Rumor: OLED MacBook Pro without a notch coming in 2026
Apple has big plans for the future of MacBook Pro displays. A new timeline from research firm Omdia reveals that Apple aims to transition the MacBook Pro from mini-LED to OLED displays as soon as 2026. As part of this change, Apple reportedly plans to ditch the MacBook Pro’s notch cutout… more…

Read more »

This super-fast 100W triple Anker charger is nearly half-off today
Macworld Charging your iPhone, MacBook, or iPad (or any other gadget you have) is easier and faster when you have the right gear. This 100W three-port Anker will handle everything without breaking a sweat, and the best part is that it’s only $46 at Amazon. That’s an impressive 46 percent off its $85 MSRP. As mentioned, this is a 100W GaN charger from Anker that can quickly charge your devices. Anker estimates that it can take your 14-inch MacBook Pro from 0 to half-full in half an hour, enough to get through most of a work day. One thing that makes this charger a great idea for those who often travel is that it comes with thick foldable prongs, which means it will take up less space and won’t snag on fabrics or scratch up your devices. As mentioned, this particular Anker model has three ports—two USB-C and one USB-A. Of course, it’s only when you use single-port charging you actually get the 100W max output via the type-C ports. But it’s no slouch when using all three ports at the same time, with the top USB-C port delivering 65W and the other two maxing out at 24W. So go ahead and fix your charging woes by getting this Anker 100W Prime Charger for just $46 while it’s still on sale. And if this is a stocking stuffer for your techie friend, then know it will arrive ahead of Christmas with time to spare if you order soon. Buy now at Amazon

Read more »

Today in Apple history: Apple storms New York’s Grand Central Terminal
On December 9, 2011, Apple opened its fifth Manhattan retail store, located in New York's ultra-busy Grand Central Terminal. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

OLED MacBook Pros reportedly won’t have notch
According to a recent report from Omdia, Apple is planning to eliminate the notch from its MacBook Pro lineup when the first MacBook Pro… The post appeared first on MacDailyNews.

Read more »

4 acclaimed Apple TV+ series grab Golden Globe nominations
New Apple TV+ Golden Globes nominations go to "Slow Horses," with three, and also to "Shrinking," "Disclaimer" and "Presumed Innocent." (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Next Apple TV+ movie is a Valentine’s Day horror thriller, here’s the trailer
Apple TV+ has revealed its next movie release, and it’s a little bizarre and still very mysterious. Starring Anya Taylor-Joy and Miles Teller, The Gorge looks like part thriller, part horror, with some romance thrown in and a Valentine’s Day release. Here’s the trailer. more…

Read more »

Got a problem with your Mac, iPhone, or iPad? Macworld’s Mac 911 can help
Macworld With Macworld’s Mac 911 column, we take your questions and do our best to help. We love being the place you come to find answers to nagging problems. The “Mac 911” name predates iOS, iPadOS, and iCloud, but we’re happy to answer questions about all those topics as well as macOS and any Apple hardware, software, or service. Ask Mac 911 We’re always looking for new problems to solve! If you have a problem with your Mac, iPhone, iPad, Apple Watch, or any other Apple device, let us know about it and we’ll try to help by responding with a Mac 911 column. You can also ask us general tech questions if you have them. Here’s how to send us your questions: Send an email to mac911@macworld.com Including screenshots when appropriate  Let us know if you want your full name used or not If you have a question that doesn’t include screenshots, you can submit it through the form below. Submit your question to Mac 911 Submit a form. Keep in mind that not every question will be answered, we don’t reply to email, and we cannot provide direct troubleshooting advice. Check the Mac 911 FAQ Some questions we get more frequently than others. We’ve covered those questions in the Mac 911 FAQ. The FAQ covers topics involving: The Photos app and iCloud Photos macOS: erase, revive, restore, and reinstall Apple ID problems Siri misspellings and mispronunciations

Read more »

Expect 2026 to be a huge year for OLED MacBook and iPad
Apple reportedly intends to introduce MacBooks and an iPad mini with an OLED screen in 2026 as the switch away from LED continues. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple Silicon chief Johny Srouji likely on Intel’s new CEO short list
Following the recent departure of CEO Pat Gelsinger, Intel may once again turn to Apple's Johny Srouji as a potential candidate for… The post appeared first on MacDailyNews.

Read more »

Here's where to get Apple's M3 MacBook Air 16GB for $899 with delivery by Christmas
Delivery dates are already slipping on Apple's popular M3 MacBook Air with 16GB RAM. Here's where to pick it up for as low as $899, with delivery by Christmas.Get an M3 MacBook Air for just $899 with delivery by Christmas - Image credit: AppleAmazon is reporting delivery after Christmas for its M3 MacBook Air 13-inch 16GB/256GB listing, but Best Buy currently has units in stock at a $200 discount off MSRP with free shipping or store pickup.Buy from $899 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Best iPhone 13 and iPhone 13 Pro deals
Macworld If you’re in the market for a 13-series iPhone, you’ve come to the right place. This article offers a summary of the best deals and promotions offered by popular retailers to help you get the best deal on this discontinued handset. The company discontinued the iPhone 13 Pro when the 14-series handsets came out in fall 2022; it then dropped the 13 mini in fall 2023, and finally killed off the standard iPhone 13 in fall 2024. If you want to buy a 13-series iPhone, you won’t get one from Apple, unless it’s from the Apple Refurbished Store (U.S.) or Apple Refurbished Store (U.K.). Luckily we’re here to guide you to the best deals available from a wide range of vendors. (If you’re considering other models, check out our overall Best iPhone deals roundup.) Best unlocked 13-series iPhone 13 deals Because Apple no longer sells the 13-series iPhones, you’ll need to shop around. Here are the best deals we’re seeing right now. U.K. Amazon, iPhone 13 (128GB): £441 (£58 off, most recent RRP was £599) iPhone 13 carrier stores and contract deals You can try to get a good deal on an iPhone 13 from a carrier or mobile provider, but there will often be significant strings attached. These deals can be complicated, so be sure to read the fine print. U.S. AT&T T-Mobile Verizon U.S. readers can also view the best current iPhone 13 contract deals in their area by perusing the table below.

Read more »

Best iPhone SE deals
Macworld If you’re looking for an iPhone but don’t want to spend a fortune, the third-gen iPhone SE, Apple’s cheapest current handset, is the phone for you. It features a powerful processor (the A15, which also appeared in the flagship iPhone 13 Pro from 2021) at an affordable price, starting at $429 in the U.S. or £429 in the U.K. In this article, we round up the best deals and discounts currently available on each iPhone SE model, as well as cheap bundle offers worth considering. We cover both SIM-free and contract deals, identifying which retailers which have the handsets in stock, and which offer the best price. If you want to get yourself an iPhone SE, read on for the best deals. Just be aware that Apple could soon upgrade the iPhone SE. The new model expected in spring 2025 may lose the Home button and be more like the iPhone 14. Read iPhone SE 4: Everything you need to know. U.K. KRCS, iPhone SE (64GB): £375 (£54 off, RRP £429) Amazon, iPhone SE (128GB): £429 (£50 off, RRP £479) How much does the iPhone SE cost? Apple’s most affordable iPhone starts at $429/£429. (And you can get it for less if you trade in an older qualifying phone.) The 2022 model is currently available in three configurations: iPhone SE (2022, 64GB): $429 / £429 / AUD$719 iPhone SE (2022, 128GB): $479 / £479 / AUD$799 iPhone SE (2022, 256GB): $579 / £579/ AUD$969 (If you’re buying the iPhone SE we recommend that you avoid the lowest-capacity model. We explain in a separate article: Why you shouldn’t buy the 64GB iPhone SE.) Best iPhone SE (2022) deals on contract Try the following stores and carriers for the best iPhone SE contract deals. As mentioned above, make sure you’re getting the 2022 model with the A15 processor and 5G. It’s also bearing in mind that you’ll want the contract to include 5G support too: you need both hardware and contract to support the tech, and this may cost extra. If in doubt, ask a member of the sales support staff. U.S. readers can browse the best contract deals using the table below:

Read more »

'Slow Horses' and 'Disclaimer' lead Apple's Golden Globes nominations
Apple TV+ has scored seven nominations in the major categories of the Golden Globes, with "Slow Horses" and "Disclaimer" getting multiple nods.Gary Oldman in "Slow Horses" — image credit: Apple TV+It's a dramatic drop from its fortunes in 2023 when Apple TV+ scored 16 nominations across the film and television categories. But this time the critical hit "Slow Horses" picked up three nominations, while "Shrinking" and "Disclaimer" each had two.The full list of nominees is: Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Build APIs, apps and websites — no code needed
Whip up websites and automate workflows simply by dragging and dropping with Twidget. Get a lifetime sub to the no-code platform for just $39. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

iPhone 14 and iPhone 14 Pro: Where to get the best deals
Macworld The iPhone 16 launched in September 2024, but you can still buy 2022’s iPhone 14 or iPhone 14 Plus from Apple. And if you’re prepared to shop around you may still be able to get the iPhone 14 Pro or Pro Max (both of which were discontinued in 2023). This article is designed to help you to spend as little money as possible. We provide a summary of the best deals and promotions offered by popular retailers, plus automatically updated price-comparison tables covering the wider market, all of which will help you find the very best deal on your new iPhone.  If you’re looking for other models, check out our overall Best iPhone deals roundup. And if you can’t decide which iPhone to buy, read our reviews and take a look at our Best iPhone chart. Where to get the best iPhone deals Buying direct from Apple is one option if you’re looking for an unlocked, SIM-free iPhone 14 or iPhone 14 Plus, and it’s the go-to place to join the iPhone Upgrade Program. Apple will also let you trade in your old iPhone and get up to $650 in credit toward a new purchase. Find an unlocked or SIM-free iPhone 14 or iPhone 14 Plus at Apple. With the arrival of the 15-series iPhones in late 2023, Apple stopped selling the iPhone 14 Pro and 14 Pro Max, but they are still available from other retailers, as you will see in the price comparison tables below. Best unlocked iPhone 14 series deals in the U.K. Amazon, iPhone 14, 128GB: £549 (£50 off, RRP £599) Best iPhone 14 series carrier deals If you want to buy a recent iPhone for less than the full retail price, you’re probably going to need to get it from a carrier or mobile provider, and there will often be significant strings attached. These deals can be complicated, so be sure to read the fine print. In the U.S., Apple partners with carriers to offer discounts on the 2022 iPhones. You get a $30 discount if you buy a phone activated on AT&T, Verizon, or T-Mobile/Sprint, however, if you shop around there are some good deals to be found. See our table below for the best deals right now. U.S. AT&T: Get up to $800 in bill credits when you buy a new iPhone 14 and trade in your old phone, with a qualifying unlimited plan. T-Mobile: Get up to $800 in bill credits when you buy an iPhone 14 and trade in your old phone when you add a new line. Verizon: Get up to $1,000 in bill credits toward an iPhone 14 Pro with trade-in and select Unlimited plans.

Read more »

Best iPad Pro deals this month
Macworld If you want to buy an iPad Pro you’ve come to the right place. In this article, we’re looking at where you can buy the iPad Pro for the lowest price. We track the various resellers who sell the iPad Pro in the U.S. and U.K., so we always have details of the best prices and best discounts. Read on to find the best place to get a great deal on a new iPad Pro right now! There are two kinds of iPad Pro: the 11-inch Pro with M4 and the 13-inch Pro with M4, both of which were launched in May 2024. Among these are Wi-Fi and cellular models in various configurations. For more information read our iPad Pro 2024 review and find out how it compares to the 2024 iPad Air in our iPad Air (M2) vs iPad Pro (M4) comparison. Have a look at our iPad buying guide if you’re not sure which model you want. You may also like to read: best iPad for kids, best iPad for students, and best iPad for seniors. Best iPad Pro deals right now U.S. Amazon, 11-inch M4 iPad Pro (256GB, 8GB RAM): $899 ($100 off, MSRP $999) Amazon, 11-inch M4 iPad Pro (2TB, 16GB RAM): $1,449 ($150 off, MSRP $1,599) Amazon, 13-inch M4 iPad Pro (256GB, 8GB RAM): $1,099 ($200 off, MSRP $1,299) U.K. Amazon, 11-inch M4 iPad Pro (256GB): £899 (£100 off, RRP £999) Amazon, 11-inch M4 iPad Pro (512GB): £1,099 (£100 off, RRP £1,199) John Lewis, 13-inch M4 iPad Pro (256GB): £1,149 (£150 off, RRP £1,299) Best M4 iPad Pro deals The M4 iPad Pro models launched in May 2024. Look through the tables below to find the best discounts. These tables will always be up-to-date with the latest prices for each iPad Pro. For even bigger savings, the 2022 iPad Pro models can be found in the section below this one. 11-inch M4 iPad Pro (256GB, Wi-Fi): MSRP $999/£999 Retailer Price $899 View Deal $924 View Deal $999 View Deal $999 View Deal $1199 View Deal $1199 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 11-inch M4 iPad Pro (512GB, Wi-Fi): MSRP $1,199/£1,199 Retailer Price $1021.95 View Deal $1099 View Deal $1104 View Deal $1199 View Deal $1199 View Deal $1199 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 11-inch M4 iPad Pro (1TB, Wi-Fi): MSRP $1,599/£1,599 Retailer Price $1449 View Deal $1,469 View Deal $1469 View Deal $1499 View Deal $1499 View Deal $1599 View Deal $1599 View Deal $1599 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 11-inch M4 iPad Pro (2TB, Wi-Fi): MSRP $1,999/£1,999 New Refurbished Retailer Price $1829 View Deal $1,909.49 View Deal $1999 View Deal $1999 View Deal $1999 View Deal $1999 View Deal $1999 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iPad Pro 11 M4 (2024) 2000GB – Space Black – (WiFi) $1749 View Deal Price comparison from Backmarket 13-inch M4 iPad Pro (256GB, Wi-Fi): MSRP $1,299/£1,299 Retailer Price $1104 View Deal $1199 View Deal $1199 View Deal $1199 View Deal $1199 View Deal $1299 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 13-inch M4 iPad Pro (512GB, Wi-Fi): MSRP $1,499/£1,499 Retailer Price $1194 View Deal $1199 View Deal $1299 View Deal $1299 View Deal $1299 View Deal $1399 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 13-inch M4 iPad Pro (1TB, Wi-Fi): MSRP $1,899/£1,899 New Refurbished Retailer Price $1573.95 View Deal $1739 View Deal $1,825.30 View Deal $1869 View Deal $1899 View Deal $1899 View Deal $1899 View Deal $1899 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iPad Pro 13 M4 (2024) 1000GB – Space Black – (WiFi) $1629 View Deal Price comparison from Backmarket 13-inch M4 iPad Pro (2TB, Wi-Fi): MSRP $2,299/£2,299 New Refurbished Retailer Price $2099 View Deal $2099 View Deal $2299 View Deal $2299 View Deal $2299 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iPad Pro 13 M4 (2024) 2000GB – Space Black – (WiFi) $1849 View Deal Price comparison from Backmarket Best 11-inch M2 iPad Pro deals The M2 iPad Pro models launched in October 2022, and have now been replaced by the M4 model. But you may still be able to get a deal on one of these older models. Look through the tables below to find the best discounts. These tables will always be up-to-date with the latest prices for each iPad Pro. 11-inch M2 iPad Pro (128GB, Wi-Fi): MSRP $799/£899 New Refurbished Retailer Price $799.99 View Deal $1024 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 11 (2021) 128GB – Space Gray – (WiFi) $476.14 View Deal iPad Pro 11 (2021) 128GB – Silver – (WiFi) $517.07 View Deal iPad Pro 11 (2022) 128GB – Silver – (WiFi) $681.56 View Deal iPad Pro 11 (2022) 128GB – Space Gray – (WiFi) $699 View Deal iPad Pro 11 (2020) 1000GB – Space Gray – (Wi-Fi + LTE) $729 View Deal Price comparison from Backmarket View more prices 11-inch M2 iPad Pro (256GB, Wi-Fi): MSRP $899/£1,019 New Refurbished Retailer Price $844 View Deal $899 View Deal $899.99 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 11 (2021) 256GB – Silver – (WiFi) $567.68 View Deal iPad Pro 11 (2021) 256GB – Space Gray – (WiFi) $583.29 View Deal iPad Pro 11 (2022) 256GB – Space Gray – (WiFi) $757 View Deal iPad Pro 11 (2022) 256GB – Silver – (WiFi) $813.65 View Deal Price comparison from Backmarket 11-inch M2 iPad Pro (512GB, Wi-Fi): MSRP $1,099/£1,249 New Refurbished Retailer Price $1024 View Deal $1099 View Deal $1099.99 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 11 (2021) 512GB – Space Gray – (WiFi) $659.99 View Deal iPad Pro 11 (2022) 512GB – Silver – (WiFi) $905 View Deal Price comparison from Backmarket 11-inch M2 iPad Pro (1TB, Wi-Fi): MSRP $1,499/£1,699 Retailer Price $1099 View Deal $1499 View Deal $1499 View Deal $1499.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 11-inch M2 iPad Pro (2TB, Wi-Fi): MSRP $1,899/£2,149 New Refurbished Retailer Price $1499 View Deal $1,649.99 View Deal $1759 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 11 (2022) 2000GB – Silver – (WiFi) $1149.99 View Deal iPad Pro 11 (2022) 2000GB – Space Gray – (WiFi) $1824.99 View Deal Price comparison from Backmarket Best 12.9-inch M2 iPad Pro deals 12.9-inch M2 iPad Pro (128GB, Wi-Fi): MSRP $1,099/£1,249 New Refurbished Retailer Price $1024 View Deal $1099.99 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 12.9 (2022) 128GB – Space Gray – (WiFi) $713.26 View Deal iPad Pro 12.9 (2022) 128GB – Silver – (WiFi) $809.28 View Deal Price comparison from Backmarket 12.9-inch M2 iPad Pro (256GB, Wi-Fi): MSRP $1,199/£1,369 New Refurbished Retailer Price $899 View Deal $1119 View Deal $1199 View Deal $1199.99 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 12.9 (2022) 256GB – Silver – (WiFi) $835.84 View Deal iPad Pro 12.9 (2022) 256GB – Space Gray – (WiFi) $899 View Deal Price comparison from Backmarket 12.9-inch M2 iPad Pro (512GB, Wi-Fi): MSRP $1,399/£1,599 New Refurbished Retailer Price $999 View Deal $1299 View Deal $1299.99 View Deal 1399 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 12.9 (2020) 512GB – Silver – (WiFi) $629.79 View Deal iPad Pro 11 (2020) 512GB – Silver – (WiFi) $699 View Deal iPad Pro 12.9 (2021) 512GB – Silver – (WiFi) $714 View Deal iPad Pro 12.9 (2021) 512GB – Space Gray – (WiFi) $719.99 View Deal iPad Pro 12.9 (2022) 512GB – Space Gray – (WiFi) $929 View Deal iPad Pro 12.9 (2022) 512GB – Silver – (WiFi) $979 View Deal Price comparison from Backmarket View more prices 12.9-inch M2 iPad Pro (1TB, Wi-Fi): MSRP $1,799/£2,049 New Refurbished Retailer Price $1299 View Deal $1674 View Deal $1799 View Deal $1799.99 View Deal Price comparison from over 24,000 stores worldwide Product Price iPad Pro 12.9 (2021) 1000GB – Silver – (WiFi) $999 View Deal iPad Pro 12.9 (2022) 1000GB – Space Gray – (WiFi) $999 View Deal Price comparison from Backmarket 12.9-inch M2 iPad Pro (2TB, Wi-Fi): MSRP $2,199/£2,499 Retailer Price $1699 View Deal $1881 View Deal $2039 View Deal $2199 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Where to buy the iPad Pro You can also find the iPad Pros from all the retailers listed below. Alternatively, check out the great deals in the section below – our best price tables will always be up to date with the latest prices for each iPad Pro model. US retailers Apple Amazon Best Buy Costco Target Walmart UK retailers Apple Amazon Argos Currys John Lewis KRCS Very Apple has a number of Apple Premium Resellers who stock iPads in the UK, and also offer other services, try the following: KRCS is often the first to discount new products iStore Select Western Computer iPad Pro refurbished deals The deals you will see above are generally from Apple resellers rather than Apple itself, which rarely reduces prices. Apple does, however, sell reconditioned iPads in its refurbished store. So you can grab a bargain. The iPads in Apple’s refurbished store may be ex-display stock, or they may have been returned to Apple due to a fault, but they are fully reconditioned now and come with a full year’s warranty. It’s not like buying secondhand. In the U.K., watch this page and the U.S. Refurb Store page is here. The U.S. refurbished store has a selection that includes: Standard iPad (8th and 9th generation) iPad Air (4th generation) 11-inch iPad Pro (2nd and 3rd generation) 12.9-inch iPad Pro (4th and 5th generation) iPad mini (5th and 6th generation) Compared to the original price, you can save as much as $320 on a 12.9-inch iPad Pro. Get a refurbished iPad at Apple's refurbished store (U.S.) In the U.K. you’ll find a similar selection of iPads available from Apple’s refurbished store. You’ll find the following: Standard iPad (9th generation) iPad Air (4th generation) 11-inch iPad Pro (2nd and 3rd generation) 12.9-inch iPad Pro (5th generation) iPad mini (5th and 6th generation) There are savings of £480 on a 12.9-inch iPad Pro, compared to the original price. Get a refurbished iPad at Apple's refurbished store (U.K.) Another place to look is BackMarket US and BackMarket UK, which sells refurbished iPads and other Apple products. There is also a large refurbished market for the iPad. We’d recommend taking a look at these refurbished resellers: Amazon AWD Big Phone Store eBay Envirofone Affordable Mac Tech Trade 4Gadgets Handtec Laptops Direct Music Magpie Preloved Smartfone Store Apple Education Discount University students and teachers can also save on the iPad Pro with Apple’s Education pricing. See our full guide on to how to get an education discount. Or head directly to Apple UK or Apple US to get the educational discount.

Read more »

Apple and Sony may team on game controllers for Vision Pro
Apple and Sony have discussed forging a game controller partnership that could change gaming on the Vision Pro… The post appeared first on MacDailyNews.

Read more »

Boldly designed ‘subwoofer’ earbuds boast 3 drivers but mixed performance [Review] ★★★☆☆
Our hands-on Between 3ANC earbuds review looked into the bold, three-driver "subwoofer" buds, finding good sound but "meh" noise cancellation. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

iPhone SE 4 rumored to get 48MP rear camera, OLED screen
Apple's upgrades to the 2025 iPhone SE 4 go beyond OLED, with one report claiming it will also gain a 48-megapixel rear camera.Phone SE 4 could look like iPhone 14, but with one rear cameraThe iPhone SE 4 has been rumored to arrive in March 2025 with a lot of updates. In a Sunday report from South Korea, it seems the list of changes has more to come.Sources of ET News say that LG Innoteck and LG Display are supplying the cameras and displays for the iPhone SE 4. In the case of LG Innotech, while it previously only supplied the rear camera for the iPhone SE 3, it will do the front as well for the iPhone SE 4. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iPhone SE 4 is coming soon; here are the latest rumors
Apple is reportedly set to launch the iPhone SE 4 in just a few short months. The update will bring a dramatic overhaul to Apple’s most affordable iPhone. A new supply chain report this week has some additional details on what to expect from the iPhone SE 4’s camera hardware. more…

Read more »

Surprising rumor says new HomePod will get high-quality OLED screen
South Korean press unexpectedly claims that Apple's anticipated new HomePod with a display will use high-quality OLED screens, all of which are to be manufactured in China.An artist's rendition of a HomePod with a displayThe much-rumored HomePod with a built-in screen has most recently been predicted to be launched in the second half of 2025. But Chinese display firm Tianma is said to have already got the exclusive order, and will be making OLED screens.According to Seoul Economic Daily, the company is believed to be planning screens of between 6 inches and 7 inches, and using the low-temperature polycrystalline silicon (LTPS) version of OLED. Reportedly, this is also the first time that a Chinese company has gained an exclusive contract, beating South Korean rivals. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

5 Tech Gifts To Brighten Their Holidays
Rob Enderle's curated list of standout tech gifts that are sure to impress includes innovative gadgets for every budget, from practical home tech to cutting-edge wearables. Whether you're shopping for family, friends, or colleagues, these picks offer something for everyone this holiday season. The post appeared first on TechNewsWorld.

Read more »

Best MacBook Pro deals this month
Macworld Apple announced new 14-inch and 16-inch MacBook Pro models with M4, M4 Pro and M4 Max chips at an event in October 2024. The upgraded MacBook Pro models arrived a year after Apple launched the M3, M3 Pro and M3 Max variants of the 14- and 16-inch MacBook Pro and bring double the RAM alongside the new chips. The new MacBook Pro models went on sale on Friday, November 8. They are available to buy now. Read our reviews: 14-inch MacBook Pro (M4) review and 16-inch MacBook Pro (M4 Pro) review. If you want to buy a MacBook Pro you may be wondering if you can save money by buying one of the M3-series models. These models are likely to be discounted as resellers sell off the discontinued stock. However, be aware that those models have half the RAM compared to the newer models. Apple charges $200/£200 to upgrade the RAM at point of sale, so if you find an older MacBook Pro on sale with less RAM, do make sure that the discount reflects that. Another consideration is that if you are outside the U.S. the price of the new models is less than the old models, so make sure that the discount takes that into account. With a mixture of price rises and declines across the range in comparison to the previous generation, it could be hard to spot a really good deal. Luckily we are here to help. Our team of Apple experts search the web all year round for the top deals, offers, and discounts for the MacBook Pro–seeking out the best money-off offers to save you time. We are focused on the MacBook Pro here, but there are some great deals for the MacBook Air too. The MacBook Air and the 13-inch MacBook Pro have a lot in common, so you might also be interested in reading our MacBook Air deals article as well. And make sure you check out our complete round-up of the best Apple deals. Below you will find price comparison tables that show the best prices right now for each standard model of MacBook Pro (including the new models that go on sale on November 8). You will also find deals on MacBook Pro models that Apple has now discontinued, as long as stockists still have them available. For more information and more help choosing the best Apple laptop read our buying guide where we cover all the models. We also have a Mac buying guide that covers the whole range. We also explain the differences between the MacBook Air and Pro. Best MacBook Pro deals right now The new MacBook Pro went on sale on November 8, but we are already seeing a price drops. There are discounts on the older models, but you should make sure that you take into account the fact that they have less RAM than the new models. Here are some of the best deals we are seeing right now. Best U.S. MacBook Pro deals We are already a discount on the new M4 MacBook Pro at Amazon U.S.: Amazon, M4, 14-inch MacBook Pro, 512GB/16GB RAM: $1,487 ($112 off, MSRP $1,599) Amazon, M4 14-inch MacBook Pro, 1TB/16GB RAM: $1,737 ($62 off, MSRP $1,799) Amazon, M4 16-inch MacBook Pro, 512GB/24GB RAM: $2,250 ($250 off with coupon, MSRP $2,499) Apple’s older M3 MacBook Pro models are on clearance: Best Buy, M3 14-inch MacBook Pro, 512GB/8GB RAM: $1,299 ($300 off, Was $1,599 – Clearance) B&H, M3 Pro 14-inch MacBook Pro, 512GB/18GB RAM: $1,699 ($300 off, Was $1,999 – Clearance) Best Buy, M3 Pro 14-inch MacBook Pro, 1TB/18GB RAM: $2,099 ($300 off, Was $2,399 – Clearance) Best Buy, M3 Pro 16-inch MacBook Pro, 512GB/18GB RAM: $1,999 ($500 off, Was $2,499 – Clearance) Best Buy, M3 Pro 16-inch MacBook Pro, 512GB/36GB RAM: $2,399 ($500 off, Was $2,899 – Clearance) Best U.K. MacBook Pro deals We are already seeing discounts on the new M4 MacBook Pro at KRCS and a discount at Amazon: KRCS, M4 14-inch MacBook Pro, 512GB/16GB RAM, £1,519.10 (£80 off, RRP £1,599) KRCS, M4 14-inch MacBook Pro, 1TB/16GB RAM, £1,519.05 (£80 off, RRP £1,799) Amazon, M4 Pro 14-inch MacBook Pro, 512GB/24GB RAM, £1,849.97 (£149 off, RRP £1,999) Amazon, M4 Pro 16-inch MacBook Pro, 512GB/24GB RAM, £2,249.97 (£249 off, RRP £2,499) KRCS, M4 Max 16-inch MacBook Pro, 1TB/36GB RAM, £3,179.97 (£349 off, RRP £3,499) Apple’s older M3 MacBook Pro models are on clearance at the following retailers: Argos, M3 14-inch MacBook Pro, 1TB/8GB RAM: £1,499 (£400 off, Was £1,899 – Clearance) Amazon, M3 Pro 14-inch MacBook Pro, 1TB/18GB RAM: £1,929 (£370 off, Was £2,299 – Clearance) Best deals on the latest MacBook Pro While you could buy a MacBook Pro from Apple, the charts below show the best deals for the 14-inch MacBook Pro M4, M4 Pro & M4 Max right now. 14-inch MacBook Pro deals 14-inch, M4, 10-core CPU/10-core GPU, 512GB/16GB RAM, $1,599/£1,599 Retailer Price $1499 View Deal $1599 View Deal $1599 View Deal $1599 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M4, 10-core CPU/10-core GPU, 1TB/16GB RAM, $1,799/£1,799 Retailer Price $1799 View Deal $1799 View Deal $1799 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M4, 10-core CPU/10-core GPU, 1TB/24GB RAM, $1,999/£1,999 Retailer Price $1839 View Deal $1849 View Deal $1999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Retailer Price $2199 View Deal $2199 View Deal $2399 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M4 Pro, 12-core CPU/16-core GPU, 512GB/24GB RAM, $1,999/£1,999 Retailer Price $1839 View Deal $1849 View Deal $1999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M4 Pro, 14-core CPU/20-core GPU, 1TB/24GB RAM, $2,399/£2,399 Retailer Price $2199 View Deal $2199 View Deal $2399 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M4 Max, 14-core CPU/32-core GPU, 1TB/36GB RAM, $3,199/£3,199 Retailer Price $2,929 View Deal $2929 View Deal $3199 View Deal $3199 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch MacBook Pro deals 16-inch, M4 Pro, 14-core CPU/20-core GPU, 512GB/24GB RAM, $2,499/£2,499 Retailer Price $2299 View Deal $2299 View Deal $2499 View Deal $2499 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch, M4 Pro, 14-core CPU/20-core GPU, 512GB/48GB RAM, $2,899/£2,899 Retailer Price $2664 View Deal $2,699 View Deal $2699 View Deal $2899 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch, M4 Max, 14-core CPU/32-core GPU, 1TB/36GB RAM, $3,499/£3,499 Retailer Price $3209 View Deal $3,254 View Deal $3499 View Deal $3499 View Deal $3499 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 16-inch, M4 Max, 16-core CPU/40-core GPU, 1TB/48GB RAM, $3,999/£3,999 Retailer Price $3,664 View Deal $3664 View Deal $3799 View Deal $3999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best deals on discontinued MacBook Pro If you don’t mind buying an older MacBook Pro, there are some great deals to be had, if you take a look at the charts below. Best MacBook Pro M3, M3 Pro & M3 Max deals Get a discount on the MacBook Pro models introduced in 2023: you’ll find the lowest prices in the tables below. 14-inch, M3, 8-core CPU/10-core GPU, 8GB Unified Memory, 512GB SSD, $1,599/£1,699 – discontinued Retailer Price $974.95 View Deal $1294 View Deal $1299 View Deal $1,349.95 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M3, 8-core CPU/10-core GPU, 8GB Unified Memory, 1TB SSD, $1,799/£1,899 – discontinued Retailer Price $1,399 View Deal $1399 View Deal $1399 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M3 Pro, 11-core CPU/14-core GPU, 18GB Unified Memory, 512GB SSD, $1,999/£2,099 – discontinued Retailer Price $1499 View Deal $1649 View Deal $1699 View Deal $1749 View Deal $1,798.49 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket 14-inch, M3 Pro, 12-core CPU/18-core GPU, 18GB Unified Memory, 1TB SSD, $2,399/£2,499 – discontinued Retailer Price $2,099 View Deal $2099 View Deal $2099 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 14-inch, M3 Max, 14-core CPU/30-core GPU, 36GB Unified Memory, 1TB SSD, $3,199/£3,299 – discontinued Retailer Price $2799 View Deal $2799 View Deal $2999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch, M3 Pro, 12-core CPU/18-core GPU, 18GB Unified Memory, 512GB SSD, $2,499/£2,599 – discontinued Retailer Price $1999 View Deal $1999 View Deal $2,396.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch, M3 Pro, 12-core CPU/18-core GPU, 36GB Unified Memory, 512GB SSD, $2,899/£2,999 – discontinued Retailer Price $2399 View Deal $2599 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 16-inch, M3 Max, 14-core CPU/30-core GPU, 36GB Unified Memory, 1TB SSD, $3,499/£3,599 – discontinued Retailer Price $3,399 View Deal $3399 View Deal $3399 View Deal $3999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best 13-inch MacBook Pro (M2) deals These Macs were introduced in 2022. You may still find them on sale. 13-inch MacBook Pro M2 8-core CPU/10-core GPU, MSPR: $1,299/£1,349 – discontinued Retailer Price $1,114.95 View Deal $1249 View Deal $1299 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket 13-inch MacBook Pro M2 8-core CPU/10-core GPU, MSPR: $1,499/£1,549 – discontinued Retailer Price $1449 View Deal $1499 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Where to buy a MacBook Pro There are limited stocks leading to some shipping delays, but you can find the MacBook Pro on sale at various locations. You could buy a MacBook Pro directly from Apple, or at stores and Apple Premium Resellers around the world – many of whom offer discounts on new and old Macs, so it’s worth shopping around. You can find out where the MacBook Pro is in stock or read our Where to buy a Mac article for more advice. One benefit of buying from Apple is you could trade in your old Mac and get money off. We have an article explaining  How to get money off with Apple’s trade-in program. We recommend the following resellers in the U.S. and U.K.: U.S. retailers Apple Store Apple Education Store Amazon B&H Photo Best Buy Walmart Adorama Looking for other ways to save money. Find out if you can save money buying Apple products from another country. U.K. retailers Apple Store Apple Education Store Amazon AO.com BT Shop Currys Ebuyer John Lewis Laptops Direct Very Additionally, Apple has a number of Apple Premium Resellers in the U.K. who stock Macs and offer other services: KRCS Insight iStore Select Western Computer Jigsaw Best MacBook Pro refurbished deals While Apple rarely discounts new Macs, from time to time there are some excellent deals to be had in Apple’s Refurbished Store. The Macs in Apple’s refurbished store may be ex-display stock, or they may have been returned to Apple due to a fault, but they are fully reconditioned now and come with a full year’s warranty. Read about buying a refurbished Mac. It’s not only Apple that sells refurbished Macs, but Apple does offer some great incentives to buy from Apple’s Refurbished Store, so we do recommend taking a look there for great MacBook Pro deals. Get a refurbished MacBook at Apple's refurbished store (U.S.) Get a refurbished MacBook at Apple's refurbished store (U.K.) You can get refurbished Macs from other suppliers too, including the following refurbished resellers listed below: In the U.S.: Apple Amazon Back Market Best Buy Decluttr Gainsaver OWC Mac Of All Trades Refurb.me In the U.K.: Affordable Mac Apple Amazon BackMarket Hoxton Macs Laptops Direct MacFinder Mac 4 Sale Music Magpie Amazon also has a certified refurbished store for Apple products but we would advise against buying any products that are older than five years – most of the products we see on the Amazon refurbished store are unfortunately very old. Another place to look is BackMarket US and BackMarket UK, which sells refurbished Macs and other Apple products. We also recommend Hoxton Macs in the U.K. Find the latest Apple refurbished deals here. If you are considering buying a second-hand Mac read: Should I buy a second hand Mac?

Read more »

Best iMac deals this month
Macworld A year after Apple updated the iMac with an M3 chip Apple switched in an M4 chip and doubled the memory. The 2024 iMac was announced in October 2024 and went on sale on November 8. Read about the 2024 iMac and read our review: M4 iMac review. With the arrival of the M4 iMac the M3 iMac will no longer be sold by Apple, but you may find those older models available at a discount from resellers while they try to sell off old stock. Note that outside the U.S. the prices have dropped on the iMac range, so the savings may not be as good as they appear to be. Not that you need to pay full price. The team here at Macworld is constantly looking out for the best iMac deals from around the web. We track the biggest and best deals from U.S. and U.K. retailers and list them all right here in this article. So you can always find the best price for an iMac. If the 24-inch display on the iMac isn’t big enough for you you may be interested to learn that although Apple discontinued the 27-inch iMac in March 2022, it is rumored that a new iMac Pro could be in the pipeline. If that is the Mac you are interested in you may be in for a long wait though, with the larger iMac not expected until late 2024 or 2025. Alternatively, you may be interested in Apple’s high-power desktop, the Mac Studio, see our Best Mac Studio deals. The Mac mini with M4 Pro is another good option, see Best Mac mini deals. You might also want to look through our round-up of the best MacBook Pro deals and MacBook Air deals. Make sure you check out our complete round-up of the best Apple deals we’ve seen too. If you need help deciding which Mac is best for you read our Mac buying guide.  Best iMac deals right now There are deals on the new iMacs, but the biggest discounts are likely to be on the older models. U.S. Amazon, iMac, M4, 16GB RAM, 256GB: $1,199 ($100 off, MSRP $1,299) These older models are also discounted: Amazon, M3 iMac, 10-core GPU, 8GB RAM, 256GB: $1,304 ($195 off, MSRP was $1,499 – Clearance) U.K. You can save on each of the models. AO.com: M4 iMac, 8-core GPU, 256GB/16GB RAM, £1,185 (£114 off, RRP £1,299) Amazon: M4 iMac, 10-Core GPU, 256GB/16GB RAM, £1,355 (£144 off, RRP £1,499) Amazon: M4 iMac, 10-Core GPU, 256GB/16GB RAM, £1,535 (£164 off, RRP £1,699) These older models are also discounted: John Lewis, M3 iMac,10-core GPU, 512GB/8GB RAM: £1,493 (£305 off, RRP was £1,799 – Clearance) For even more deals check out our best prices comparison tables in the section below. For the new iMacs launching on November 8, the tables below should populate with prices once on sale. Best iMac M4 deals iMac, M4, 8-core CPU/8-core GPU, 256GB/16GB unified memory, MSRP $1,299/£1,299 Retailer Price $1199 View Deal $1204 View Deal $1299 View Deal $1299 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket iMac, M4, 10-core CPU/10-core GPU, 256GB/16GB unified memory, MSRP $1,499/£1,499 Retailer Price $1389 View Deal $1399 View Deal $1499 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket iMac, M4, 10-core CPU/10-core GPU, 512GB/16GB unified memory, MSRP $1,699/£1,699 Retailer Price $1569 View Deal $1699 View Deal $1699 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best deals on old iMacs While resellers sell off old stock you may be able to pick up some good deals. Just keep in mind that the new iMacs include more RAM and in some places have a lower price than previously. iMac, M3, 8-core CPU, 8-core GPU, 256GB/8GB unified memory, Was $1,299/£1,399 – Discontinued Retailer Price $1039 View Deal $1,097.96 View Deal $1149 View Deal $1149 View Deal $1199 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket iMac, M3, 8-core CPU, 10-core GPU, 256GB/8GB unified memory, Was $1,499/£1,599 – Discontinued New Refurbished Retailer Price $1,199 View Deal $1199 View Deal $1304 View Deal $1399 View Deal $1399 View Deal $1499 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iMac 24-inch Retina (Late 2023) M3 2.8GHz – SSD 256 GB – 8GB $1049 View Deal Price comparison from Backmarket iMac, M3, 8-core CPU, 10-core GPU, 512GB/8GB unified memory, Was $1,699/£1,799 – Discontinued New Refurbished Retailer Price $1,399 View Deal $1399 View Deal $1484 View Deal $1599 View Deal $1599 View Deal $1699 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iMac 24-inch Retina (Late 2023) M3 4.05GHz – SSD 256 GB – 8GB $999 View Deal iMac 24-inch Retina (Late 2023) M3 4.05GHz – SSD 512 GB – 8GB $1099 View Deal iMac 24-inch Retina (Late 2023) M3 3.2GHz – SSD 512 GB – 8GB $1209 View Deal Price comparison from Backmarket Where to buy an iMac You can buy an iMac directly from Apple in the US or at Apple UK, but there are plenty of stores and Apple Premium Resellers around the world that offer discounts on new and old Macs. Some Mac retailers offer great discounts on Apple products and Apple accessories, so you should be able to save a few hundred pounds off some iMac configurations. Beware, though. The Mac listed by the reseller may be an older model than the one Apple currently sells. We’ve seen resellers advertising Macs with money off based on the price they were previously sold at by Apple, even after Apple has started selling a newer Mac at the same price – so the deal often looks better than it actually is. So be careful to check the age and spec of the machine being sold, and don’t automatically assume that it’s current. To get an idea of what the old model should be worth, take a look at Apple’s refurbished store to see what Apple is selling the older version for (and remember that buying from Apple, even if it’s refurbished, will mean you get a full year’s warranty). And for another way to save money on a new Apple product read about how you can trade in old products at Apple and other resellers and get money off. Read: How Apple trade-in works and saves you money. We regularly see Mac-related deals from the following U.K. and U.S. retailers: U.S. Want to buy a iMac from Apple? View the iMac in the Apple Store. Get your education discount: View the iMac in the Apple Education Store View the iMac at Amazon where we often see discounts. View the iMac at B&H Photo. View the iMac at Best Buy. View the iMac at Walmart. You can find the iMac at Adorama here. Looking for other ways to save money. Find out if you can save money buying Apple products from another country. U.K. You can be sure that you are buying a Mac at the correct price at Apple. View the iMac in the Apple Store. Save money if you are a teacher or student. View the iMac in the Apple Education Store. Get a iMac from Amazon where we often see discounts. View the iMac at Amazon View the iMac at AO.com. You may find an iMac at Argos, although we only tend to see deals in conjunction with events like Black Friday. We often see great deals on iMac at EE. View the iMac at Currys, who also frequently offer discounts. View the iMac at Ebuyer. View the iMac at John Lewis, where we often see discounts. You can get an iMac from Laptops Direct here And you may also find discounts on the iMac at Very Apple has a number of Apple Premium Resellers in the UK who stock Macs and also offer other services: KRCS Insight iStore Select Western Computer Jigsaw From time to time, Amazon runs lightning deals, which could get you a discount if you act quickly. If you’ve found that you’re missing out on Amazon’s Lightning deals, which run for just a few hours and offer limited stock, we’d recommend signing up for Amazon’s 30-day free trial of Prime, which will get you access to deals 30 minutes before everyone else. Plus, you’ll get free next-day delivery with the Prime trial, as well as access to Prime Instant Video and more. Sign up for Prime here. Best refurbished iMac deals One of the best places to look for iMac deals all year round is the Apple Refurbished Store. There, you’ll find huge iMac discounts, sometimes even on the latest models. These iMacs have been returned to Apple for various reasons, and then completely revamped for resale. One of the major benefits of buying a refurbished Mac from Apple is that it will come with a one-year warranty so Apple may fix or replace it for free should anything happen to it in that first year. You won’t be able to tell the difference between a refurbished iMac and a brand-new iMac, aside from the box it comes in, which is white to prevent people from buying them and attempting to sell them as new. Find out more about buying a refurbished iMac here. Get a refurbished Mac at Apple's refurbished store (U.S.) Get a refurbished Mac at Apple's refurbished store (U.K.) You can get refurbished Macs from other suppliers too, including the following refurbished MacBook and reconditioned Mac from the resellers listed below: In the U.S.: Apple Amazon Back Market Best Buy Decluttr Gainsaver OWC Mac Of All Trades Refurb.me In the U.K.: Affordable Mac Apple Amazon BackMarket Hoxton Macs Laptops Direct MacFinder Mac 4 Sale Music Magpie Amazon also has a certified refurbished store for Apple products but we would advise against buying any products that are older than five years – most of the products we see on the Amazon refurbished store are unfortunately very old. Another place to look is BackMarket US and BackMarket UK, which sells refurbished Macs and other Apple products. We also recommend Hoxton Macs in the U.K. Best iMac Student Deals If you are a student you can save money with Apple all year round. Read: How to get an Apple student discount. to find out more. Also take a look at when Apple will be running its Back to School deal this year, when you can get a free pair of AirPods with your purchase.

Read more »

Best Mac mini deals this month
Macworld Apple announced new, smaller Mac mini models with M4 and M4 Pro chips in October 2024 and they went on sale on went on sale on Friday, November 8, 2024. This was the first update to the range since January 2023. Read about the new Mac mini here: M4 Mac mini: Everything you need to know. Plus we review the Mac mini M4 Pro here: M4 Pro Mac mini review. It’s not just the smallest Mac, the Mac mini is also Apple’s cheapest Mac, but you don’t have to pay full price–we’ve scoured the web for the best cut-price deals for a Mac mini, so you can save money on a new Mac. If you’d like some help choosing the best Mac for you, read our Mac buying guide where we cover all the models. Best Mac mini deals right now U.S. Amazon, Mac mini, M4, 16GB RAM, 256GB: $579 ($40 off, MSRP $599) Amazon, Mac mini, M4, 16GB RAM, 512GB: $744 ($55, MSRP $799) Amazon, Mac mini, M4 Pro, 24GB, 512GB: $1,369 ($30 off, MSRP $1,399) Amazon, M2 Mac mini, 8GB RAM, 256GB: $499 ($100 off, MSRP $599 – Clearance) U.K. KRCS has already discounted the new iMac and Mac mini, you can save on each of the models. KRCS: M4 Mac mini, 256GB/16GB RAM, £569.05 (£30 off, RRP £599) KRCS: M4 Pro Mac mini, 512GB/24GB RAM, £1,329.05 (£70 off, RRP £1,399) These older models are also discounted, but we’d like to see bigger discounts on the old models. Amazon: M2 Pro Mac mini, 512GB/16GB RAM: £1,199 (£200 off, RRP was £1,399 – Clearance) Amazon: M2 Mac mini, 512GB/8GB RAM: £639 (£210 off, RRP was £849 – Clearance) If you’re looking for an M4 iMac, check out our round-up of the best iMac deals. We also have the best Mac Studio deals. Best M4 Mac mini deals It’s still early days, but if there are discounts on the new Mac mini you will see them below. Alternatively you can buy directly from Apple. Order the Mac mini from Apple (U.S.) Order the Mac mini from Apple (U.K.) M4 Mac mini, 10-core CPU/10-core GPU, 256GB/16GB RAM, MSRP $599/£599 Retailer Price $579 View Deal $589 View Deal $599 View Deal $599 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket M4 Mac mini, 10-core CPU/10-core GPU, 512GB/16GB RAM, MSRP $799/£799 Retailer Price $779 View Deal $799 View Deal $799 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket M4 Mac mini, 10-core CPU/10-core GPU, 512GB/24GB RAM, MSRP $999/£999 Retailer Price $999 View Deal $999 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best M4 Pro Mac mini deals M4 Pro Mac mini, 12-core CPU/16-core GPU, 512GB/24GB RAM, MSRP $1,399/£1,399 Retailer Price $1399 View Deal $1399 View Deal $1399 View Deal $1399 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best deals on old Mac mini models There are new models but this may mean you can find a good deal on the previous generation. Just keep in mind that the older Mac mini had lass RAM as standard – 8GB rather than 16GB. M2 Pro Mac mini, 512GB/16GB RAM (MSRP: $1,299/£1,399) New Refurbished Retailer Price $1099 View Deal $1199 View Deal $1199 View Deal $1239 View Deal $1,259.31 View Deal $1299 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Mac Mini (January 2023) M2 Pro 3.49 GHz – SSD 512 GB – 16GB $929 View Deal Price comparison from Backmarket M2 Mac mini, 256GB/8GB RAM (MSRP: $599/£649) New Refurbished Retailer Price $499 View Deal $499 View Deal $499 View Deal $599 View Deal $599 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Mac mini (January 2023) M2 3.49 GHz – SSD 256 GB – 8GB $439.44 View Deal Price comparison from Backmarket M2 Mac mini, 512GB/8GB RAM (MSRP: $799/£849) New Refurbished Retailer Price $499 View Deal $549 View Deal $599 View Deal $699 View Deal Apple $799 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Mac mini (January 2023) M2 3.49 GHz – SSD 512 GB – 8GB $459 View Deal Price comparison from Backmarket Best M1 Mac mini deals M1 Mac mini, 256GB/8GB RAM (MSRP WAS: $699/£699) New Refurbished Retailer Price $465.49 View Deal $499 View Deal $549 View Deal $699 View Deal Price comparison from over 24,000 stores worldwide Product Price Mac mini (Late 2020) M1 3.2 GHz – SSD 512 GB – 8GB $387.09 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 256 GB – 8GB $390.97 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 256 GB – 16GB $422.67 View Deal Mac mini (October 2020) M1 3.2 GHz – SSD 256 GB – 8GB $425 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 256 GB – 8GB $435.90 View Deal Mac mini (September 2020) M1 3.2 GHz – SSD 256 GB – 8GB $435.90 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 512 GB – 16GB $514.25 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 512 GB – 8GB $519 View Deal Mac mini (Late 2020) M1 3.2 GHz – SSD 1 TB – 16GB $530 View Deal Mac mini (October 2020) M1 3.2 GHz – SSD 1 TB – 8GB $550 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 2 TB – 8GB $625 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 2 TB – 16GB $775 View Deal Mac mini (November 2020) M1 3.2 GHz – SSD 1 TB – 16GB $829 View Deal Mac Mini (October 2020) M1 3.2 GHz – SSD 1 TB – 16GB $1000 View Deal Price comparison from Backmarket View more prices Where to buy the Mac mini Mac mini buyers in the U.S. can check out the following stores: Apple Amazon Best Buy BH Photo Video Costco Looking for other ways to save money. Find out if you can save money buying Apple products from another country. If you’re based in the U.K. you can pick up a Mac mini from the following retailers: Apple Amazon Argos Currys John Lewis Very Apple has a number of Apple Premium Resellers in the UK who stock Macs and offer other services: KRCS Insight iStore Select Western Computer Jigsaw You might also be able to trade in your old Mac to get some money off your new purchase. Here’s how to get money off with Apple’s trade-in program. Best refurbished Mac mini deals One of the best places to look for Mac mini deals all year round is the Apple Refurbished Store. There, you’ll find discounts on Mac mini that have been returned to Apple for various reasons, and then completely revamped for resale. If you buy a refurbished Mac mini from Apple it will come with a one-year warranty so Apple may fix or replace it for free should anything happen to it in that first year. In the U.S.: Get a refurbished Mac at Apple's refurbished store (U.S.) In the U.K.: Get a refurbished Mac at Apple's refurbished store (U.K.) You can get refurbished Macs from other suppliers too, including the following refurbished resellers listed below: In the U.S.: Apple Amazon Back Market Best Buy Decluttr Gainsaver OWC Mac Of All Trades Refurb.me In the U.K.: Affordable Mac Apple Amazon BackMarket Hoxton Macs Laptops Direct MacFinder Mac 4 Sale Music Magpie Amazon also has a certified refurbished store for Apple products but we would advise against buying any products that are older than five years – most of the products we see on the Amazon refurbished store are unfortunately very old. Another place to look is BackMarket US and BackMarket UK, which sells refurbished Macs and other Apple products. We also recommend Hoxton Macs in the U.K. Find the latest Apple refurbished deals here. We also have this advice about buying a refurbished Mac.

Read more »

The best AirPods deals this month
Macworld Apple’s AirPods wireless headphones offer an iconic look, exceptional convenience, and strong audio quality. They come with a premium price tag, however, so it’s important to shop around for a good deal… or find a bunch of tech experts who’ll do this for you. That’s where we come in. In this article, we round up the best AirPods discounts and deals to help you save money. We’ve got the best prices on the 4th-gen AirPods, the 2nd-gen AirPods Pro with USB-C, and the premium AirPods Max over-ear headphones which Apple has updated to use USC-C rather than Lightning. Below you will find links to the best deals available right now. You’ll find more detailed advice and price comparisons for each model further down. Before you buy note the following: AirPods 4 and AirPods 4 with ANC were introduced in September 2024. The AirPods 4 start at $129/£129 with the ANC model costing $179/£179. With this in mind do not buy the AirPods 3 or AirPods 2 if they aren’t considerably cheaper than $129/£129. The AirPods Max with Lightning were discontinued in favor of the AirPods Max with USB-C. In this case if you do see the older models on sale they are worth buying at a good discount. The AirPods Pro are often on sale right now as they are likely to be updated later in 2025. They are still a good purchase and recently gained the ability to work as hearing aid thanks to a software updated. U.S. Amazon, AirPods Pro 2 (USB-C case): $170 ($79 off, MSRP $249) Amazon, AirPods 4: $119 ($10 off, MSRP $129) Amazon, AirPods 4 with ANC: $169 ($10 off, MSRP $179) Amazon, AirPods Max (USB-C): $529 ($20 off, MSRP $549) Amazon, AirPods Max (Lightning): $469 ($80 off; MSRP $549 – Clearance) U.K. Argos, AirPod Max, Lightning, 2020: £429 (£70 off, RRP was £499 – Clearance) Amazon, AirPods Pro 2 (USB-C case): £170 (£59 off, MSRP £229) You can check the automated price comparison tables below to see if any retailers have dropped their prices since we last updated this article. How much do AirPods cost? Some changes were announced at Apple’s September 2024 event, so make sure you’re up to date with the latest prices: AirPods Max (2024): $549 / £499 (price dropped from £549 to £499 in September 2023) AirPods Pro with USB-C (2nd gen, 2023): $249 / £229 AirPods 4: $129 / £129 AirPods 4 (with ANC): $179 / £179 Discontinued: 3rd-gen AirPods with Lightning (2021): was $169 / £169 3rd-gen AirPods with MagSafe (2021): was $179 / £179 2nd-gen AirPods (2019): was $129 / £129 You should never pay more than the prices above: we’ve seen unscrupulous retailers claim the MSRP/RRP is higher and work out ‘savings’ based on that. Remember to take delivery and postage fees into account when evaluating deals; we include it in our list of prices but most retailers won’t add it until you’re at the checkout. And watch out for deals that seem too good to be true, but turn out to have no stock. We see this a lot. Good AirPods deals are rare and tend not to last long. If you see one (and you’re sure the supplier is legit: look it up on TrustPilot if you’ve not bought from there before), grab it. Best new AirPods deals Apple sells two sets of basic (non-Pro) AirPods, both introduced at the 2024 Glowtime event: the 4th-gen model with active noise cancellation, and the 4th-gen model without. Best Buy is worth a look for some worthwhile savings in the U.S., while U.K. customers can save a little money across the range. You can buy the 4th-gen AirPods directly from Apple, but you’ll find the best prices elsewhere in the automated tables below. AirPods (4th gen, 2024, with ANC) deals These replace the AirPods (3rd generation) and have a redesigned, smaller USB-C case that works with wireless charging and now has Find My functionality, with a built-in speaker for locating the device. They feature active noise cancellation, previously found only on the AirPods Pro and Max, and sport Apple’s H2 chip, which was introduced in the 2022 AirPods Pro and improves audio quality. MSRP: $179/£179 New Refurbished Retailer Price $138.99 View Deal $169.99 View Deal $179 View Deal $179 View Deal $179 View Deal $179 View Deal $179.99 View Deal $179.99 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Apple AirPods 4th gen (2024) – Wireless (USB-C) Charging case $179 View Deal Price comparison from Backmarket AirPods (4th gen, 2024, without ANC) deals Whereas the ANC AirPods 4 replace the 3rd-gen AirPods, these replace the 2nd-gen AirPods. They feature most of the features of the higher-priced model with the main exception of Active Noise Cancelation, Transparency Mode, and Adaptive Audio. MSRP: $129/£129 Retailer Price $119 View Deal $119.99 View Deal $129 View Deal $129 View Deal $129.99 View Deal $129.99 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket Best AirPods Pro deals The 2nd-gen version of the AirPods Pro was released in September 2022. Rather than introduce the third generation in 2023, Apple instead tweaked them to support USB-C for charging (including charging via the iPhone 15) The Lightning models have now been discontinued, but will be available from other retailers for a while; make sure you’re getting the exact model you want. AirPods Pro (2nd gen, 2023, USB-C) deals This is the 2023 version with USB-C charging. You can also use an iPhone 15 to charge the case. MSRP: $249 / £229 Retailer Price $194.5 View Deal $249 View Deal $297.50 View Deal Price comparison from over 24,000 stores worldwide Product Price Price comparison from Backmarket Best AirPods Max deals The AirPods Max, Apple’s wireless over-ear headphones, are available to buy directly from Apple for $549 / £499 (they were £549 in the U.K. before September 2023 when Apple dropped the price to £499). Best AirPods Max (2024, USB-C) deals The AirPods Max haven’t exactly been updated for 2024, beyond a new set of colors and USB-C instead of Lightning. These are still effectively the same as the 2020 models. It may still be possible to buy old models in the original colors for some time so we have included the best prices for the older model in the discontinued section of this article. Find the latest prices in our automated table embedded below. MSRP: $549/£499 Retailer Price $449.99 View Deal $529 View Deal $529 View Deal $529.99 View Deal $547 View Deal $549 View Deal $549 View Deal $549.99 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket Discontinued AirPods deals One way to pick up a really good deal can be to buy discontinued AirPods which are often the first to be discounted. AirPods (3rd gen, 2021, MagSafe) deals Apple updated the ultra-popular AirPods in October 2021, after a wait of more than two and a half years. They were eventually discontinued in September 2024. Get all the info you need in our AirPods 3 review. MSRP was: $179 / £179 (DISCONTINUED) New Refurbished Retailer Price $152.95 View Deal $169.99 View Deal $169.99 View Deal $179.99 View Deal $199.99 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Apple AirPods 3rd gen (2021) – MagSafe Charging case $102 View Deal Price comparison from Backmarket AirPods (3rd gen, 2021, Lightning) deals There was also a cheaper version of the AirPods 3rd generation with a case that has to be charged via Lightning, rather than wirelessly. MSRP was: $169 / £169 (DISCONTINUED) New Refurbished Retailer Price $149 View Deal $149.99 View Deal $154.95 View Deal $159.99 View Deal $169.49 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Apple AirPods 3rd gen (2021) – Lightning Charging case $108.84 View Deal Price comparison from Backmarket AirPods (2nd gen, 2019) deals This older version of the AirPods was sold by Apple until September 2024, and may still be found at other retailers. Note that this version of the AirPods comes with an Lightning charging case that needs to be plugged in, as opposed to the wireless MagSafe charging case. Check the automated table below for the latest deals. MSRP was: $129 / £129 (DISCONTINUED) New Refurbished Retailer Price $13.49 View Deal $129 View Deal $131.48 View Deal Price comparison from over 24,000 stores worldwide Product Price Apple AirPods 2nd gen (2019) – Lightning Charging case $108.84 View Deal Price comparison from Backmarket AirPods Pro (2nd gen, 2022, Lightning) deals This is the older version with a Lightning port for charging the case. You may still find them on sale. MSRP was $249 / £249 (DISCONTINUED) New Refurbished Retailer Price $199 View Deal $219 View Deal $245.99 View Deal $279.99 View Deal Price comparison from over 24,000 stores worldwide Product Price Apple AirPods Pro 2nd gen (2022) – MagSafe (Lightning) Charging case $160.62 View Deal Price comparison from Backmarket AirPods Max (2020, Lightning) deals This is the older version of the original AirPods Max came in different colors and featured Lightning (rather then USB-C in the newer models). You may still find them on sale. MSRP was: $549/£499 New Refurbished Retailer Price $399 View Deal $403.95 View Deal $469 View Deal $477 View Deal $479.99 View Deal $495 View Deal $549 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Apple AirPods Max (2020) – Space Gray $392 View Deal Apple AirPods Max (2020) – Silver $399.12 View Deal Apple AirPods Max (2020) – Sky blue $454.99 View Deal Price comparison from Backmarket For an in-depth look at your options here, read Where to buy AirPods Max. Other ways to save: AirPods Bundle deals The best way to get a good price on AirPods may be to bundle them with a phone, although this is mainly an option in the U.K. Phone network Three offers a variety of bundles that include the AirPods. Visit the company’s accessories page to browse the best options for you. Vodafone and O2 aren’t currently bundling the AirPods with their iPhone plans, although O2 sells the 2021 AirPods, the early-2019 AirPods and the 2022 AirPods Pro on their own. Whichever bundle you go for, remember to check if you’re getting the AirPods Pro, the early-2019 AirPods (sometimes called the second gen or AirPods 2) or the new 2021 AirPods (third-gen or AirPods 3). If you’re getting the AirPods Pro, find out if they include the new MagSafe charging case. AirPods buying advice Wondering if a pair of AirPods is right for you? We have a guide to the Best AirPods, and you could read AirPods Pro vs AirPods to find out how the models compare, but let’s quickly discuss the pros and cons. Apple has launched various AirPods versions, several of which are still on sale: 2016: 1st-gen AirPods, discontinued 2019: 2nd-gen AirPods, discontinued 2019: 1st-gen AirPods Pro, discontinued 2021: 3rd-gen AirPods, Lightning and Magsafe variants, discontinued 2022 & 2023: 2nd-gen AirPods Pro, Lightning and USB-C variants 2020 & 2024: AirPods Max All four non-Max models are wireless, sitting in your ears and in theory staying there through snugness of fit alone. The advantages of this are clear–they allow you to go running or work out without worrying about snagging the cables–but they may fall out once you pick up the pace. Our experience, however, is that the AirPods are among the best earbuds around in this regard. The AirPods Pro offer a snugger fit than the others because they have a choice of flexible ear tips, and are actually able to tell you whether you’ve selected the right tip or not. Sound quality is decent but not exceptional on the original and early-2019 models; the 2021 3rd gen AirPods were better, while the AirPods Pro are a step above thanks in part to their better fit and implementation of active noise cancellation. What AirPods consistently do better than non-Apple headphones is coordinate with other Apple products, thanks to the W1 chip (in the 2016 model) and H1 chip (2019 and 2021) which makes pairing with an iPhone a breeze. Battery-wise, most non-Max AirPods will last around five hours, but that’s not the end of the story: they come with a little charging case with its own larger battery, so you can pop them back in for a quick charge. The case should offer another 24 hours (give or take) before it’ll require charging. The 2021 AirPods, however, offer more in this department, with claimed figures of six hours out of the case and 30 hours in total. We’ve got some advice on getting better AirPods battery life. Apple’s 2nd gen AirPods can respond to Hey Siri commands, charge wirelessly if you opt for the Wireless Charging Case, and offer more talk time than the originals. Those features are kept in the 2021 3rd-generation models, with Spatial Audio and Adaptive EQ added to the mix. The 4th generation AirPods arrived in 2024 and add ANC to the mix. The AirPods Max are over-ear headphones and essentially a completely different product to the rest of the AirPods range. They are a lot more expensive and a totally different proposition to the other AirPods. Audio quality is almost universally considered to be exceptional, but it’s debatable whether it’s exceptional enough to justify that premium price tag. And many reviewers have pointed out that the case is oddly designed, given that the one part of the headphones that it doesn’t protect–the mesh headband–is the one that’s most vulnerable to damage.The AirPods Max are an appealing prospect, but may not be practical for most budgets. For more detailed advice and thoughts on the best alternatives to Apple’s three cheaper AirPods models, read our guides to the Best wireless earbuds and the best wired headphones.

Read more »

Norway gets world's first Apple Pay alternative for iPhone
A Norwegian firm has become the first to take advantage of the EU law that required Apple to allow Apple Pay rivals to use its iPhone NFC technology.Tap to Vipps works exactly the same way that Apple Pay does — image credit: Vipps MobilePayAs per the requirements of the EU's Digital Markets Act, Apple has been adding APIs to allow rivals to use its iPhone NFC in their digital wallet and banking apps. Now users of Vipps MobilePay in Norway can simply elect to use that service instead of Apple Pay."We have fought for years to be able to compete on equal footing with Apple," said Rune Garborg, CEO of Vipps MobilePay, in a blog post, "and it feels almost surreal to finally be able to launch our very own solution." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Say hello to Samsung’s suspiciously familiar new phone OS
Macworld There are only so many ways you can improve a smartphone, and these days the major manufacturers’ flagship handsets are pretty evenly matched. The difference lies in the software. We iPhone users swear by iOS, and why not? It’s better than Android. (Angry emails to the usual address.) Mobile operating systems, of course, are already trending towards similarity, much like the hardware they run on. Apple and Google frequently adopt each other’s OS features, and that can only be a good thing for the customer. Nobody wants app offloading or RCS support to be a platform exclusive. These aren’t game consoles. But there’s a difference between the free marketplace of ideas and blatant imitation, and Apple’s rivals have been known to adopt, not one or two general concepts, but its entire way of doing things. Occasionally the mimicry is so uncanny that one would almost suspect they’re trying to trick customers into thinking they’re holding an iPhone when they’re not. Of course, that can’t possibly be the case. But you do wonder… Last week, Samsung announced the release of its One UI 7 mobile OS in public beta, and to say that it looks a lot like iOS 18, from the arrangement of onscreen elements to the overall design language, would be an understatement. The leaker Ice Universe loaded up matching wallpapers on two handsets for a direct comparison and the results are astonishing. The key here is to understand the difference between ideas and execution. As you can see above, iOS 18 and One UI 7 both have Now Playing music widgets on the lock screen, for example, and that’s perfectly reasonable; whoever thought of it first, it’s fair for the idea to be adopted by other companies in time. But for the widgets to be rendered in such a similar way, achieving such a similar look, is where the imitation becomes hard to justify. It starts to stray closer and closer to the legal concept of passing off. Control Center (right) and something that looks an awful lot like Control Center.Ice Universe One UI 7’s equivalent of Control Center is jarringly familiar, too: a grid of semi-transparent grey circles and squircles with white sans serif text labels. And its camera interface, which isn’t shown in Ice Universe’s comparison but can be seen in Samsung’s official announcement article, has been pretty much Xeroxed (perhaps an unfortunate verb to use, given Apple’s own history of imitation) from the same function in iOS. At least pretend to be doing your own thing, guys. Ultimately, perhaps, we might wonder whether this sort of thing matters. Eventually the smartphone will become fully commoditized, if it hasn’t been already, and products will compete on price and the general appearance of quality rather than on unique and identifiable characteristics. Buying a smartphone will start to feel a bit like buying a potato, only with slightly higher stakes. It’s also understandable that companies with a generic brand, like Samsung, will be happier to see that future arrive than those like Apple with a strong and carefully cultivated aesthetic. Even so, it does make me wonder if Samsung has thought this through properly. Yes, Apple has the most to lose if all the mobile OSes become indistinguishable. But Samsung is still a premium brand, even if it isn’t exactly known for its originality, and it might be surprised by how little customers are willing to spend on a smartphone, and how rarely they’ll be inclined to upgrade, if they realise that one handset is pretty much the same as another. Foundry Welcome to our weekly Apple Breakfast column, which includes all the Apple news you missed last week in a handy bite-sized roundup. We call it Apple Breakfast because we think it goes great with a Monday morning cup of coffee or tea, but it’s cool if you want to give it a read during lunch or dinner hours too. Trending: Top stories Jason Snell explains why he’s done with desktop Macs. Apple was more fun when it was small enough to ignore. Shock report: The foldable market really needs Apple to make a folding iPhone. TV or not, Apple is coming to save the smart home. Halyna Kubiv picks out four features the iPhone should steal from Google’s Pixel 9. A long-time rumor about a rare Macintosh blunder has finally been proven true. This Kickstarter revives the Touch Bar as an OLED strip that can go anywhere. Intrepid DIY project turns the new Mac mini into a retro Power Mac M4 Cube. Podcast of the week The Apple TV+ service recently had its fifth anniversary, so on the latest episode of the Macworld Podcast, we talk about Apple’s foray into the entertainment streaming industry. What has the experience been, what can we expect in the future, and, of course, what are our favorite shows. You can catch every episode of the Macworld Podcast on Spotify, Soundcloud, the Podcasts app, or our own site. Reviews corner BenQ MA270U review: A display with good looks, great image quality. Box review: A great cloud storage solution for enterprise. Get Backup Pro review: Create backups and sync your data. Onyx review: A must-have Mac utility. Anker MagGo 3-in-1 Folding Wireless Charging Station review: Pocket power rocket. Best Mac cleaner software: Boost performance and disk space. The rumor mill Wild Apple patent hints at an iPhone with multiple customizable action buttons. The iPad Pro is tapped to get the M5 chip before the Mac (again). Will it ever arrive? Apple’s HomePod with a screen reportedly delayed again. Software updates, bugs, and problems iOS 18.2: These great non-AI features are coming soon to your iPhone. If you’re using WhatsApp on an older iPhone, you’ll need to upgrade soon. And with that, we’re done for this week’s Apple Breakfast. If you’d like to get regular roundups, sign up for our newsletters. You can also follow us on Facebook, Threads, or Twitter for discussion of breaking Apple news stories. See you next Monday, and stay Appley.

Read more »

Apple Stores coming to Saudi Arabia for the first time
Apple has announced a massive retail expansion in the Kingdom of Saudi Arabia, including flagship stores, as well as an Apple Developer Academy.Saudi Arabia — image credit: US Department of State"We're excited to be expanding here in Saudi Arabia with the launch of the Apple Store online next year," said Tim Cook, Apple's CEO, in a statement, "and the first of several flagship Apple Store locations starting in 2026, including an iconic store at the stunning site of Diriyah coming later.""Our teams are looking forward to deepening our connections with customers," he continued, "and to bringing the best of Apple to help people across this country explore their passions, build their businesses, and take their ideas to the next level." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Hate the new iOS 18 Photos app? Here’s how to fix it in a few taps
Macworld One of the biggest new features of iOS 18 is a completely redesigned Photos app. Apple calls it the “biggest redesign ever,” and the massive changes have been quite contentious, to put it mildly. Many users have expressed frustration with the new layout, complaining about missing features (some of which aren’t really missing) and difficulty finding what they’re looking for. You don’t need to look hard to see what’s different. Where the old Photos app had four tabs at the bottom of the interface (Library, For You, Albums, and Search) the new interface is tab-free, placing all of your content on a vertically scrolling page. There’s no way to revert to the old iOS 17 Photos app, but with these tweaks you can make the new design a lot more usable. Your Photo Library is still there The top half of the main Photos screen contains your entire photo library. It’s not totally intuitive, but you need to scroll upward to go back in time and see what’s not visible on the screen. As you scroll, you’ll see three options—Years, Months, or All—which lets you quickly access a specific time period. You can also tap the button with up and down arrows on the left to change the view. Here you can sort by Recently Added or Date Captured, change how many photos are in a row, eliminate screenshots from the main view, and filter be various categories, including Favorites, Photos, and Videos. Your Albums are still there too The new Photos app prioritizes smart Collections, which are auto-generated albums that populate on their own. However, if you scroll down to the very bottom of the screen, you’ll find your Albums from the old app. You can either swipe left or tap the right arrow icon to see them all. To create a new album tap the right arrow and press Create on the window that pops up. To edit on existing album, tap and hold on any album name to see a list of options. You can customize and reorder everything Now that you know where things are, let’s get to fixing it. The bottom half of the Photos app contains a bunch of categories, some of which are unfamiliar or organized differently. You probably don’t want them all cluttering up your view and good news, you don’t have to keep them there. At the very bottom of the main page you’ll find a large Customize & Reorder button, which is a one-stop shop for making the Photos app what you want it to be. Tap it and you’ll see a list of the categories and collections that are currently visible on your main page. It’s simple—click the ones you don’t want to see to remove the blue check. Then, use the little bars on the right to drag them into the order you want them. You’re not actually removing any data here, just choosing which major sections you want on that big vertically-scrolling front page and in which order. Trimming the interface down to just the parts you want is the single biggest thing you can do to making the new Photos app more enjoyable. Foundry Pinned Collections are very customizable One of the biggest changes in the Photos app is the prominence of Pinned Collections, which are groups of photos of a certain type, such as screenshots, selfies, locations, or specific people or pets. You can swipe the Pinned Collections row to scroll through them. But you don’t need to stick to the ones Apple chooses. to get the most out of Pinned Collections, you’ll want to customize it. Tap Modify and you can choose which Collections to include on the main page, as well as reorder the list using the little bar on the right. You can also pin your own albums. Scroll to the bottom of the Modify page and you’ll see an option to add any Collection or Album. If you keep going back to this one custom Album you’ve had for years, or always look at pictures of your pet Fluffy, you can add those specific things to your Pinned Collections list and drag it right to the top spot. Foundry There are more settings in your Apple ID profile pic In the top right corner of the main screen, you’ll see two icons: Search and your Apple ID profile picture. Tap your image to several options, including the iCloud sync status, which is no longer shown on the main Photos window. Explore this page and you’ll find several useful options. You can choose whether you want the main Photos view to show shared albums or your hidden albums, if videos should loop, whether you want to see automatically-generated stuff like Featured Content and Holiday Events, and so on. This is also where you’ll reset suggestions for People & Pets or Memories, if you feel like the AI has gone off track. Foundry

Read more »

U.S. Offered $10M for Hacker Just Arrested by Russia
In January 2022, KrebsOnSecurity identified a Russian man named Mikhail Matveev as "Wazawaka," a cybercriminal who was deeply involved in the formation and operation of multiple ransomware groups. The U.S. government indicted Matveev as a top ransomware purveyor a year later, offering $10 million for information leading to his arrest. Last week, the Russian government reportedly arrested Matveev and charged him with creating malware used to extort companies.

Read more »

Why Phishers Love New TLDs Like .shop, .top and .xyz
Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) -- such as .shop, .top, .xyz -- that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees the domain name industry is moving forward with plans to introduce a slew of new gTLDs.

Read more »

Vulnerability Summary for the Week of November 25, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Portfolio Management System MCA  A vulnerability has been found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /register.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-26 7.3 CVE-2024-11744 1000 Projects--Portfolio Management System MCA  A vulnerability classified as critical was found in 1000 Projects Portfolio Management System MCA 1.0. This vulnerability affects unknown code of the file /forgot_password_process.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-27 7.3 CVE-2024-11819 1000projects -- beauty_parlour_management_system  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/edit-services.php. The manipulation of the argument sername leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11646 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, has been found in 1000 Projects Beauty Parlour Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11647 1000projects -- beauty_parlour_management_system  A vulnerability, which was classified as critical, was found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/add-customer.php. The manipulation of the argument name leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11648 1000projects -- beauty_parlour_management_system  A vulnerability has been found in 1000 Projects Beauty Parlour Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/search-appointment.php. The manipulation of the argument searchdata leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-25 7.3 CVE-2024-11649 AbsolutePlugins--Absolute Addons For Elementor  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AbsolutePlugins Absolute Addons For Elementor allows Local Code Inclusion.This issue affects Absolute Addons For Elementor: from n/a through 1.0.14. 2024-11-28 7.5 CVE-2024-52496 Advantech--EKI-6333AC-2G  A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (securityEngineID to local_record.engineid without proper bounds checking. 2024-11-27 3 CVE-2024-36468 Zabbix--Zabbix  When the webdriver for the Browser object downloads data from a HTTP server, the data pointer is set to NULL and is allocated only in curl_write_cb when receiving data. If the server's response is an empty document, then wd- >data in the code below will remain NULL and an attempt to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42328 Zabbix--Zabbix  The webdriver for the Browser object expects an error object to be initialized when the webdriver_session_query function fails. But this function can fail for various reasons without an error description and then the wd- >error will be NULL and trying to read from it will result in a crash. 2024-11-27 3.3 CVE-2024-42329 Zabbix--Zabbix  In the src/libs/zbxembed/browser.c file, the es_browser_ctor method retrieves a heap pointer from the Duktape JavaScript engine. This heap pointer is subsequently utilized by the browser_push_error method in the src/libs/zbxembed/browser_error.c file. A use-after-free bug can occur at this stage if the wd- >browser heap pointer is freed by garbage collection. 2024-11-27 3.3 CVE-2024-42331 Zabbix--Zabbix  The researcher is showing that due to the way the SNMP trap log is parsed, an attacker can craft an SNMP trap with additional lines of information and have forged data show in the Zabbix UI. This attack requires SNMP auth to be off and/or the attacker to know the community/auth details. The attack requires an SNMP item to be configured as text on the target host. 2024-11-27 3.7 CVE-2024-42332 Zabbix--Zabbix  When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding sysmapelementurlid + 1. This action prevents others from adding URLs to the map element. 2024-11-26 2.2 CVE-2024-22117 Zabbix--Zabbix  When exporting media types, the password is exported in the YAML in plain text. This appears to be a best practices type issue and may have no actual impact. The user would need to have permissions to access the media types and therefore would be expected to have access to these passwords. 2024-11-27 2.7 CVE-2024-36464 Zabbix--Zabbix  The researcher is showing that it is possible to leak a small amount of Zabbix Server memory using an out of bounds read in src/libs/zbxmedia/email.c 2024-11-27 2.7 CVE-2024-42333 Back to top Severity Not Yet Assigned PrimaryVendor -- Product Description Published CVSS Score Source Info autolab--Autolab  Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the download_all_submissions feature. This can allow for leakage of submissions to unauthorized users, such as downloading submissions from other students in the class, or even instructor test submissions, given they know their user IDs. This issue has been patched in commit `1aa4c769` which is not yet in a release version, but is expected to be included in version 3.0.3. Users are advised to either manually patch or to wait for version 3.0.3. As a workaround administrators can disable the feature. 2024-11-25 not yet calculated CVE-2024-53258 BoidCMS--BoidCMS  BoidCMS is a free and open-source flat file CMS for building simple websites and blogs, developed using PHP and uses JSON as a database. In affected versions a reflected Cross-site Scripting (XSS) vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This code could be used to steal the user's session cookie, perform phishing attacks, or deface the website. This issue has been addressed in version 2.1.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-25 not yet calculated CVE-2024-53255 bunkerity--bunkerweb  bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated "next" parameter for redirects. Ex. visiting: `/loading?next=https://google.com` while authenticated will cause the page will redirect to google.com. This vulnerability could be used in phishing attacks by redirecting users from a legitimate application URL to malicious sites. This issue has been addressed in version 1.5.11. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-27 not yet calculated CVE-2024-53264 Century Systems Co., Ltd.--FutureNet NXR-G110 series  FutureNet NXR series routers provided by Century Systems Co., Ltd. have REST-APIs, which are configured as disabled in the initial (factory default) configuration. But, REST-APIs are unexpectedly enabled when the affected product is powered up, provided either http-server (GUI) or Web authentication is enabled. The factory default configuration makes http-server (GUI) enabled, which means REST-APIs are also enabled. The username and the password for REST-APIs are configured in the factory default configuration. As a result, an attacker may obtain and/or alter the affected product's settings via REST-APIs. 2024-11-29 not yet calculated CVE-2024-50357 Checkmk GmbH--Checkmk  Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions type] may result in an out-of-bounds access. To spot such missed invocations early in the future, checking the validity of link- >type in bpf_link_show_fdinfo() and emitting a warning when such invocations are missed. 2024-11-25 not yet calculated CVE-2024-53099 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: tcp: avoid race between queue_lock lock and destroy Commit 76d54bf20cdc ("nvme-tcp: don't access released socket during error recovery") added a mutex_lock() call for the queue- >queue_lock in nvme_tcp_get_address(). However, the mutex_lock() races with mutex_destroy() in nvme_tcp_free_queue(), and causes the WARN below. DEBUG_LOCKS_WARN_ON(lock- >magic != lock) WARNING: CPU: 3 PID: 34077 at kernel/locking/mutex.c:587 __mutex_lock+0xcf0/0x1220 Modules linked in: nvmet_tcp nvmet nvme_tcp nvme_fabrics iw_cm ib_cm ib_core pktcdvd nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables qrtr sunrpc ppdev 9pnet_virtio 9pnet pcspkr netfs parport_pc parport e1000 i2c_piix4 i2c_smbus loop fuse nfnetlink zram bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper xfs drm sym53c8xx floppy nvme scsi_transport_spi nvme_core nvme_auth serio_raw ata_generic pata_acpi dm_multipath qemu_fw_cfg [last unloaded: ib_uverbs] CPU: 3 UID: 0 PID: 34077 Comm: udisksd Not tainted 6.11.0-rc7 #319 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 04/01/2014 RIP: 0010:__mutex_lock+0xcf0/0x1220 Code: 08 84 d2 0f 85 c8 04 00 00 8b 15 ef b6 c8 01 85 d2 0f 85 78 f4 ff ff 48 c7 c6 20 93 ee af 48 c7 c7 60 91 ee af e8 f0 a7 6d fd 0b e9 5e f4 ff ff 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 RSP: 0018:ffff88811305f760 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88812c652058 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000001 RBP: ffff88811305f8b0 R08: 0000000000000001 R09: ffffed1075c36341 R10: ffff8883ae1b1a0b R11: 0000000000010498 R12: 0000000000000000 R13: 0000000000000000 R14: dffffc0000000000 R15: ffff88812c652058 FS: 00007f9713ae4980(0000) GS:ffff8883ae180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcd78483c7c CR3: 0000000122c38000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? __warn.cold+0x5b/0x1af ? __mutex_lock+0xcf0/0x1220 ? report_bug+0x1ec/0x390 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x13/0x40 ? asm_exc_invalid_op+0x16/0x20 ? __mutex_lock+0xcf0/0x1220 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx___mutex_lock+0x10/0x10 ? __lock_acquire+0xd6a/0x59e0 ? nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] nvme_tcp_get_address+0xc2/0x1e0 [nvme_tcp] ? __pfx_nvme_tcp_get_address+0x10/0x10 [nvme_tcp] nvme_sysfs_show_address+0x81/0xc0 [nvme_core] dev_attr_show+0x42/0x80 ? __asan_memset+0x1f/0x40 sysfs_kf_seq_show+0x1f0/0x370 seq_read_iter+0x2cb/0x1130 ? rw_verify_area+0x3b1/0x590 ? __mutex_lock+0x433/0x1220 vfs_read+0x6a6/0xa20 ? lockdep_hardirqs_on+0x78/0x100 ? __pfx_vfs_read+0x10/0x10 ksys_read+0xf7/0x1d0 ? __pfx_ksys_read+0x10/0x10 ? __x64_sys_openat+0x105/0x1d0 do_syscall_64+0x93/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? __pfx_ksys_read+0x10/0x10 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on_prepare+0x16d/0x400 ? do_syscall_64+0x9f/0x180 ? lockdep_hardirqs_on+0x78/0x100 ? do_syscall_64+0x9f/0x180 ? do_syscall_64+0x9f/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9713f55cfa Code: 55 48 89 e5 48 83 ec 20 48 89 55 e8 48 89 75 f0 89 7d f8 e8 e8 74 f8 ff 48 8b 55 e8 48 8b 75 f0 4 ---truncated--- 2024-11-25 not yet calculated CVE-2024-53100 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fs: Fix uninitialized value issue in from_kuid and from_kgid ocfs2_setattr() uses attr- >ia_mode, attr- >ia_uid and attr- >ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. 2024-11-25 not yet calculated CVE-2024-53101 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: nvme: make keep-alive synchronous operation The nvme keep-alive operation, which executes at a periodic interval, could potentially sneak in while shutting down a fabric controller. This may lead to a race between the fabric controller admin queue destroy code path (invoked while shutting down controller) and hw/hctx queue dispatcher called from the nvme keep-alive async request queuing operation. This race could lead to the kernel crash shown below: Call Trace: autoremove_wake_function+0x0/0xbc (unreliable) __blk_mq_sched_dispatch_requests+0x114/0x24c blk_mq_sched_dispatch_requests+0x44/0x84 blk_mq_run_hw_queue+0x140/0x220 nvme_keep_alive_work+0xc8/0x19c [nvme_core] process_one_work+0x200/0x4e0 worker_thread+0x340/0x504 kthread+0x138/0x140 start_kernel_thread+0x14/0x18 While shutting down fabric controller, if nvme keep-alive request sneaks in then it would be flushed off. The nvme_keep_alive_end_io function is then invoked to handle the end of the keep-alive operation which decrements the admin- >q_usage_counter and assuming this is the last/only request in the admin queue then the admin- >q_usage_counter becomes zero. If that happens then blk-mq destroy queue operation (blk_mq_destroy_ queue()) which could be potentially running simultaneously on another cpu (as this is the controller shutdown code path) would forward progress and deletes the admin queue. So, now from this point onward we are not supposed to access the admin queue resources. However the issue here's that the nvme keep-alive thread running hw/hctx queue dispatch operation hasn't yet finished its work and so it could still potentially access the admin queue resource while the admin queue had been already deleted and that causes the above crash. This fix helps avoid the observed crash by implementing keep-alive as a synchronous operation so that we decrement admin- >q_usage_counter only after keep-alive command finished its execution and returns the command status back up to its caller (blk_execute_rq()). This would ensure that fabric shutdown code path doesn't destroy the fabric admin queue until keep-alive request finished execution and also keep-alive thread is not running hw/hctx queue dispatch operation. 2024-11-25 not yet calculated CVE-2024-53102 Mozilla--Firefox  The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw, triggered by an invalid or unsupported extension manifest, could have caused runtime errors that disrupted the signature validation process. As a result, the enforcement of signature validation for unrelated add-ons may have been bypassed. Signature validation in this context is used to ensure that third-party applications on the user's computer have not tampered with the user's extensions, limiting the impact of this issue. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5. 2024-11-26 not yet calculated CVE-2024-11696 Mozilla--Firefox  On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authentication. This vulnerability affects Firefox < 133. 2024-11-26 not yet calculated CVE-2024-11703 msg Suisse AG--EasyTax  A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software 2023 1.2 and earlier across multiple platforms, including Windows, Linux, and macOS. 2024-11-29 not yet calculated CVE-2024-9044 n/a--n/a  FFmpeg n6.1.1 is Integer Overflow. The vulnerability exists in the parse_options function of sbgdec.c within the libavformat module. When parsing certain options, the software does not adequately validate the input. This allows for negative duration values to be accepted without proper bounds checking. 2024-11-29 not yet calculated CVE-2024-35366 n/a--n/a  FFmpeg n6.1.1 has an Out-of-bounds Read via libavcodec/ppc/vp8dsp_altivec.c, static const vec_s8 h_subpel_filters_outer 2024-11-29 not yet calculated CVE-2024-35367 n/a--n/a  FFmpeg n7.0 is affected by a Double Free via the rkmpp_retrieve_frame function within libavcodec/rkmppdec.c. 2024-11-29 not yet calculated CVE-2024-35368 n/a--n/a  Ant-Media-Serverv2.8.2 is affected by Improper Output Neutralization for Logs. The vulnerability stems from insufficient input sanitization in the logging mechanism. Without proper filtering or validation, user-controllable data, such as identifiers or other sensitive information, can be included in log entries without restrictions. 2024-11-29 not yet calculated CVE-2024-35371 n/a--n/a  LinkStack 2.7.9 through 4.7.7 allows resourcesviewscomponentsfavicon.blade.php link SSRF. 2024-11-29 not yet calculated CVE-2024-35451 n/a--n/a  A deserialization vulnerability exists in the Stub class of the VarDumper module in Symfony v7.0.3. The vulnerability stems from deficiencies in the original implementation when handling properties with null or uninitialized values. An attacker could construct specific serialized data and use this vulnerability to execute unauthorized code. 2024-11-29 not yet calculated CVE-2024-36610 n/a--n/a  In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle cases where the username or password field of a login request is empty. This flaw could lead to various security risks, including improper authentication logic handling or denial of service. 2024-11-29 not yet calculated CVE-2024-36611 n/a--n/a  Zulip from 8.0 to 8.3 contains a memory leak vulnerability in the handling of popovers. 2024-11-29 not yet calculated CVE-2024-36612 n/a--n/a  FFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while being read in the output thread. 2024-11-29 not yet calculated CVE-2024-36615 n/a--n/a  An integer overflow in the component /libavformat/westwood_vqa.c of FFmpeg n6.1.1 allows attackers to cause a denial of service in the application via a crafted VQA file. 2024-11-29 not yet calculated CVE-2024-36616 n/a--n/a  FFmpeg n6.1.1 has an integer overflow vulnerability in the FFmpeg CAF decoder. 2024-11-29 not yet calculated CVE-2024-36617 n/a--n/a  FFmpeg n6.1.1 has a vulnerability in the AVI demuxer of the libavformat library which allows for an integer overflow, potentially resulting in a denial-of-service (DoS) condition. 2024-11-29 not yet calculated CVE-2024-36618 n/a--n/a  moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. 2024-11-29 not yet calculated CVE-2024-36620 n/a--n/a  moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion. 2024-11-29 not yet calculated CVE-2024-36621 n/a--n/a  In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitization of user input passed via the logfile parameter. 2024-11-29 not yet calculated CVE-2024-36622 n/a--n/a  moby v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes. 2024-11-29 not yet calculated CVE-2024-36623 n/a--n/a  nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. 2024-11-29 not yet calculated CVE-2024-36671 n/a--n/a  MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. 2024-11-29 not yet calculated CVE-2024-45495 n/a--n/a  WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. 2024-12-01 not yet calculated CVE-2024-45520 n/a--n/a  OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /upload route is accessible without authentication, allowing any user to upload files. 2024-11-27 not yet calculated CVE-2024-46054 n/a--n/a  Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the power(uct_int_t x, uct_int_t n) in src/uct_upstream.c. 2024-11-29 not yet calculated CVE-2024-48406 n/a--n/a  Incorrect access control in Adapt Learning Adapt Authoring Tool

Read more »

Hacker in Snowflake Extortions May Be a U.S. Soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues to publicly extort victims. However, this person's identity may not remain a secret for long: A careful review of Kiberphant0m's daily chats across multiple cybercrime personas suggests they are a U.S. Army soldier who is or was recently stationed in South Korea.

Read more »

Feds Charge Five Men in ‘Scattered Spider’ Roundup
Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio.

Read more »

Fintech Giant Finastra Investigating Data Breach
The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world's top 50 banks, notified customers of a potential breach after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company. 

Read more »

Vulnerability Summary for the Week of November 11, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Beauty Parlour Management System  A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 7.3 CVE-2024-11100 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11257 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11258 1000 Projects--Portfolio Management System MCA  A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11256 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47441 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47442 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47443 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-45114 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47450 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47451 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47452 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49507 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49508 adobe -- indesign  InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49509 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47426 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47427 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47428 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47429 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47430 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47431 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47432 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47433 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47434 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49515 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49516 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49517 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49518 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49519 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49520 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49525 Adobe--Adobe Commerce  Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction. 2024-11-12 7.7 CVE-2024-49521 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49526 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49528 Adobe--Photoshop Desktop  Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49514 adonesevangelista -- agri-trading_online_shopping_system  A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout. 2024-11-14 7.5 CVE-2024-50968 algolplus--Advanced Order Export For WooCommerce  The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). 2024-11-13 8.1 CVE-2024-10828 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21974 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21975 AMD--AMD Cloud Manageability Service Software  Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21939 AMD--AMD Management Console  Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21957 AMD--AMD Management Plug-In for SCCM  Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21938 AMD--AMD Provisioning Console (APC) Software  Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21958 AMD--AMD Ryzen AI Software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 8.8 CVE-2024-21976 AMD--AMD Ryzen Master Monitoring SDK  Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21945 AMD--AMD Ryzen Master Utility for Overclocking Control  Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21946 AMD--AMD Software: PRO Edition  Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21937 AMI--AptioV  APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode. 2024-11-12 7.2 CVE-2024-42442 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 9 CVE-2024-51490 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51484 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51485 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL?-?Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.4 CVE-2024-51486 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51487 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the map_id parameter. 2024-11-13 7.2 CVE-2024-50971 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrow_id parameter. 2024-11-13 7.2 CVE-2024-50972 angeljudesuarez -- tailoring_management_system  A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "inccat" to be affected. But it must be assumed "desc", "date", and "amount" are affected as well. 2024-11-11 9.8 CVE-2024-11074 anisha -- job_recruitment  A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11076 anisha -- job_recruitment  A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11077 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 9.8 CVE-2024-11099 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 8.8 CVE-2024-11127 Anthony Carbon--WDES Responsive Mobile Menu  Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through 5.3.18. 2024-11-16 9.8 CVE-2024-52414 Apache Software Foundation--Apache Airflow  Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets. 2024-11-15 7.5 CVE-2024-45784 Apache Software Foundation--Apache CloudStack  Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.5 or 4.19.1.3, or later, which addresses this issue. Additionally, all user-registered KVM-compatible templates can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run the following command on their file-based primary storage(s) and inspect the output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. However, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "nn"; doneFor checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "nn"; done 2024-11-12 8.5 CVE-2024-50386 Apache Software Foundation--Apache Traffic Server  Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue. 2024-11-14 9.1 CVE-2024-50306 Apache Software Foundation--Apache Traffic Server  Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-38479 Apache Software Foundation--Apache Traffic Server  Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-50305 Arttia Creative--Datasets Manager by Arttia Creative  Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative.This issue affects Datasets Manager by Arttia Creative: from n/a through 1.5. 2024-11-14 10 CVE-2024-52375 Autodesk--Installer  A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management. 2024-11-15 7.2 CVE-2024-9500 Avigilon--VideoIQ iCVR HD camera  Avigilon - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-45253 axelkeller--GPX Viewer  The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-13 8.8 CVE-2024-10629 ays-pro--Chartify WordPress Chart Plugin  The Chartify - WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2024-11-14 9.8 CVE-2024-10571 Baxter--Life2000 Ventilation System  The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 10 CVE-2024-48966 Baxter--Life2000 Ventilation System  The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance. 2024-11-14 10 CVE-2024-48967 Baxter--Life2000 Ventilation System  The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48970 Baxter--Life2000 Ventilation System  The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges. 2024-11-14 9.3 CVE-2024-48971 Baxter--Life2000 Ventilation System  The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-48973 Baxter--Life2000 Ventilation System  The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48974 Baxter--Life2000 Ventilation System  There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-9832 Baxter--Life2000 Ventilation System  Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-9834 BdThemes--Instant Image Generator  Unrestricted Upload of File with Dangerous Type vulnerability in BdThemes Instant Image Generator allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through 1.5.4. 2024-11-14 10 CVE-2024-52377 Bigfive--CF7 Reply Manager  Unrestricted Upload of File with Dangerous Type vulnerability in Bigfive CF7 Reply Manager.This issue affects CF7 Reply Manager: from n/a through 1.2.3. 2024-11-16 9.9 CVE-2024-52404 Bikram Joshi--B-Banner Slider  Unrestricted Upload of File with Dangerous Type vulnerability in Bikram Joshi B-Banner Slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through 1.1. 2024-11-16 9.9 CVE-2024-52405 BlackBerry--SecuSUITE  A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege. 2024-11-12 7.3 CVE-2024-51721 Boa web server--Boa web server 0.94.14rc21  Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-47916 Bosch Rexroth AG--IndraDrive FWA-INDRV*-MP*  A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages. 2024-11-13 7.5 CVE-2024-48989 Ciprian Popescu--W3P SEO  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO allows Stored XSS.This issue affects W3P SEO: from n/a before 1.8.6. 2024-11-14 7.1 CVE-2024-51684 Cisco--Cisco BroadWorks  A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting does not occur for certain incoming TCP connections. An attacker could exploit this vulnerability by sending a high rate of TCP connections to the server. A successful exploit could allow the attacker to cause TCP connection resources to grow rapidly until the Cisco BroadWorks Network Server becomes unusable.Note: To recover from this vulnerability, either Cisco BroadWorks Network Server software must be restarted or the Cisco BroadWorks Network Server node must be rebooted. For more information, see the section of this advisory.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.6 CVE-2023-20125 Cisco--Cisco Cyber Vision  A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.5 CVE-2022-20685 Cisco--Cisco Industrial Network Director  A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITYSYSTEM on the underlying operating system of an affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 9.9 CVE-2023-20036 Cisco--Cisco IOS XR Software  A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root. 2024-11-15 8.8 CVE-2022-20655 Cisco--Cisco Modeling Labs  A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerability, the attacker would need valid user credentials that are stored on the associated external authentication server.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. 2024-11-15 9.1 CVE-2023-20154 Cisco--Cisco Redundancy Configuration Manager  A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container.This vulnerability exists because the debug mode is incorrectly enabled for specific services. An attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled. A successful exploit could allow the attacker to execute arbitrary commands as the root user.The attacker would need to perform detailed reconnaissance to allow for unauthenticated access. The vulnerability can also be exploited by an authenticated attacker.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.1 CVE-2022-20649 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.  The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic.Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.4 CVE-2022-20814 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.  2024-11-15 7.4 CVE-2022-20853 Citrix Session Recording--Citrix Session Recording  Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server 2024-11-12 8.8 CVE-2024-8069 Clarisse K.--Writer Helper  Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper allows Upload a Web Shell to a Web Server.This issue affects Writer Helper: from n/a through 3.1.6. 2024-11-16 9.9 CVE-2024-52399 cli--cli  The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. 2024-11-14 8 CVE-2024-52308 cmorillas1--External Database Based Actions  The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator. 2024-11-15 7.5 CVE-2024-10311 cmsMinds--Boat Rental Plugin for WordPress  Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through 1.0.1. 2024-11-14 10 CVE-2024-52376 code-projects--Job Recruitment  A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11241 codeSavory--BasePress Migration Tools  Unrestricted Upload of File with Dangerous Type vulnerability in codeSavory BasePress Migration Tools allows Upload a Web Shell to a Web Server.This issue affects BasePress Migration Tools: from n/a through 1.0.0. 2024-11-16 9.9 CVE-2024-52407 craftcms--cms  Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5. 2024-11-13 8.4 CVE-2024-52291 craftcms--cms  Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8. 2024-11-13 7.7 CVE-2024-52292 craftcms--cms  Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3. 2024-11-13 7.2 CVE-2024-52293 creativeinteractivemedia--Real3D Flipbook Lite 3D FlipBook, PDF Viewer, PDF Embedder  The 3D FlipBook, PDF Viewer, PDF Embedder - Real 3D FlipBook WordPress Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-16 8.8 CVE-2024-9849 cyberlord92--Login using WordPress Users ( WP as SAML IDP )  The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2024-11-16 7.2 CVE-2024-9887 Dang Ngoc Binh--Audio Record  Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record allows Upload a Web Shell to a Web Server.This issue affects Audio Record: from n/a through 1.0. 2024-11-11 10 CVE-2024-51792 Davor Zeljkovic--Convert Docx2post  Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post allows Upload a Web Shell to a Web Server.This issue affects Convert Docx2post: from n/a through 1.4. 2024-11-16 9.1 CVE-2024-52397 decidim--decidim  Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0. 2024-11-13 7.7 CVE-2024-45594 decidim-ice--decidim-module-decidim_awesome  An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands. 2024-11-12 9 CVE-2024-43415 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. 2024-11-12 7.8 CVE-2024-49557 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. 2024-11-12 7.8 CVE-2024-49558 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. 2024-11-12 7.8 CVE-2024-49560 Dell--SmartFabric OS10 Software  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution 2024-11-12 7.8 CVE-2024-48837 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39354 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39605 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-47131 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user's password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user's account. 2024-11-11 9.8 CVE-2024-11068 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11062 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11063 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11064 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11065 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through the specific web page. 2024-11-11 7.2 CVE-2024-11066 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password. 2024-11-11 7.5 CVE-2024-11067 DMC--Airin Blog  Deserialization of Untrusted Data vulnerability in DMC Airin Blog allows Object Injection.This issue affects Airin Blog: from n/a through 1.6.1. 2024-11-16 9.8 CVE-2024-52413 DonnellC--Global Gateway e4 | Payeezy Gateway  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway.This issue affects Global Gateway e4 | Payeezy Gateway: from n/a through 2.0. 2024-11-14 8.6 CVE-2024-52371 DoThatTask--Do That Task  Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task allows Upload a Web Shell to a Web Server.This issue affects Do That Task: from n/a through 1.5.5. 2024-11-14 10 CVE-2024-52374 dotnetzip.semverd_project -- dotnetzip.semverd  Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2024-11-13 9.8 CVE-2024-48510 Elastic--Kibana  A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest** The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted* Under Integration the Read or All privilege is granted* Access to the fleet-setup privilege is gained through the Fleet Server's service account token 2024-11-14 9.1 CVE-2024-37285 Eugen Bobrowski--Debug Tool  Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a through 2.2. 2024-11-16 10 CVE-2024-52416 Flowcraft UX Design Studio--Advanced Personalization  Deserialization of Untrusted Data vulnerability in Flowcraft UX Design Studio Advanced Personalization allows Object Injection.This issue affects Advanced Personalization: from n/a through 1.1.2. 2024-11-16 9.8 CVE-2024-52411 fortinet -- forticlient  A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts. 2024-11-12 8.8 CVE-2024-36513 fortinet -- forticlient  A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering. 2024-11-12 7.8 CVE-2024-36507 Fortinet--FortiClientWindows  A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages. 2024-11-13 7.8 CVE-2024-47574 Fortinet--FortiManager  A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigDataat least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests. 2024-11-12 7.5 CVE-2024-23666 Fortinet--FortiOS  A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link. 2024-11-12 7.5 CVE-2023-50176 FraudLabs Pro--FraudLabs Pro SMS Verification  Cross-Site Request Forgery (CSRF) vulnerability in FraudLabs Pro FraudLabs Pro SMS Verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through 1.10.1. 2024-11-14 7.1 CVE-2024-51688 FreeBSD--FreeBSD  The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option. 2024-11-12 7.5 CVE-2024-45289 GeekRMX--Twitter @Anywhere Plus  Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through 2.0. 2024-11-14 7.1 CVE-2024-51659 GentleSource--Appointmind  Cross-Site Request Forgery (CSRF) vulnerability in GentleSource Appointmind allows Stored XSS.This issue affects Appointmind: from n/a through 4.0.0. 2024-11-14 7.1 CVE-2024-51679 GeoVision--GV-VS12  Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports. 2024-11-15 9.8 CVE-2024-11120 GitLab--GitLab  An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. 2024-11-14 8.5 CVE-2024-9693 glpi-project--glpi  GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17. 2024-11-15 8.1 CVE-2024-40638 gogs--gogs/gogs  A remote command execution vulnerability exists in gogs/gogs versions

Read more »

An Interview With the Target & Home Depot Hacker
In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.

Read more »

Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November's patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.

Read more »

FBI: Spike in Hacked Police Emails, Fake Subpoenas
The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies.

Read more »

13-inch M3 MacBook Airs with 16GB of RAM back on Holiday sale this week for $200 off MSRP, prices start at $899
Amazon and Best have Apple's 13-inch M3 MacBook Airs with 16GB of memory, the newest models recently upgraded by Apple, back on Holiday sale this week for the same prices they had posted over Black Friday. Save $200 on each MacBook Air right now, with prices available starting at only $899. Sale prices below apply to all colors. (1): Amazon has new 13" 16GB M3 MacBook Airs on sale for $200 off MSRP, each including free shipping: - 13" M3 MacBook Air (16GB/256GB): $899, $200 off MSRP - 13" M3 MacBook Air (16GB/512GB): $1099, $200 off MSRP - 13" M3 MacBook Air (24GB/512GB): $1299, $200 off MSRP Note that stock at Amazon varies, and be sure to select Amazon as the seller rather than choosing a third-party retailer. (2): Best Buy has new 13" 16GB M3 MacBook Airs on sale for $200 off MSRP as well. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 13" M3 MacBook Air (16GB/256GB): $899, $200 off MSRP - 13" M3 MacBook Air (16GB/512GB): $1099, $200 off MSRP - 13" M3 MacBook Air (24GB/512GB): $1299, $200 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

iPads are back on Holiday sale for $70 off MSRP on Best Buy’s online store
Best Buy has Apple's 10th-generation iPads back on Holiday sale this week for $70 off MSRP on their online store, starting at $279. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 10" 10th-generation 64GB WiFi iPads: $279 $70 off MSRP - 10" 10th-generation 256GB WiFi iPads: $429 $70 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $429 $70 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $579 $70 off MSRP These are the lowest prices available for base-model iPads among the Apple retailers we track. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Holiday Sale: Take $100 off 11-inch M4 iPad Pros and $200 off 13-inch M4 iPad Pros this week
Best Buy has Apple's iPad Pros with M4 CPUs back on Holiday sale this week for $100-$200 off MSRP on their online store. Prices start at $899: - 13-inch M4 WiFi iPad Pros: $200 off MSRP - 13-inch M4 WiFi + 5G iPad Pros: $200 off MSRP - 11-inch M4 WiFi iPad Pros: $100 off MSRP - 11-inch M4 WiFi + 5G iPad Pros: $100 off MSRP Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). See our iPad Pro Price Tracker for a detailed breakdown of prices.

Read more »

Holiday Sale: Take $100 off 11-inch M4 iPad Pros and $200 off 13-inch M4 iPad Pros this week
Best Buy has Apple's iPad Pros with M4 CPUs back on Holiday sale this week for $100-$200 off MSRP on their online store. Prices start at $899: - 13-inch M4 WiFi iPad Pros: $200 off MSRP - 13-inch M4 WiFi + 5G iPad Pros: $200 off MSRP - 11-inch M4 WiFi iPad Pros: $100 off MSRP - 11-inch M4 WiFi + 5G iPad Pros: $100 off MSRP Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). See our iPad Pro Price Tracker for a detailed breakdown of prices.

Read more »

27-inch 5K Apple Studio Display back on Holiday sale this week for $300 off MSRP
Best Buy has 27" 5K Apple Studio Displays on Holiday sale again for $300 off MSRP this week. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 27" Studio Display (Standard glass, Tilt Adjustable): $1299.99, $300 off MSRP For the latest prices and sales, see our Studio Display Price Tracker, updated daily.

Read more »

Apple HomePod on rare Holiday sale for $30 off MSRP this week with free store pickup
Best Buy is offering a $30 discount on 2nd-generation full-size Apple HomePods this week on their online store, now $269.99, $30 off MSRP. Sale prices are valid for both colors. Sale price is for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup, if available. For the latest prices & sales, see our HomePod Price Tracker, updated daily.

Read more »

Holiday Sale: 15-inch M3 MacBook Airs for $200 off MSRP this weekend
Amazon has new 15" 16GB M3 MacBook Airs on Holiday sale this weekend for up to $200 off MSRP, each including free shipping. These are the lowest prices available for a new 15" 16GB MacBook Air this weekend: - 15" M3 MacBook Air (16GB/256GB): $1099, $200 off MSRP - 15" M3 MacBook Air (16GB/512GB): $1384, $115 off MSRP - 15" M3 MacBook Air (24GB/512GB): $1399, $200 off MSRP Note that sale price may be dependent on color. Most prices reflect an initial sale price + a clippable coupon (see their site for details). For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Take $40 off 4th-generation Apple AirPods this weekend at Amazon
Amazon has 4th-generation Apple AirPods in stock and on Holiday sale this weekend for up to $40 off MSRP including free shipping. Their prices are among the lowest prices available for new AirPods: - AirPods 4: $119, $10 off - AirPods 4 with ANC: $138.99, $40 off Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Take $40 off 4th-generation Apple AirPods this weekend at Amazon
Amazon has 4th-generation Apple AirPods in stock and on Holiday sale this weekend for up to $40 off MSRP including free shipping. Their prices are among the lowest prices available for new AirPods: - AirPods 4: $119, $10 off - AirPods 4 with ANC: $138.99, $40 off Keep an eye on our AirPods Price Tracker for the latest prices and deals, updated daily.

Read more »

Holiday Sale: Apple Watch Series 10 models on sale for $50 off MSRP this weekend
Apple retailers have Apple Watch Series 10 models on Holiday sale this weekend for $50 off Apple's MSRP. These are the lowest prices available for Series 10 Watches this weekend: Apple Watch Series 10 (aluminum cases): - Amazon: $50 off MSRP, prices start at $349 - Best Buy: $50 off MSRP, prices start at $349 - Walmart: $50 off MSRP, prices start at $349 Sale prices at Best Buy and Walmart are for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »

Clearance 14-inch M3 MacBook Pros available starting at only $1199 at Apple, Certified Refurbished
Apple has clearance 14" M3 MacBook Pros available, Certified Refurbished, starting at only $1199. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 MacBook Pros currently available for sale at Apple: - 14" M3 MacBook Pro (8GB/512GB/Gray): $1199 $400 off MSRP - 14" M3 MacBook Pro (8GB/1TB/Gray): $1359 $440 off MSRP - 14" M3 MacBook Pro (8GB/512GB/Silver): $1199 $400 off MSRP - 14" M3 MacBook Pro (8GB/1TB/Silver): $1359 $440 off MSRP See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily.

Read more »

Holiday Sale: $50 off 10th-generation iPads on Walmart’s online store
Walmart has Apple's 10th-generation 64GB WiFi iPads on Holiday sale for $50 off MSRP on their online store. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 10" 10th-gen 64GB WiFi iPads: $299 $50 off MSRP This is the cheapest new iPad for sale among the Apple retailers we track. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »