Vulnerability Summary for the Week of April 12, 2021
Original release date: April 19, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges to NT SYSTEM. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 7.2 CVE-2020-13532 MISC fluidsynth -- fluidsynth FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can result in arbitrary code execution or a denial of service (DoS) if a malicious soundfont2 file is loaded into a fluidsynth library. 2021-04-13 7.5 CVE-2021-28421 MISC MISC google -- android In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a malicious NFC packet with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-178725766 2021-04-13 10 CVE-2021-0430 MISC indionetworks -- unibox_u50_firmware Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device. 2021-04-09 9.3 CVE-2020-21884 MISC MISC MISC indionetworks -- unibox_u50_firmware Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover. 2021-04-09 9 CVE-2020-21883 MISC MISC MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28480 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28481 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28483. 2021-04-13 9 CVE-2021-28482 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28482. 2021-04-13 7.7 CVE-2021-28483 MISC microsoft -- windows_10 Azure AD Web Sign-in Security Feature Bypass Vulnerability 2021-04-13 7.5 CVE-2021-27092 MISC microsoft -- windows_10 Windows Hyper-V Denial of Service Vulnerability 2021-04-13 7.8 CVE-2021-26416 MISC online_book_store_project -- online_book_store SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication. 2021-04-09 7.5 CVE-2020-23763 MISC MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27236 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27235 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27234 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27233 MISC rust-lang -- rust In the standard library in Rust before 1.53.0, a double free can occur in the Vec::from_iter function if freeing the element panics. 2021-04-14 7.5 CVE-2021-31162 MISC MISC sonicwall -- email_security A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. 2021-04-09 7.5 CVE-2021-20021 CONFIRM sonicwall -- global_management_system A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. 2021-04-10 10 CVE-2021-20020 CONFIRM trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25250 N/A N/A N/A trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25253 N/A N/A N/A trendmicro -- apex_one An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-28645 N/A N/A N/A windriver -- vxworks An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client. 2021-04-13 7.5 CVE-2021-29998 MISC windriver -- vxworks An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server. 2021-04-13 7.5 CVE-2021-29999 MISC zerof -- expert The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. 2021-04-13 7.5 CVE-2021-30176 MISC MISC zerof -- web_server ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. 2021-04-13 7.5 CVE-2021-30175 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accessally -- accessally In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required. 2021-04-12 5 CVE-2021-24226 CONFIRM atlassian -- data_center The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. 2021-04-09 5 CVE-2020-36287 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 with weak privileges which can lead to privilege escalation when used. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 6.8 CVE-2020-13534 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs in and uses the application. 2021-04-09 4.4 CVE-2020-13533 MISC fortinet -- fortiadc A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files. 2021-04-12 4 CVE-2021-24024 CONFIRM google -- android In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171221090 2021-04-13 5.4 CVE-2021-0433 MISC google -- android In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-152064592 2021-04-13 4.4 CVE-2021-0438 MISC google -- android In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790 2021-04-13 4.4 CVE-2021-0432 MISC google -- android In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174768985 2021-04-13 4.6 CVE-2021-0442 MISC google -- android In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174243830 2021-04-13 4.6 CVE-2021-0439 MISC google -- android In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176168330 2021-04-13 4.6 CVE-2021-0437 MISC google -- android In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175074139 2021-04-13 4.6 CVE-2021-0429 MISC google -- android In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174485572 2021-04-13 4.6 CVE-2021-0426 MISC google -- android In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174150451 2021-04-13 5 CVE-2021-0435 MISC google -- android In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174149901 2021-04-13 5 CVE-2021-0431 MISC google -- android In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174488848 2021-04-13 4.6 CVE-2021-0427 MISC google -- chrome Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21195 MISC MISC google -- chrome Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21194 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21196 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21197 MISC MISC google -- chrome Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21199 MISC MISC google -- chrome Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2021-04-09 4.3 CVE-2021-21198 MISC MISC ibm -- collaborative_lifecycle_management IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422. 2021-04-12 5 CVE-2020-4965 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198441. 2021-04-12 4.3 CVE-2021-20519 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419. 2021-04-12 4 CVE-2020-4964 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396. 2021-04-12 4.3 CVE-2020-4920 XF CONFIRM intelliants -- subrion Cross Site Scripting (XSS) vulnerability in subrion CMS Version

Read more »

Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?
On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy.

Read more »

How to Encrypt and Password Protect Files on Your Mac
Encrypting folders and files on your Mac is a good idea. This ultimate guide covers how to encrypt files using Apple’s built-in password protection features. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI Remote Code Execution
This Metasploit module exploits a command injection vulnerability in the /admin/monitoringplugins.php page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows an authenticated admin user to achieve remote code execution as the apache user by uploading a malicious plugin. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both running on CentOS 7.

Read more »

500 Million More Reasons to Talk About Facebook – Intego Mac Podcast Episode 183
Scammers have a new technique for delivering malware: using online contact forms. A couple of browsers are nixing Google's FLoC ad tracking technology. The FBI has been playing white hat hacker. And e talk about Facebook, and especially the "off-Facebook activity" that tracks you across the internet. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI getprofile.sh Remote Command Execution
This Metasploit module exploits a vulnerability in the getprofile.sh script of Nagios XI versions prior to 5.6.6 in order to upload a malicious check_ping plugin and thereby execute arbitrary commands. For Nagios XI 5.2.0 through 5.4.13, the commands are run as the nagios user. For versions 5.5.0 through 5.6.5, the commands are run as root. Note that versions prior to 5.2.0 will still be marked as being vulnerable however this module does not presently support exploiting these targets. The module uploads a malicious check_ping plugin to the Nagios XI server via /admin/monitoringplugins.php and then executes this plugin by issuing a HTTP GET request to download a system profile from the server. For all supported targets except Linux (cmd), the module uses a command stager to write the exploit to the target via the malicious plugin. This may not work if Nagios XI is running in a restricted Unix environment, so in that case the target must be set to Linux (cmd). The module then writes the payload to the malicious plugin while avoiding commands that may not be supported. Valid credentials for a user with administrative privileges are required. This module was successfully tested on Nagios XI 5.3.0 and Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before 5.5.0, it may take a significant amount of time for the payload to get back (up to 5 minutes). If exploitation fails against an older system, it is recommended to increase the WfsDelay setting (default is 300 seconds).

Read more »

Microsoft Patch Tuesday, April 2021 Edition
Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server -- the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild.

Read more »

ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users
Someone is selling account information for 21 million customers of ParkMobile, a mobile parking app that's popular in North America. The stolen data includes customer email addresses, phone numbers, license plate numbers, hashed passwords and mailing addresses.

Read more »

Facebook, Google, and Stolen iPhones – Intego Mac Podcast Episode 182
Facebook leaks 500 million user records, Google is testing a new replacement for cookies to track users, and we explain how to check if that used iPhone you want to buy is stolen. The post appeared first on The Mac Security Blog.

Read more »

How to remove GPS location data from photos on iPhone or Mac
Your photos can store the location where you shot them, but you don't always want them to, especially if you share them. Here's how to remove location data from photos on iOS and Mac. The post appeared first on The Mac Security Blog.

Read more »

The Ultimate Guide to Backups and Storage for iPhone and iPad
You can back up your iPhone or iPad to iCloud, but not all their data gets backed up. If you back up your devices to your Mac, everything is backed up. The post appeared first on The Mac Security Blog.

Read more »

Is Apple Looking To Its Past For Inspiration With The Designs Of Its New Macs?
FEATURE: 04.20.21 – Apple seems to be getting a bit nostalgic over the Mac when it comes to updating its design… back to the late 1990s and early 2000s to be exact. The first Apple Event of 2021 — teased as a, “Spring Loaded” special event — is predicted to see the unveiling of a brand new iMac with Apple silicon inside. While the exact details of its expected design overhaul are not yet known (could it hearken back to the spring-loaded floating display of the iMac G4 from 2002?), one thing’s for sure. Will a new Apple silicon-based iMac sporting a wide array of metallic color finishes, reminiscent of the “fruit-flavored” iMacs of the late 1990s as seen photographed above, be announced at the first Apple Event of 2021? (Photo: Apple, Inc.) No matter what new hardware and/or devices are announced by Apple at the “Spring Loaded” special event, there’s evidence that the Cupertino, California-based company may be going backwards in time and looking to its past (as opposed to springing forward, as it were) with the future product designs of its upcoming Macs. **AD: No matter what new products may be announced by Apple at its “Spring Loaded” special event? Before you pull out your Apple Card (or whatever form of payment you have on hand) and spring for one, or all, of the company’s newest hardware and devices, point your browser to MacPrices.net and consult our exclusive and award winning price trackers for the lowest prices, best deals, and latest discounts offered at Apple’s online and retail stores (as well as Apple Authorized Resellers, too). Pricing updated daily, seven days a week! iMacs With Color? ‘Yum.’ Back in February of this year, iMore — a website whose “authoritative team” helps people to get the most out of life from their Apple products — reported that Apple is expected to replace the iMac with an updated model later this year. Citing a report from Jon Prosser → Read More...

Read more »

No trade-in? AT&T still offers Apple iPhones to new and existing customers starting at only $5 per month
AT&T is offering Apple’s previous-generation 64GB iPhone 11 for $10 per month, for new or existing customers, no trade-in required. Discount is applied via monthly bill credits over a 30 month period. The fine print: “Get the iPhone 11 64GB for $10/mo., 128GB for $15/mo., or 256GB for $20/mo. for 30 mos. when you buy it on a qualifying installment agreement with eligible wireless. No trade-in required.” The same no trade-in deal is offered with a couple of other iPhone models as well: – iPhone SE: 64GB for $5/mo., 128GB for $10/mo., and 256GB for $15/month. – iPhone XS: 64GB for $5/mo., 256GB for $10 per month. AT&T’s offers are live on their site now. For the latest prices & deals, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

This wireless carrier has the Apple iPhone SE on sale for only $249, $150 off MSRP
Boost Mobile is offering Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249. 128GB models are offered at a $50 discount: $399. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is one of the cheapest no-contract 2020 iPhones we’ve seen available anywhere. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

Amazon drops prices on iPad Pros before Apple’s special event on the 20th, offers models from only $729
Apple is widely expected to introduce new iPad Pros during their spring 2021 special event on April 20th. In front of this event, Amazon has dropped prices on 2020 11″ and 12″ iPad Pros by up to $100 off Apple’s MSRP. These are the same iPad Pros sold by Apple in its retail and online stores. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free. Note that some sale prices may be restricted to either Space Gray or Silver colors: – 11″ 128GB WiFi iPad Pro: $729.99 $70 off – 11″ 256GB WiFi iPad Pro: $799.99 $100 off – 11″ 512GB WiFi iPad Pro: $999.99 $100 off – 11″ 1TB WiFi iPad Pro: $1199 $100 off – 11″ 128GB WiFi + Cellular iPad Pro: $879.99 $70 off – 11″ 256GB WiFi + Cellular iPad Pro: $949.99 $100 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $100 off – 11″ 1TB WiFi + Cellular iPad Pro: $1349.99 $100 off – 12″ 128GB WiFi iPad Pro: $929.99 $70 off – 12″ 256GB WiFi iPad Pro: $999 $100 off – 12″ 512GB WiFi iPad Pro: $1199 $100 off – 12″ 1TB WiFi iPad Pro: $1399.99 $100 off – 12″ 128GB WiFi + Cell iPad Pro: $1079.99 $70 off – 12″ 256GB WiFi + Cell iPad Pro: $1149.99 $100 off – 12″ 512GB WiFi + Cell iPad Pro: $1349 $100 off – 12″ 1TB WiFi + Cell iPad Pro: $1549.99 $100 off Keep an eye on our 11″ iPad Pro Price Tracker and our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Sunday Sale: 13″ M1 MacBook Pros for $200-$230 off MSRP, Certified Refurbished, at Apple
Apple has a full line of 2020 13″ M1 MacBook Pros available Certified Refurbished, starting at only $1099 and up to $230 off original MSRP. These are the cheapest M1 MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Pro/256GB SSD/Space Gray: $1099 $200 off MSRP – 13″ M1 MacBook Pro/512GB SSD/Space Gray: $1269 $230 off MSRP – 13″ M1 MacBook Pro/256GB SSD/Silver: $1099 $200 off MSRP – 13″ 13″ M1 MacBook Pro/512GB SSD/Silver: $1269 $230 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Roundup of Today’s Best 13″ M1 MacBook Pro Deals from Apple’s Authorized Resellers
Apple resellers are offering sale prices on Apple’s M1-powered 13″ MacBook Pro ranging up to $230 off MSRP. Here’s where to pick one up today, and as always, keep an eye on our 13″ MacBook Pro Price Tracker for the latest deals: 13″ M1 MacBook Pro/256GB SSD. MSRP: $1299 – 13″ M1 MacBook Pro/256GB SSD: $1099 at Apple, Certified Refurbished $200 off MSRP – 13″ M1 MacBook Pro/256GB SSD: $1199 at Apple Education $100 off MSRP – 13″ M1 MacBook Pro/256GB SSD: $1199 at Amazon $100 off MSRP – 13″ M1 MacBook Pro/256GB SSD: $1199 at Abt $100 off MSRP – 13″ M1 MacBook Pro/256GB SSD: $1199 at B&H $100 off MSRP – 13″ M1 MacBook Pro/256GB SSD: $1199 at DataVision $100 off MSRP, no sales tax in 42 US states 13″ M1 MacBook Pro/512GB SSD. MSRP: $1499 – 13″ M1 MacBook Pro/512GB SSD: $1269 at Apple, Certified Refurbished $230 off MSRP – 13″ M1 MacBook Pro/512GB SSD: $1399 at Apple Education $100 off MSRP – 13″ M1 MacBook Pro/512GB SSD: $1399 at Amazon $100 off MSRP – 13″ M1 MacBook Pro/512GB SSD: $1399 at B&H $100 off MSRP – 13″ M1 MacBook Pro/512GB SSD: $1399 at Abt $100 off MSRP – 13″ M1 MacBook Pro/512GB SSD: $1399 at DataVision $100 off MSRP, no sales tax in 42 US states All of these resellers offer → Read More...

Read more »

Roundup of Today’s Best M1 Mac mini Prices and Deals among Apple’s Authorized Resellers
Apple resellers are offering discounts on new M1 Mac minis ranging up to $140 off MSRP this week, with prices starting at only $589. These are all the same Mac minis sold by Apple in their retail and online stores. And as always, keep an eye on our Mac mini Price Tracker for the latest prices & sales. Here’s where to get the best price on an M1 Mac mini today: M1 Mac mini/256GB SSD: – Mac mini M1 CPU/256GB SSD: $589 at Apple, Certified Refurbished $110 off MSRP – Mac mini M1 CPU/256GB SSD: $669 at Abt $30 off MSRP – Mac mini M1 CPU/256GB SSD: $669.99 at Amazon $30 off MSRP – Mac mini M1 CPU/256GB SSD: $669.99 at B&H $30 off MSRP M1 Mac mini/512GB SSD: – Mac mini M1 CPU/512GB SSD: $759 at Apple, Certified Refurbished $140 off MSRP – Mac mini M1 CPU/512GB SSD: $799.99 at Amazon $100 off MSRP – Mac mini M1 CPU/512GB SSD: $829 at B&H $70 off MSRP – Mac mini M1 CPU/512GB SSD: $836 at Abt $63 off MSRP All resellers are offering → Read More...

Read more »

New at Verizon: Apple iPhone SE for free with new line of service
Verizon is offering the 64GB Apple iPhone SE for free for customers opening a new line of service with a Verizon Unlimited plan. Offer is valid for a limited time. Price is credited monthly over a 24 month period. No trade in is required. Upgrade to 128GB model for $5/month or the 256GB SE for $10/month. The fine print: “$399.99 device payment purchase or full retail price purchase w/new smartphone line on Unlimited req’d. Less $399.99 promo credit applied over 24 mos.; promo credit ends if eligibility req’s are no longer met; 0% APR.” Verizon’s offer is live on their site → Read More...

Read more »

B&H is offering clearance prices on leftover 2020 13″ 4-core Intel MacBook Pros, models start at only $1099
Apple reseller B&H Photo has clearance 2020 13″ 1.4GHz Intel-based MacBook Pros on sale today for $200-$300 off Apple’s original MSRP with prices starting at only $1099. Expedited shipping is free to most US addresses. B&H is offering the lowest prices for these models: – 2020 13″ 1.4GHz/256GB MacBook Pro Space Gray: $1099 $200 off MSRP – 2020 13″ 1.4GHz/256GB MacBook Pro Silver: $1099 $200 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Space Gray: $1199 $300 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Silver: $1199 $300 off MSRP For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Roundup of Today’s Best MacBook Deals: M1 MacBook Airs for $50-$190 off MSRP
Apple resellers are offering sale prices on Apple’s M1-powered 13″ MacBook Airs ranging up to $190 off MSRP. Here’s where to pick one up today, and as always, keep an eye on our 13″ MacBook Air Price Tracker for the latest deals: 8-Core M1 Silicon CPU, 7-Core GPU. MSRP: $999 – 13″ MacBook Air/256GB SSD: $849 at Apple, Certified Refurbished $150 off MSRP – 13″ MacBook Air/256GB SSD: $899 at Apple Education $100 off MSRP – 13″ MacBook Air/256GB SSD: $948 at Expercom $51 off MSRP – 13″ MacBook Air/256GB SSD: $949 at Amazon $50 off MSRP – 13″ MacBook Air/256GB SSD: $949 at Abt $50 off MSRP – 13″ MacBook Air/256GB SSD: $949 at B&H $50 off MSRP 8-Core M1 Silicon CPU, 8-Core GPU. MSRP: $1249 – 13″ MacBook Air/512GB SSD: $1059 at Apple, Certified Refurbished $190 off MSRP – 13″ MacBook Air/512GB SSD: $1149 at Amazon $100 off MSRP – 13″ MacBook Air/512GB SSD: $1149 at B&H $100 off MSRP – 13″ MacBook Air/512GB SSD: $1149 at Apple Education $100 off MSRP All of these resellers offer → Read More...

Read more »

Apple AirPods Pro drop to new low price of only $197, $52 off MSRP
Amazon has Apple’s AirPods Pro on sale today for a new low price of only $197 shipped. That’s $52 off MSRP and the lowest price currently available for a set of AirPods Pro from any Apple reseller. For the latest prices and sales, see our Apple AirPods Price Tracker, → Read More...

Read more »

Apple restocks clearance 13″ Intel-based MacBook Airs starting at only $809, Certified Refurbished
Apple has clearance, Certified Refurbished, 2020 13″ Intel-based MacBook Airs available starting at only $809 and up to $280 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Silver: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Gold: $809 $190 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Space Gray: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Silver: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Gold: $1019 $280 off MSRP The dual-core model is the cheapest MacBook for sale today at Apple. Check their site for the latest stock status, and note that Apple may sell out at any time. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »