macOS Sonoma 14.2 with enhanced Autofill PDF features now available
Apple has officially released macOS Sonoma 14.2, introducing promised new enhancements to Autofill for PDFs. The update also adds new features to Messages, Clock, and more. more…

Read more »

iOS 17.2 arrives with Journal app, and big Apple Music changes
Apple has released iOS 17.2 to the public, with the update adding the long-awaited Journal app as well as Apple Music changes.iOS 17The second main update to iOS 17 since iOS 17.1 was introduced on October 25, iOS 17.2 has finished its run of beta tests and can now be installed by the public onto their iPhones. Read more...

Read more »

iPadOS 17.2 is here with Apple Music updates, and other changes
Apple has released iPadOS 17.2 to the public and it contains most of the new features available in iOS 17.2, like Messages and Music updates.iPadOS 17.2 is hereA little over a month after Apple released iPadOS 17.1, the next point update is here. It doesn't have any iPadOS-specific features, but contains several small system tweaks, services updates, and a focus on bug fixes. Read more...

Read more »

macOS Sonoma 14.2 now available with Apple Music changes & more
The latest update cycle focused on changes to wider ecosystem services and iOS 17, so macOS Sonoma 14.2 is a minimal update with Apple Music changes, bug fixes, and more.macOS SonomaApple released macOS Sonoma 14.1 on October 25 with the new Apple Music favorites feature and fixes. The trend for minimal macOS updates continues with macOS Sonoma 14.2. Read more...

Read more »

Apple releases watchOS 10.2 for Apple Watch; here’s everything new
Alongside iOS 17.2 with a host of new features, Apple has also released watchOS 10.2 for Apple Watch users. This update includes updates to the Health app’s integration with Siri, an easier way to switch watch faces, and more. more…

Read more »

Apple releases tvOS 17.2 with 3D movies and better system navigation
Apple has updated its home entertainment experience with the release of tvOS 17.2, which brings features like 3D movies for the Vision Pro headset.The latest tvOS update brings 3D moviesFollowing the launch of the most recent tvOS 17.2 beta update on November 14, Apple has formally rolled out the latest iteration of its operating system tailored for the Apple TV. Read more...

Read more »

watchOS 10.2 now available, allowing Siri to access health data for hands-free usage
Apple has officially released the watchOS 10.2 update to bring back the swipe gesture for changing watch faces and Siri access to health data.Apple releases watchOS 10.2After the release of the second watchOS 10.2 beta on November 9, the official release it out for all Apple Watch users. Read more...

Read more »

Apple releases iOS 17.2 with Journal app, spatial video capture, much more
Apple has released iOS 17.2 for iPhone. The new version introduces Apple’s Journal app that was first shown off at WWDC in June. It also adds new functionality to the Action button and introduces spatial video capture on iPhone 15 Pro and iPhone 15 Pro Max. more…

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Apple introduces spatial video capture on iPhone 15 Pro

Read more »

Beeper Mini for Android lives again, but for how long is anybody's guess
Beeper Mini is back and working, with the developers releasing an update for the Android app that lets it use Apple's iMessage network once again.Following the launch of the Android app and the blocking of it by Apple, Beeper insisted that a fix was on the way that would get Beeper Mini working again. On Monday, it released the update.Offered as a sideload-able app while it awaits to be approved for download from the Google Play Store, the Beeper Mini app update is said by the company to fix an issue "that caused messages not to be sent or received." Read more...

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Siri can now help users access and log their Health app data

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Apple launches Journal app, a new app for reflecting on everyday moments

Read more »

Turn Your iPhone into a Phone and Wallet Combo at 24% Off
MagSafe has unlocked many features and functionalities for the iPhone, including the ability to turn the device into a mini wallet. Today, the iPhone FineWoven Wallet with MagSafe is down to just $44.99 from its original price of $60 on Amazon. The MagSafe wallet is made from microtwill offering durability and a suedelike feel. The […] The post appeared first on iLounge.

Read more »

Why is everyone mad at Apple for blocking Beeper’s Android iMessage hack?
Macworld Last week, a new Android app named Beeper Mini broke onto the scene and made instant headlines. Its intention was to get iMessage working on Android without routing Apple IDs through unsecured third-party servers—and it worked. Android users were suddenly able to text their iPhone friends and appear in blue bubbles as if they had switched phones. Almost immediately, Apple shut it down in the friendliest way possible. The company didn’t send out a cease-and-desist letter or publicly threaten Beeper with a lawsuit. It simply closed whatever loophole Beeper was exploiting. Then when asked about it, it explained why it had acted so quickly: We took steps to protect our users by blocking techniques that exploit fake credentials in order to gain access to iMessage. These techniques posed significant risks to user security and privacy, including the potential for metadata exposure and enabling unwanted messages, spam, and phishing attacks. We will continue to make updates in the future to protect our users. Cut-and-dried, yes? Not so much. The backlash was swift and took on a surprising tone: most people weren’t mad at Beeper for exploiting a security hole in someone else’s platform, but at Apple for closing it. These voices include Massachusetts Senator Elizabeth Warren, who wrote on the network formerly known as Twitter: “So why would Apple block a new app allowing Android users to chat with iPhone users on iMessage? Big Tech executives are protecting profits by squashing competitors.” No one likes when an Android phone blows up a group chat.Michael Simon/IDG Really? Even if we ignore the fact that Beeper was charging for people to use a service they didn’t make, let’s pretend these are two different companies: What if a company developed a way to get Halo to work on PlayStation and charged users a monthly fee to play it, would anyone be surprised if Microsoft blocked it? The message would be simple: If you want to play Halo on a console, you need to buy an Xbox. Listen, we all know that SMS is unencrypted. That’s not Apple’s fault. Apple deserves some blame for waiting so long to support RCS, but let’s be clear: that’s not encrypted either. RCS enables end-to-end encryption, but it’s not actually supported by the Global System for Mobile Communications Association. Unless you’re using Google Messages and sending a message to someone else using Google Messages and a carrier that supports RCS you’re not getting end-to-end encryption. (Beeper claims its iMessage knockoff was offering the same encryption as iMessage in Apple’s Messages app, but didn’t offer any proof of that.) In its announcement of RCS support, Apple said it would be working with GSMA to bring end-to-end encryption to the RCS standard instead of supporting piecemeal encryption within proprietary apps. I’m willing to bet that GSMA figures it out before RCS launches on the iPhone. Like most people, I’m very much looking forward to Apple’s implementation of RCS in Messages. We all hate how Android users mess with iMessage features in group texts and don’t want to worry about which of our friends have iPhones. But Apple shouldn’t be expected to sit idly by while someone usurps their tech and profits off it. Apple Inc, iPhone

Read more »

Apple Vision Pro might launch in January 2024
Apple’s much-awaited mixed reality headset might be appearing to the public as early as January next year. Apple has stressed many times that it’s planning for an ‘early 2024’ release of the Apple Vision Pro, albeit without an actual date. In his recent ‘Power On’ newsletter, Bloomberg analyst Mark Gurman said that the release is […] The post appeared first on iLounge.

Read more »

Beeper Mini app shut down by Apple
Messaging app Beeper Mini has been shut down, notably, its ability to receive and send iMessages. Beeper Mini is an Android app that allows users to receive and send Apple-formatted messages. The way it works is by intercepting the platform protocol via push notification and letting the servers think that it’s an Apple device. The […] The post appeared first on iLounge.

Read more »

12.9-inch iPad Air display panels start shipping in December
Shipments of the upcoming display panel for the 12.9-inch iPad Air are well under way, according to Ross Young. 2023 is different from the other prior years since no new iPad models were released. However, it looks like Apple will be compensating for this by launching new ones for the whole lineup next year. One […] The post appeared first on iLounge.

Read more »

Apple may pay artists more to use Dolby Atmos
Music makers may see more profit from Apple Music tracks starting in 2024 if they mix using Dolby Atmos, sources said. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

More Apple Vision Pro environments surface to show where you can virtually be
More virtual environments users of the Apple Vision Pro will use while using the headset have surfaced, showcasing not only the visuals but also spatial sounds they will experience.The Apple Vision Pro offers users a choice of how immersive their mixed reality experience is, blending between a view of their local environment and a virtual one. In a late Sunday post to X, eight of the environments headset wearers can use are shown off in video.The clips from @M1Astra consist of eight variants compiled into a nine-minute video. The clips are accompanied by descriptions supposedly provided by Apple itself. Read more...

Read more »

AirPods 3 land under the tree at $140, Samsung Thunderbolt 4 5K monitor $600 off, Anker gear, more
A discount down to $140 means you can wrap up AirPods 3 under the tree for less ahead of the holidays. It comes joined by a new all-time low on Samsung’s 27-inch ViewFinity S9 5K Monitor with Thunderbolt 4 at $600 off, as well as Anker’s recent Prime 240W USB-C charging station at $130. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more…

Read more »

iOS 17.2 expected this week with these new features and changes
After the release of iOS 17.1 in October, Apple is hard at work on iOS 17.2 with a collection of new features and changes. iOS 17.2 is currently in beta testing with developers and public beta users, and is expected to be released to everyone this week. Here’s everything new coming with iOS 17.2 this week.. more…

Read more »

Samsung Winter Sale knocks up to 64% off phones, monitors, Bespoke appliances & storage
The 2023 Discover Samsung Winter Sale is in effect now and popular gift ideas have been slashed by up to 64%. Plus, get delivery by Christmas on many orders.Save on Samsung gearWhether you're looking for an external display for your Mac or a portable SSD to expand your access to storage, Samsung's Winter Sale has a variety of deals available with delivery by Christmas. We're dropping our prime picks below, but new flash deals will be going live all week long, so be sure to check back daily for the latest discounts. Read more...

Read more »

PETA names Apple ‘PETA’s 2023 Company of the Year’ for dropping leather for ‘FineWoven’ junk
People for the Ethical Treatment of Animals (PETA) has named Apple "2023 Company of the Year" for dropping leather for "FineWoven" junk… The post appeared first on MacDailyNews.

Read more »

New iPad Pro M3: Rumors about the new 11, 12, and 14-inch models
Macworld The current iPad range is one of the most populated we’ve seen. It includes two iterations of the standard iPad, the iPad mini, the iPad Air, and the 11-inch and 12.9-inch iPad Pro models, so there’s plenty to choose from. It seems Apple isn’t stopping there, though; rumors suggest it could be adding an even larger iPad Pro to the line-up. Here’s everything we know about the next-generation iPad Pro, including the rumored 14-inch model. New iPad Pro release date: When will the M3 iPad Pro arrive? Following no iPad updates at all in 2023, it looks like there will be a new iPad Pro in 2024. With the last update to the range being in October 2022, and iPad Pro launches tending to happen every 18 months, a spring 2024 update could be on the cards. Bloomberg’s Mark Gurman said in a newsletter in December that the new iPad Pro could launch in March 2024. However, we could be waiting a little longer for the update, according to analyst Ming-Chi Kuo. Kuo had been expecting the new Pros to enter mass production early in the first half of 2024, but as of November 2023, he suggests production has been pushed back too late in the first half, or even the second half, of 2024. For some clues as to when Apple could launch the new iPad Pro, we can look at past launches, bearing in mind that Apple has been inconsistent with the launch windows from previous models. Here’s when they made their debuts: iPad Pro 11-inch and 12.9-inch (6th gen): Oct 2022 iPad Pro 11-inch and 12.9-inch (5th gen): Apr 2021 iPad Pro 11-inch and 12.9-inch (4th gen): Mar 2020 iPad Pro 11-inch and 12.9-inch (3rd gen): Oct 2018 iPad Pro 10.5-inch and 12.9-inch (2nd gen): June 2017 iPad Pro 9.7-inch (1st gen): Mar 2016 iPad Pro 12.9-inch (1st gen): Nov 2015 We could see the new iPad Pro around April, but we could be waiting until June 2024. Read about the other new products Apple is launching in 2024. New iPad Pro size: Is there going to be a 14-inch iPad Pro? Currently, there are two sizes of iPad Pro: a 12.9-inch model and an 11-inch iPad Pro. Reports suggest that Apple could soon launch a new 14-inch model alongside the 11- and 12-inch iPad Pro models, or perhaps the 14-inch model will replace one of the other options. The rumor of a larger-screened iPad started with Bloomberg’s Mark Gurman back in June 2021. He wrote that Apple was considering making iPads with larger displays, but not to expect anything for a few years. In December 2023 Gurman suggested the new iPad Pro could be 13-inches. Another leaker named Majin Bu has also posted that a new 14.1-inch iPad Pro is in development. Display analyst Ross Young also claimed in 2022 that a 14.1-inch iPad Pro model was in development, and that “early 2023” was a likely release schedule. It appears that the tweet is no longer on Twitter/X, but initially, he tweeted the following on June 9. 2022. “Confirmed the 14.1” iPad Pro is being developed with our supply chain sources. It will have MiniLEDs and ProMotion. Not sure of the timing, but early 2023 may be more likely.— Ross Young (@DSCCRoss) June 9, 2022. (Clearly, a 2023 release did not happen.) There are also rumors that a larger iPad Air is in the works, with Apple set to launch a new 12.9-inch iPad Air in 2024. Should this materialize then a larger iPad Pro may make sense in the lineup. With the release of Logic Pro and Final Cut Pro on the iPad, it makes a lot of sense for Apple to offer an iPad with a larger screen and external display support. New iPad Pro display: Will the new iPad Pro have an OLED screen? Apple The current LED (on the 10.9-inch model) and mini-LED (on the 12.9-inch iPad Pro) are to be replaced by OLED, according to Ming-Chi Kuo in November 2023. The iPad Pro will be the first iPad to transition to OLED displays, with the rest of the iPad lineup to follow. Back in December 2022, Display analyst Ross Young suggested that Apple is planning to move the entire iPad line to OLED by 2024. This matches what Gurman wrote (in January 2023) when he predicted that “an updated design and OLED screens” would be coming to the iPad in the spring of 2024. There is yet more evidence that OLEDs are coming: market research company Omdia has also stated that the iPad Pro could see OLED upgrades by 2024. In addition, leaker Yeux1122 has claimed that Apple is in negotiations with LG, Samsung, and Chinese companies for active matrix OLEDs (AMOLEDs). More here: Apple may upgrade nearly every iPad with an OLED display. New iPad Pro price: How much will the 2024 iPad Pro cost? At the moment, these are the starting prices for each model in the current iPad Pro range. iPad Pro 11-inch Wi-Fi (2022): $799/£899 iPad Pro 11-inch Cellular (2022): $999/£1,079 iPad Pro 12.9-inch Wi-Fi (2022): $1,099/£1,249 iPad Pro 12.9-inch Cellular (2022): $1,299/£1,429 If Apple moves to OLED screens and introduces a larger iPad Pro we may see a price hike. “If Apple wants to maintain the price gap between the iPad Air and iPad Pro to preserve its existing product segmentation strategy,” Kuo explains, “it means that the new OLED iPad Pros may see a price increase.” If Apple introduces a larger 14-inch iPad Pro we are likely to see price rises at the top of the range, although that depends on whether Apple discontinues the 12.9-inch model or keeps that in the lineup. There is currently a $300 gap between the base 11-inch and 12.9-inch models. So if the 12.9-inch model remains we could see the 14-inch iPad Pro start at $1,399/£1,529 or thereabouts. However, Apple could remove the 12.9-inch model and the 14-inch iPad Pro could start at $1,099/£1,249 or slightly more than that. New iPad Pro specs: What features will the 2024 iPad Pro have? The current iPad Pros are powered by the M2 chip, so it makes sense for an M3 chip to appear in any new 2024 models. We don’t think the M3 Pro is a likely option, though, as the Pro versions of Apple’s chips have so far only appeared on the 14-inch and 16-inch MacBook Pro and Mac mini, and the M2 in the iPad Pros already provides more power than it needs. Also due to the iPad’s thin, finless design, it seems more sensible for a standard M3 to be at the heart of a 14-inch iPad Pro. A tweet from June 2022 by Majin Bu suggested that the 14-inch iPad Pro would contain an M2 processor, 16GB of RAM and 512GB of base storage. That tweet was some time ago now though so a M3-chip would be more likely now. According to my resource, Apple is developing a new 14.1-inch iPad M2 with 512GB and 16GB of base memory. The new M2 line is expected to include a new 11-inch model with no major changes, a new 12.9 model with reduced bezels and this new 14.1 iPad #Apple #AppleRumor— Majin Bu (@MajinBuOfficial) June 8, 2022 Apple currently sells 128GB, 256GB, 512GB, 1TB and 2TB iPad Pro configurations – which is a lot of configurations when you consider all the color combinations and screen sizes. It’s possible that the company could change to starting with 512GB at the entry-level, although we think it more likely that the company will drop the 128GB model from the lineup. New iPad Pro specs: New keyboard Bloomberg’s Mark Gurman indicated in a September 2023 newsletter that Apple is planning a new aluminium Magic Keyboard with a larger trackpad, that will be released alongside the M3 iPad Pro. The aluminium finish could make it more like a laptop when linked to the iPad. We’ll update this article as more details are revealed, so check back regularly to see what we dig up. In the meantime, we’ve rounded up the best deals on iPad Pros so you can always get one now rather than waiting. iPad

Read more »

Slammin’ Mac Studio is just the start of this rig’s massive upgrades [Setups]
Going from a 13-year-old Mac mini to a new Mac Studio is huge, but it's just the beginning of recent upgrades this setup saw. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Why Apple is focusing on 6G already
Apple's recent listing for a Cellular Platform Architect to work on 6G technology raised some eyebrows from those wondering why is Apple already hiring for 6G, when it's yet to get its 5G house in order. Here's why it's looking so far forward.iPhone 15 Pro and Pro MaxSignals indicate that Apple will end its partnership with Qualcomm sometime in the next couple of years, once it has a capable modem chip of its own to use for the iPhone. While the company's current semiconductor efforts may be focused on 5G engineering, that doesn't mean planning for 6G isn't necessary. In fact, Apple's been hiring 6G engineers for a while. Read more...

Read more »

Killers of the Flower Moon earns 7 Golden Globe nominations for Apple TV+
Martin Scorsese’s "Killers of the Flower Moon" picked up enough Golden Globe nominations that the Apple TV+ drama really stands out. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple market value to surpass $4 trillion in 2024 – Wedbush
Wedbush Securities analyst Dan Ives is predicting that Apple will become the first company to surpass a $4 trillion market value in 2024… The post appeared first on MacDailyNews.

Read more »

Apple blocks Beeper Mini Android-iMessage bridge
Well that didn't take long. Apple cited security and privacy in shutting down Beeper Mini's iMessage workaround for Android users. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Daily deals Dec. 11: $250 off M1 MacBook Air, 24% off Apple MagSafe Duo, AirPods 3 $139.99, more
Today's top deals include an OWC 14-Port Thunderbolt dock for $169.99, 22% off Apple's iPad 10th Generation, 58% off a Heybike Race Max electric bike, 35% off an Anker foldable 3-in-1 wireless charging station, 77% off a Puma wireless portable Bluetooth speaker, and more.Save $199 on an M1 MacBook AirThe AppleInsider crew combs the web for top-notch deals at e-commerce retailers to create a list of outstanding discounts on popular tech gadgets, including deals on MacBook Air laptops, TVs, accessories, and other items. We share our top finds daily to help you get more bang for your buck. Read more...

Read more »

ICANN Launches Service to Help With WHOIS Lookups
More than five years after domain name registrars started redacting personal data from all public domain registration records, the non-profit organization overseeing the domain industry has introduced a centralized online service designed to make it easier for researchers, law enforcement and others to request the information directly from registrars.

Read more »

Vulnerability Summary for the Week of November 27, 2023
 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- dolphinscheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may include sensitive data such as database credentials. Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file ``` management:   endpoints:     web:       exposure:         include: health,metrics,prometheus ``` This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue. 2023-11-24 7.5 CVE-2023-48796   apache -- dolphinscheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which fixes the issue. At the time of disclosure of this advisory, this version has not yet been released. In the meantime, we recommend you make sure the logs are only available to trusted operators. 2023-11-27 7.5 CVE-2023-49068   apache -- superset Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weakness could result on tampering with the authentication/authorization data. 2023-11-27 8.8 CVE-2023-40610   arcserve -- udp Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacker to upload and execute arbitrary files. 2023-11-27 9.8 CVE-2023-41998 arslansoft -- education_portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1. 2023-12-01 9.8 CVE-2023-5634 arslansoft -- education_portal Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects Education Portal: before v1.1. 2023-12-01 9.8 CVE-2023-5636 arslansoft -- education_portal Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting. This issue affects Education Portal: before v1.1. 2023-12-01 7.5 CVE-2023-5635 arslansoft -- education_portal Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable. This issue affects Education Portal: before v1.1. 2023-12-01 7.5 CVE-2023-5637 chamilo -- chamilo_lms Command injection in `main/lp/openoffice_presentation.class.php` in Chamilo LMS

Read more »

Okta: Breach Affected All Customer Support Users
When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users.

Read more »

ID Theft Service Resold Access to USInfoSearch Data
One of the cybercrime underground's more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker USinfoSearch, KrebsOnSecurity has learned.

Read more »

Vulnerability Summary for the Week of November 20, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47066 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47067 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47068 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47069 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47070 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47073 code-projects -- simple_crud_functionality SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. 2023-11-17 9.8 CVE-2023-48078 concrete_cms -- concrete_cms Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified. 2023-11-17 9.8 CVE-2023-48648   corebos -- corebos Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer. 2023-11-17 8 CVE-2023-48029   cubecart -- cubecart Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. 2023-11-17 8.1 CVE-2023-38130   cubecart -- cubecart CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. 2023-11-17 7.2 CVE-2023-47675   dreamer_cms -- dreamer_cms Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management. 2023-11-18 8.8 CVE-2023-48017 getsimplecms -- getsimplecms A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735. 2023-11-17 9.8 CVE-2023-6188   git-urls -- git-urls git-urls version 1.0.1 is vulnerable to ReDOS (Regular Expression Denial of Service) in Go package. 2023-11-18 7.5 CVE-2023-46402 honeywell -- prowatch Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5). 2023-11-17 7.8 CVE-2023-6179   kodcloud -- kodbox kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack. 2023-11-18 9.8 CVE-2023-48028   liblisp -- liblisp Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c 2023-11-17 8.1 CVE-2023-48025 librenms -- librenms LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user accounts. This issue has been addressed in version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-11-17 7.5 CVE-2023-46745 luxsoft -- luxcal_web_calendar SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request and obtain or alter information stored in the database. 2023-11-20 9.8 CVE-2023-46700   medart_health_services -- medart_notification_panel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection. This issue affects Medart Notification Panel: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-23 9.8 CVE-2023-3631 misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. 2023-11-17 9.8 CVE-2023-48655   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. 2023-11-17 9.8 CVE-2023-48656   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. 2023-11-17 9.8 CVE-2023-48657   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. 2023-11-17 9.8 CVE-2023-48658   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. 2023-11-17 9.8 CVE-2023-48659   nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39544 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39545 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39546 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39547 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39548 neutron -- ip_camera Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1. 2023-11-23 7.5 CVE-2023-6118 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. 2023-11-20 7.8 CVE-2023-43612 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. 2023-11-20 7.8 CVE-2023-6045 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker to get confidential information or rewrite sensitive file through incorrect default permissions. 2023-11-20 7.1 CVE-2023-3116 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. 2023-11-17 9.8 CVE-2023-38316 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated and can be triggered only when the BinAuth option is set. 2023-11-17 7.5 CVE-2023-38313 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing client token query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). 2023-11-17 7.5 CVE-2023-38315 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). 2023-11-17 7.5 CVE-2023-38320 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated and can be triggered only when the BinAuth option is set. 2023-11-17 7.5 CVE-2023-38322 opennds -- opennds An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). 2023-11-17 9.8 CVE-2023-41101   opennds -- opennds An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. 2023-11-17 7.5 CVE-2023-41102   opensupports -- opensupports OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation. 2023-11-17 9.8 CVE-2023-48031   prestashop -- prestashop In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().` 2023-11-17 9.8 CVE-2023-45387   prestashop -- prestashop In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. 2023-11-17 7.5 CVE-2023-45382   tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48109 tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48110 tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48111 veribilim_software_computer -- veribase Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection. This issue affects Veribase: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-23 9.8 CVE-2023-3377 wordpress -- wordpress The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. 2023-11-18 9.8 CVE-2023-4214   wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin

Read more »

Vulnerability Summary for the Week of November 13, 2023
 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info checkpoint -- endpoint_security Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2023-11-12 7.8 CVE-2023-28134 discourse -- discourse Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server-side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature. 2023-11-10 9.8 CVE-2023-47121   discourse -- discourse Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds. 2023-11-10 7.5 CVE-2023-47120   dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus. 2023-11-14 8.8 CVE-2023-48020 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. 2023-11-14 8.8 CVE-2023-48021 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run 2023-11-13 8.8 CVE-2023-48058 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add 2023-11-13 8.8 CVE-2023-48060 emsigner -- emsigner Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token. 2023-11-14 9.8 CVE-2023-43902 fortinet -- fortimail An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts. 2023-11-14 7.3 CVE-2023-45582 fortinet -- fortiwlm A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests. 2023-11-14 7.5 CVE-2023-42783 froxlor -- froxlor Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. 2023-11-10 8.8 CVE-2023-6069   gibbonedu -- gibbon GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated). 2023-11-14 9.8 CVE-2023-45878 gibbonedu -- gibbon GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot. 2023-11-14 7.2 CVE-2023-45880 golden -- golden An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. 2023-11-14 7.5 CVE-2023-45558 hanwhavision -- wave_server_software Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution." 2023-11-13 8.8 CVE-2023-5747 headscale -- headscale Headscale through 0.22.3 writes bearer tokens to info-level logs. 2023-11-11 7.5 CVE-2023-47390 icssolution -- ics_business_manager A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction. 2023-11-13 8.8 CVE-2023-6097 intel(r) -- unison_software Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-22663 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-36860 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-39221 intel(r) -- unison_software Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-39412 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2022-45469 intel(r) -- unison_software Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2023-22292 intel(r) -- unison_software Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2023-38570 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-22285 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-22337 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-39228 intel(r) -- unison_software Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network access. 2023-11-14 7.2 CVE-2023-22448 johnson_controls -- quantum_hd_unity_compressor_firmware An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. 2023-11-10 9.8 CVE-2023-4804   linux -- kernel A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. 2023-11-14 7.8 CVE-2023-6111   memberscard -- memberscard An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. 2023-11-14 7.5 CVE-2023-45560 microsoft -- edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 2023-11-10 7.3 CVE-2023-36014 microsoft -- edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 2023-11-10 7.1 CVE-2023-36024 netgate -- pfsense An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. 2023-11-14 8.8 CVE-2023-42326 phonepe -- phonepe Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions. This issue affects PhonePe Payment Solutions: from n/a through 1.0.15. 2023-11-13 7.5 CVE-2022-45835 phpgurukul -- restaurant_table_booking_system A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file check-status.php of the component Booking Reservation Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-244943. 2023-11-10 9.8 CVE-2023-6074   phpgurukul -- restaurant_table_booking_system A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file booking-details.php of the component Reservation Status Handler. The manipulation of the argument bid leads to information disclosure. The attack can be launched remotely. The identifier VDB-244945 was assigned to this vulnerability. 2023-11-10 7.5 CVE-2023-6076   phpgurukul -- teacher_subject_allocation_management_system SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obtain sensitive information via the 'searchdata' parameter. 2023-11-14 7.5 CVE-2023-46024 qnap -- qumagie An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.3 and later 2023-11-10 8.8 CVE-2023-39295 qnap -- qumagie A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.4 and later 2023-11-10 8.8 CVE-2023-41284 qnap -- qumagie A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.4 and later 2023-11-10 8.8 CVE-2023-41285 remarshal -- remarshal Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition. 2023-11-13 7.5 CVE-2023-47163   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 9.8 CVE-2023-6126   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6125   salesagility -- suitecrm Path Traversal: '..filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6130   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6131   shenzhen_youkate_industrial -- facial_love_cloud_platform A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-13 9.8 CVE-2023-6099   siemens -- comos A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition. 2023-11-14 9.8 CVE-2023-43504 siemens -- comos A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP. 2023-11-14 7.5 CVE-2023-43503 statamic_cms -- statamic_cms Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0. 2023-11-10 9.8 CVE-2023-47129   sysaid -- sysaid_on-premises In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. 2023-11-10 9.8 CVE-2023-47246   telit -- bgs5_firmware A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to elevate privileges to "manufacturer" level on the targeted system. 2023-11-10 7.8 CVE-2023-47611 thinkingreed_inc. -- oss_calendar SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request. 2023-11-14 8.8 CVE-2023-47609   tongda -- tongda_oa A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VU_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-12 9.8 CVE-2023-6084   wbce -- wbce_cms SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter. 2023-11-10 9.8 CVE-2023-39796   weston-embedded -- cesium_net An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to memory corruption. An attacker can send a network request to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-24585 weston-embedded -- cesium_net A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-25181 weston-embedded -- cesium_net A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-27882 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-28379 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-28391 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-31247 wordpress -- wordpress Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors - Car Dealer, Classifieds & Listing. This issue affects Motors - Car Dealer, Classifieds & Listing: from n/a through 1.4.6. 2023-11-13 7.5 CVE-2023-46207 wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications - Webpushr plugin

Read more »

Alleged Extortioner of Psychotherapy Patients Faces Trial
Prosecutors in Finland this week commenced their criminal trial against Julius Kivimäki, a 26-year-old Finnish man charged with extorting a once popular and now-bankrupt online psychotherapy practice and thousands of its patients. In a 2,200-page report, Finnish authorities laid out how they connected the extortion spree to Kivimäki, a notorious hacker who was convicted in 2015 of perpetrating tens of thousands of cybercrimes, including data breaches, payment fraud, operating a botnet and calling in bomb threats.

Read more »

Vulnerability Summary for the Week of November 6, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1e -- platform The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45161MISCMISC 1e -- platform The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-CommandLinePing instruction to v18.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45163MISCMISC 1e -- platform The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue DELETE the instruction "Show dialogue with caption %Caption% and message %Message%" from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as "Show %Type% type notification with header %Header% and message %Message%" with a version of 7.1 or above. 2023-11-06 7.2 CVE-2023-5964MISCMISC 7-zip -- 7-zip 7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z archive. 2023-11-03 7.8 CVE-2023-31102MISCMISCMISC advanced_export_products_orders_cron_csv_excel_project -- advanced_export_products_orders_cron_csv_excel Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table. 2023-11-07 7.5 CVE-2023-43984 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-3889 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-4295 asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services. 2023-11-03 8.8 CVE-2023-41345MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41346MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41347MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41348MISC asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_ln 2C318 function. 2023-11-09 9.8 CVE-2023-47005 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ipaddr field in the sub_6FC74 function. 2023-11-09 9.8 CVE-2023-47006 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_391B8 function. 2023-11-09 9.8 CVE-2023-47007 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the ifname field in the sub_4CCE4 function. 2023-11-09 9.8 CVE-2023-47008 best_courier_management_system -- best_courier_management_system An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. 2023-11-03 9.8 CVE-2023-46980MISCMISC bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. 2023-11-03 7.5 CVE-2023-41259MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. 2023-11-03 7.5 CVE-2023-41260MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. 2023-11-03 7.5 CVE-2023-45024MISCCONFIRM bleachbit -- bleachbit BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0. 2023-11-08 7.3 CVE-2023-47113 boltwire -- boltwire An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. 2023-11-07 9.1 CVE-2023-46501   botan_project -- botan bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password. 2023-11-03 7.5 CVE-2017-7252CONFIRMMISC clickbar -- dot-diver Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability. 2023-11-06 9.8 CVE-2023-45827MISCMISC couchbase -- couchbase_server Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. 2023-11-08 7.5 CVE-2023-36667   djangoproject -- django In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. 2023-11-03 7.5 CVE-2023-41164CONFIRMMISC   djangoproject -- django In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. 2023-11-03 7.5 CVE-2023-43665CONFIRMMISC   ec-cube -- ec-cube EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege. 2023-11-07 7.2 CVE-2023-46845   eclipse -- glassfish In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners. 2023-11-03 9.8 CVE-2023-5763MISCMISC eclipse -- parsson In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale. 2023-11-03 7.5 CVE-2023-4043MISCMISC espressif -- esptool An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. 2023-11-09 7.5 CVE-2023-46894 wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin

Read more »

Microsoft Patch Tuesday, November 2023 Edition
Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three "zero day" vulnerabilities that Microsoft warns are already being exploited in active attacks.

Read more »

13-inch M2 MacBook Airs are on Holiday sale for $150-$200 off MSRP, prices start at only $949
Best Buy has Apple 13" MacBook Airs with M2 CPUs in stock and back on Holiday sale for $150-$200 off MSRP in Space Gray, Silver, Starlight, and Midnight colors. Their prices are among the lowest currently available for new 13" M2 MacBook Airs. - 13" M2 MacBook Air (8GB RAM/256GB SSD): $949 $150 off MSRP - 13" M2 MacBook Air (8GB RAM/512GB SSD): $1199 $200 off MSRP Prices valid for online orders only. In-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker. The post first appeared on MacPrices.net.

Read more »

15-inch M2 MacBook Airs are back on Holiday sale for $250 off MSRP at these Apple retailers
Apple retailers have 15-inch M2 MacBook Air back on Holiday sale for $250 off MSRP. Here is where to find the cheapest 15" Air today: (1): Apple 15-inch MacBook Airs with M2 CPUs are in stock and on sale on Best Buy's online store for $250 MSRP in Space Gray, Silver, Starlight, and Midnight colors: - 15" M2 MacBook Air 8-core M2/8-core GPU (8GB RAM/256GB SSD): $1049 $250 off MSRP - 15" M2 MacBook Air 8-core M2/10-core GPU (8GB RAM/512GB SSD): $1249 $250 off MSRP Prices valid for online orders only. In-store prices may vary. Order online and choose free shipping or free local store pickup (if available). (2): Amazon has 15" MacBook Airs with M2 CPUs in stock today and on sale for $250 off Apple's MSRP as well. Shipping is free with delivery in time for Christmas: - 15" MacBook Air 8-core M2/8-core GPU (8GB RAM/256GB SSD): $1049 $250 off MSRP - 15" MacBook Air 8-core M2/10-core GPU (8GB RAM/512GB SSD): $1249 $250 off MSRP For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Update: Apple Watch Series 9 models now $70 off MSRP on Walmart’s online store
Walmart has Apple Watch Series 9 models on Holiday sale for $70 off MSRP on their online store this weekend (that's $20 cheaper than their earlier price). Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 41mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $329, save $70 - 45mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $359, save $70 - 41mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $429, save $70 - 45mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $459, save $70 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple’s AirTags 4-Pack is on Holiday sale for $19 off MSRP this weekend, only $80
Apple retailers have 4-pack AirTags on sale this weekend for $19 off MSRP as part of their Holiday sales. These make a great stocking stuffer: (1): Amazon has Apple AirTags 4 Pack on sale for $79.99, shipped, as part of their Holiday sale. That's $20 off MSRP. A single Apple AirTag is on sale for $27 shipped. That's $4 off. (2): Walmart has Apple AirTags 4 Pack on sale for $80. That's $20 off MSRP. A single Apple AirTag is also on sale for $27. That's equals Amazon's discount. Walmart's prices are for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup, if available. For the latest prices and sales, see our AirTags Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Sunday Sale: $100 off every Apple iPad mini 6
Amazon is offering Apple's 8.3" iPad minis for $100 off MSRP, including free shipping, as part of their Holiday sale this weekend. Prices start at $399. Amazon's prices are the lowest currently available for these minis from any Apple retailer we track: - 64GB WiFi iPad mini 6 (all colors): $399.99 $100 off MSRP - 256GB WiFi iPad mini 6 (all colors): $549.99 $100 off MSRP - 64GB WiFi + Cellular iPad mini 6 (all colors): $549.99 $100 off MSRP - 256GB WiFi + Cellular iPad mini 6 (all colors): $699.99 $100 off MSRP For the latest prices and sale, keep an eye on our iPad mini Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

16-inch M3 Pro MacBook Pros (18GB/512GB) are on Holiday sale for $2249 this weekend, $250 off MSRP
Looking for the best price on a 16" M3 Pro MacBook Pro this Holiday shopping season? B&H and Amazon are currently offering a $250 discount on the 16" M3 Pro MacBook Pro (18GB RAM/512GB SSD), reducing its price to $2249. Their prices are the lowest available on a new 16" M3 Pro MacBook Pro from any Apple retailer this weekend: - 16" M3 Pro MacBook Pro (18GB/512GB) Black or Silver: $2249 at B&H Photo, $250 off MSRP - 16" M3 Pro MacBook Pro (18GB/512GB) Black or Silver: $2249 at Amazon, $250 off MSRP B&H offers free 1-2 day shipping, while Amazon offers free standard shipping. For the latest prices and sales, see our 16" MacBook Pro Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch SE models on Holiday sale for $50 off MSRP this weekend
Walmart has Apple Watch SE GPS-only models on Holiday sale on their online store for $50 off MSRP this weekend. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). Their prices are the lowest currently available for SE Watches: - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $229, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch Series 9 models on Holiday sale this weekend for $50 off MSRP on Walmart’s online store
Walmart has Apple Watch Series 9 models on Holiday sale for $50 off MSRP on their online store this weekend. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 41mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $349, save $50 - 45mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $379, save $50 - 41mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $449, save $50 - 45mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $479, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple has the 13-inch M2 MacBook Air in stock today starting at only $929, Certified Refurbished
Apple has Certified Refurbished 13" M2 MacBook Airs available starting at only $929 and ranging up to $210 off MSRP. These are the cheapest M2-powered MacBooks for sale at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Space Gray: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Silver: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Starlight: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Midnight: $929, $170 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Space Gray: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Silver: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Starlight: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Midnight: $1189, $210 off MSRP According to Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple has the 13-inch M2 MacBook Air in stock today starting at only $929, Certified Refurbished
Apple has Certified Refurbished 13" M2 MacBook Airs available starting at only $929 and ranging up to $210 off MSRP. These are the cheapest M2-powered MacBooks for sale at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Space Gray: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Silver: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Starlight: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Midnight: $929, $170 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Space Gray: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Silver: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Starlight: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Midnight: $1189, $210 off MSRP According to Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple has the 13-inch M2 MacBook Air in stock today starting at only $929, Certified Refurbished
Apple has Certified Refurbished 13" M2 MacBook Airs available starting at only $929 and ranging up to $210 off MSRP. These are the cheapest M2-powered MacBooks for sale at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Space Gray: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Silver: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Starlight: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Midnight: $929, $170 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Space Gray: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Silver: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Starlight: $1189, $210 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Midnight: $1189, $210 off MSRP According to Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple’s 10th-generation iPads on Holiday sale this weekend for record-low prices, $100 off MSRP
Amazon has Apple's 10th-generation WiFi iPads on sale for $100 off MSRP, starting at only $349, as part of their Holiday sales this weekend. With the discount, Amazon's prices are the lowest we've seen for these iPads: - 10" 10th-generation 64GB WiFi iPads: $349 $100 off MSRP - 10" 10th-generation 256GB WiFi iPads: $499 $100 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $499 $100 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $649 $100 off MSRP Note that Amazon's prices are dynamic, and the sale price may vary depending on model and color. See their site for the latest information. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »