from hardware and onto greener pastures.Credit: zhang kaiyv/UnsplashAccording to Google's own data, searches for technology companies like Apple and others have been on an overall downward trajectory since 2016. Although that doesn't prove anything on its own, it and other data points suggest an overall decline in interest in the technology sphere from the populace as a whole. Read more...

Read more »

DEA Investigating Breach of Law Enforcement Data Portal
The U.S. Drug Enforcement Administration (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.

Read more »

Requiem for the iPod – Intego Mac Podcast Episode 239
Apple has discontinued the last iPod, the iPod touch. We discuss some of the history of the iPod, and look at 17 reasons who you should use an iPod touch. We also look at the new FIDO initiative, which allows your phone to replace passwords, and we discuss AirTag false alarms. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, May 2022 Edition
Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This month's patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows.

Read more »

Vulnerability Summary for the Week of May 2, 2022
Original release date: May 9, 2022 | Last revised: May 11, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info N/A -- N/A   On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated 2022-05-05 7.5 CVE-2022-1388 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info livehelperchat -- live_helper_chat Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious JS on Application 🙂 2022-04-29 4.3 CVE-2022-1530 MISC CONFIRM mediawiki -- mediawiki The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. 2022-04-29 4.3 CVE-2022-29907 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no low vulnerabilities recorded this week. Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info tecson_and_gok -- multiple_products   In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules. 2022-05-06 not yet calculated CVE-2019-12254 CONFIRM piwigo -- piwigo   SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. 2022-05-06 not yet calculated CVE-2020-19212 MISC piwigo -- piwigo   SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. 2022-05-06 not yet calculated CVE-2020-19213 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. 2022-05-06 not yet calculated CVE-2020-19215 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. 2022-05-06 not yet calculated CVE-2020-19216 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. 2022-05-06 not yet calculated CVE-2020-19217 MISC totolink -- n200re_andn100re_routers   A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element. 2022-05-02 not yet calculated CVE-2020-23617 MISC MISC xtend -- voice_logger   A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page. 2022-05-02 not yet calculated CVE-2020-23618 MISC MISC orlansoft -- erp   The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23620 MISC MISC MISC squire-technologies -- ms_management_system   The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23621 MISC MISC MISC sonicwall -- global_vpn_client   SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system. 2022-05-04 not yet calculated CVE-2021-20051 CONFIRM fuchsia -- multiple_products   The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond. 2022-05-03 not yet calculated CVE-2021-22556 MISC MISC google -- idtoken   The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above 2022-05-03 not yet calculated CVE-2021-22573 MISC multiple_vendors -- multiple_products   NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-22680 CONFIRM topthink -- framework   The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. 2022-05-06 not yet calculated CVE-2021-23592 CONFIRM CONFIRM CONFIRM twelvemonkeys -- twelvemonkeys   The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered. 2022-05-06 not yet calculated CVE-2021-23792 CONFIRM CONFIRM wordpress -- tipsacarrier_wordpress_plugin   The Tipsacarrier WordPress plugin through 1.4.4.2 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL 2022-05-02 not yet calculated CVE-2021-25002 MISC wordpress -- advanced_page_visit_counter_wordpress_plugin   The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it 2022-05-02 not yet calculated CVE-2021-25086 MISC wordpress -- all_in_one_wp_security_&_firewall_wordpress_plugin   The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk 2022-05-02 not yet calculated CVE-2021-25102 MISC sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25267 CONFIRM sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25268 CONFIRM kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25745 MISC MISC kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25746 MISC MISC splunk -- enterprise   A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service. 2022-05-06 not yet calculated CVE-2021-26253 MISC micriumos -- multiple_products   Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones. 2022-05-03 not yet calculated CVE-2021-27411 CONFIRM CONFIRM ecoscentric -- ecospro_rtos   eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. 2022-05-03 not yet calculated CVE-2021-27417 CONFIRM CONFIRM uclibc-ng -- uclibc-ng   uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27419 CONFIRM CONFIRM nxp -- mcuxpresso   NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc. 2022-05-03 not yet calculated CVE-2021-27421 CONFIRM CONFIRM cesanta_software -- mongoose-os   Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27425 CONFIRM CONFIRM riot -- os   RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27427 CONFIRM CONFIRM arm -- cmsis_rtos2   ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution. 2022-05-03 not yet calculated CVE-2021-27431 CONFIRM arm -- mbed-ualloc   ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27433 CONFIRM CONFIRM arm -- mbed-ualloc   ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27435 CONFIRM CONFIRM tencentos-tiny -- tencentos-tiny TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27439 CONFIRM hcl_software -- commerce   HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. 2022-05-06 not yet calculated CVE-2021-27751 CONFIRM hcl_software -- bigfix_inventory   There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. 2022-05-06 not yet calculated CVE-2021-27758 CONFIRM hcl_software -- bigfix_inventory    This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application. 2022-05-06 not yet calculated CVE-2021-27759 CONFIRM hcl_software -- notes   An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code. 2022-05-06 not yet calculated CVE-2021-27760 CONFIRM hcl_software -- weak_tls   Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks 2022-05-06 not yet calculated CVE-2021-27761 CONFIRM hcl_software -- bigfix_platform   Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses 2022-05-06 not yet calculated CVE-2021-27762 CONFIRM hcl_software -- hcl_software   Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) 2022-05-06 not yet calculated CVE-2021-27764 CONFIRM hcl_software -- installshield   The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27765 CONFIRM hcl_software -- bigfix_client_installer   The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27766 CONFIRM hcl_software -- bigfix_console_installer   The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27767 CONFIRM ibm -- maximo_asset_management   IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 205680. 2022-05-03 not yet calculated CVE-2021-29854 CONFIRM XF ibm -- user_management_system_component   IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081. 2022-05-02 not yet calculated CVE-2021-29859 CONFIRM XF splunk -- enterprise_indexer   A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders. 2022-05-06 not yet calculated CVE-2021-31559 MISC cyclos -- cyclos_4_pro   A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter. 2022-05-02 not yet calculated CVE-2021-31673 MISC MISC cyclos -- cyclos_4_pro   Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant. 2022-05-02 not yet calculated CVE-2021-31674 MISC MISC secomea -- multiple_products   Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to 9.7. 2022-05-04 not yet calculated CVE-2021-32010 MISC splunk -- enterprise   The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. 2022-05-06 not yet calculated CVE-2021-33845 MISC MISC red_hat -- sox   A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. 2022-05-02 not yet calculated CVE-2021-3643 MISC suse -- rancher   A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3. 2022-05-02 not yet calculated CVE-2021-36778 CONFIRM suse -- rancher   A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4. 2022-05-02 not yet calculated CVE-2021-36784 CONFIRM wordpress -- mythemeshop_wp_subscribe_plugin   Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin

Read more »

Your Phone May Soon Replace Many of Your Passwords
Apple, Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.

Read more »

Apple AirTags: One Year On – Intego Mac Podcast Episode 238
Apple has provided some clarification to its plan to remove old and in the way apps from the App Store. Microsoft has been working on a VPN that isn't a VPN it works a little differently from Apple's VPN that isn't a VPN. And it's been a year since Apple released AirTags... It hasn't exactly been smooth sailing, but if third-party accessories are an indication, AirTags are doing pretty well. The post appeared first on The Mac Security Blog.

Read more »

Russia to Rent Tech-Savvy Prisoners to Corporate IT?
Faced with a brain drain of smart people fleeing the country following its invasion of Ukraine, the Russian Federation is floating a new strategy to address a worsening shortage of qualified information technology experts: Forcing tech-savvy people within the nation's prison population to perform low-cost IT work for domestic companies.

Read more »

17 Reasons Why You Should Use an iPod touch in 2022
You may think the iPod touch is an out-of-date technology, but there are lots of reasons why you might want to use one. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of April 25, 2022
Original release date: May 2, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info jfinalcms_project -- jfinalcms JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. 2022-04-22 7.5 CVE-2022-27341 MISC link-admin_project -- link-admin Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult(). 2022-04-22 7.5 CVE-2022-27342 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399. 2022-04-22 6.8 CVE-2021-38886 XF CONFIRM pimcore -- pimcore SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data 2022-04-22 5 CVE-2022-1429 MISC CONFIRM ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693. 2022-04-22 4.3 CVE-2021-38904 XF CONFIRM microweber -- microweber Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction. 2022-04-22 4.3 CVE-2022-1439 CONFIRM MISC crypt-server_project -- crypt-server Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username. 2022-04-22 4.3 CVE-2022-29589 MISC MISC ibm -- cognos_analytics IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813. 2022-04-22 4 CVE-2021-20464 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468. 2022-04-22 4 CVE-2021-29824 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697. 2022-04-22 4 CVE-2021-38905 XF CONFIRM Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691. 2022-04-22 3.5 CVE-2021-38903 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240. 2022-04-22 3.5 CVE-2021-38946 CONFIRM XF Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info artifex -- ghostscript   Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. 2022-04-25 not yet calculated CVE-2019-25059 MISC MLIST wordpress -- dw_question_&_answer_pro_wordpress_plugin   The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. 2022-04-25 not yet calculated CVE-2021-24800 MISC wordpress -- dw_question_&_answer_pro_wordpress_plugin   The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status. 2022-04-25 not yet calculated CVE-2021-24805 MISC wordpress -- advanced_page_visit_counter_wordpress_plugin   The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection 2022-04-25 not yet calculated CVE-2021-24957 MISC wordpress -- tatsu_wordpress_plugin   The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker. 2022-04-25 not yet calculated CVE-2021-25094 MISC MISC wordpress-- english_wordpress_admin_wordpress_plugin   The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue 2022-04-25 not yet calculated CVE-2021-25111 MISC sophos -- authenticator_for_android   An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495. 2022-04-27 not yet calculated CVE-2021-25266 CONFIRM maxboard -- maxboard   Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files. 2022-04-26 not yet calculated CVE-2021-26628 MISC tobesoft -- xplatform A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..’. 2022-04-26 not yet calculated CVE-2021-26629 MISC ibm -- qradar_siem   IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030. 2022-04-27 not yet calculated CVE-2021-29776 CONFIRM XF nomachine -- nomachine_for_windows   NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITYSYSTEM. 2022-04-28 not yet calculated CVE-2021-33436 MISC MISC MISC MISC bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable. 2022-04-27 not yet calculated CVE-2021-34587 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot . 2022-04-27 not yet calculated CVE-2021-34588 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface. 2022-04-27 not yet calculated CVE-2021-34589 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed. 2022-04-27 not yet calculated CVE-2021-34590 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd. 2022-04-27 not yet calculated CVE-2021-34591 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields. 2022-04-27 not yet calculated CVE-2021-34592 CONFIRM bender/ebee -- cc612   In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI. 2022-04-27 not yet calculated CVE-2021-34601 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges. 2022-04-27 not yet calculated CVE-2021-34602 CONFIRM 3scale -- apicast   A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address. 2022-04-27 not yet calculated CVE-2021-3523 MISC solarwinds -- serv-u   A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1. 2022-04-25 not yet calculated CVE-2021-35250 MISC MISC metasys -- ads/adx/oas   Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator. 2022-04-29 not yet calculated CVE-2021-36207 CERT CONFIRM veryfixpro -- veryfixpro   VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless. 2022-04-25 not yet calculated CVE-2021-36460 MISC MISC MISC wordpress --alexander_ustimenko's_psychological_tests_&_quizzes_plugin   Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin add a new subscription, update subscription, delete Subscription. 2022-04-29 not yet calculated CVE-2022-29414 CONFIRM CONFIRM wordpress -- ravpage_plugin   Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin

Read more »

You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a parent/guardian) to request removal of their images from Google search results.

Read more »

Apple’s AirTags: One Year On
It's been one year since Apple's AirTags were released; it’s time to take stock. How efficient have they been? What problems have they caused? The post appeared first on The Mac Security Blog.

Read more »

New today at Apple: Clearance 2020 10.9″ iPad Airs starting at only $469, Certified Refurbished
Apple has Certified Refurbished 2020 10.9" iPad Airs now available in their online store in a variety of configurations. Models start at $469 and range up to $190 off Apple's original MSRP. Each iPad Pro comes with Apple's standard one-year warranty, features a new outer case, and is in like-new condition. These iPads might be the right thing for you if you're looking to save money on an iPad Pro and don't need the M1 processor found in the '21 models. See Apple's site for the latest stock status... The post first appeared on MacPrices.net.

Read more »

Prices continue to drop on Apple Refurbished 27″ 5K iMacs with models now available starting at only $985
Other World Computing has dropped prices again on Apple refurbished, factory-sealed, just-discontinued 27" 5K iMacs with models now on sale for up to $814 off Apple's MSRP, starting at only $985. Their prices are the lowest available for the most recent generation 27" 5K iMacs (officially discontinued by Apple in March). Apple's standard one-year warranty applies, and OWC offers a 14-day free return policy. Discounts are also available on extra RAM and storage options... The post first appeared on MacPrices.net.

Read more »

Apple has clearance 27″ 5K iMacs available starting at only $1299, Certified Refurbished
Apple has clearance, Certified Refurbished, 2020 27" 5K iMacs available starting at $1299 and ranging up to $560 off original MSRP. Apple's one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are in stock on Apple's site today: (1) 27" 5K 6-Core 3.3GHz iMac: $1439 $560 off original MSRP, (2) 27" 5K 6-Core 3.1GHz iMac: $1299 $500 off original MSRP. The post first appeared on MacPrices.net.

Read more »

Use your Apple Education discount to take $100 off every 13″ MacBook Pro or MacBook Air with an M1 CPU
Need a new 13" Apple MacBook? Whether you're a student, teacher, or staff member, you can use your .edu email address when ordering at Apple Education to take $100 off the price of a new MacBook. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount, including parents of students. Education discounts are also available on most build-to-order options, such as extra RAM and more storage... The post first appeared on MacPrices.net.

Read more »

In stock today and on sale: Silver 13″ M1 MacBook Pros for $150-$250 off MSRP, prices start at $1149
Amazon has Apple's Silver 13" MacBook Pros with M1 Apple Silicon processors in stock today and on sale for $150-$250 off MSRP for a limited time. Shipping is free. These prices are the lowest the lowest currently available for new 13" M1 MacBook Pros: (1) 2020 13" MacBook Pro M1 CPU/256GB SSD: $1149.99 $150 off MSRP, (2) 2020 13" MacBook Pro M1 CPU/512GB SSD: $1249.99 $250 off MSRP. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. The post first appeared on MacPrices.net.

Read more »

Mac Studio with M1 Max CPU in stock and on sale today for $1899, $100 off Apple’s MSRP
Apple reseller Simply Mac has the new Mac Studio with M1 Max CPU (10-Core CPU) in stock and on sale for $1899.99 including free shipping. Their price is $100 off Apple's MSRP, and it's the lowest price available for a Mac Studio this weekend from any Apple reseller. For the latest prices and sales, see our Mac Studio Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

In stock: Open-box 16″ M1 Pro MacBook Pros for $350-$450 off MSRP
Having trouble finding a 16" M1 Pro MacBook Pro to buy? QuickShip Electronics has open-box return 16" M1 Pro MacBook Pros in stock and on sale for $350-$450 off MSRP on their eBay store right now, each with free express delivery. According to QuickShip, "The item in this listing is an Open Box (packaging maybe slightly distressed). The unit powers on with factory settings restored and includes the original accessories." The following standard-configuration models are available... The post first appeared on MacPrices.net.

Read more »

Apple Watch SE models are on sale today for up to $50 off MSRP, starting at $229
Amazon has Apple Watch SE GPS models on sale today for $50 off MSRP including free shipping. Their prices are the lowest currently available for SE Watches: (1) 40mm Apple Watch SE: $229, save $50, (2) 44mm Apple Watch SE: $259, save $50. Note that their sale prices may be restricted to certain band colors, and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Switch to Red Pocket Mobile and get an Apple iPhone SE for $100 off plus free 6 months of Unlimited nationwide service
Switch to Red Pocket Mobile and get an Apple iPhone SE for $100 off MSRP, plus get free 6 months of Unlimited nationwide service with the purchase of any iPhone. Red Pocket Mobile is a nationwide service using all the major wireless carrier networks and offers 50GB plans for $50 per month, no contract required, and cheaper plans starting at $20/month for 3GB of 5G data. They're currently offering the iPhone SE for $100 off MSRP (either all upfront or via 24-months of payments), with prices starting at $329 for 64GB of storage. Keep an eye on our iPhone Price Tracker for the latest prices & deals on iPhones and plans from Apple and its carriers, updated daily. The post first appeared on MacPrices.net.

Read more »

8.3″ WiFi iPad minis are in stock today and on sale for $90-$100 off Apple’s MSRP
Amazon is offering sale prices on Apple's 8.3" WiFi iPad minis ranging up to $100 off MSRP, depending on configuration. Prices start at $409. Most models are in stock today with free shipping. Amazon's prices are the lowest currently available for minis from any Apple reseller we track... The post first appeared on MacPrices.net.

Read more »

Last call: New 32GB iPod touch for $189 at these Apple resellers, $10 off MSRP
Apple discontinued the iPod touch this week, marking the end of the iPod brand at Apple. They are quickly selling out at resellers. Looking to purchase one while you can? The following iPods are in stock today. It's the last call if you want a new iPod from an Apple reseller at a discounted price... The post first appeared on MacPrices.net.

Read more »

Apple Discontinues iPod touch, Promotes Company’s Other Products As Means Of Listening To Music Digitally
NEWS: 05.12.22 – The “gadget of the century” is history. The iPod touch — the only model of the iPod that is still sold — is no more. The device is being discontinued by Apple in favor of listening to music on its other products via Apple Music, the company’s subscription-based music streaming service. Along with access to more than 90 million songs and over […] The post first appeared on MacPrices.net.

Read more »