TikTok introduces Shazam-like feature that lets you find songs by singing them
You’re probably familiar with Shazam, an Apple-owned app that lets you find out the name of a song playing near you. However, TikTok wants to take this experience to the next level by introducing a Shazam-like feature that lets users find songs by singing them. more…

Read more »

White House Announces New AI Actions As Apple Signs On To Voluntary Commitments
The White House announced that Apple has "signed onto the voluntary commitments" in line with the administration's previous AI executive order. "In addition, federal agencies reported that they completed all of the 270-day actions in the Executive Order on schedule, following their on-time completion of every other task required to date." From a report: The executive order "built on voluntary commitments" was supported by 15 leading AI companies last year. The White House said the agencies have taken steps "to mitigate AI's safety and security risks, protect Americans' privacy, advance equity and civil rights, stand up for consumers and workers, promote innovation and competition, advance American leadership around the world, and more." It's a White House effort to mobilize government "to ensure that America leads the way in seizing the promise and managing the risks of artificial intelligence," according to the White House. Read more of this story at Slashdot.

Read more »

9to5Rewards: MacBook Pro giveaway + Chargeasap Connect Pro 100W cable [Giveaway]
This month we’ve partnered with our friends at Chargeasap to give away Apple’s latest MacBook Pro to one lucky reader to celebrate the launch of the company’s new Connect Pro 100W magnetic USB charging cables. You can head below now to enter the giveaway and check out the new ConnectPro by Chargeasap. more…

Read more »

Apple updates fourth betas of iOS 18 and iPadOS 18 for developers
Apple has pushed out a revised fourth beta build for both iOS 18 and iPadOS 18. The unexpected update comes shortly after the initial beta 4… The post appeared first on MacDailyNews.

Read more »

Apple rolls out minor update to iOS 18 & iPadOS 18 beta 4
Late on Friday, Apple uncharacteristically issued an update to its current developer beta four of both iOS 18 and iPadOS 18.iOS 18On Friday, Apple released an update to its fourth developer beta for iOS 18 and iPadOS 18. The build numbers on both were previously 22A5316j and now are 22A5316K.Apple has not said what the update entails, so it's likely a security or urgent bug fix that couldn't wait for the next expected refresh. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple releases new version of iOS 18 beta 4 for developers
Apple has released an updated version of iOS 18 beta 4 for developers. The new version comes just days after the original developer beta 4. more…

Read more »

Meta’s WhatsApp hits 100 million monthly users in the U.S.
Meta CEO Mark Zuckerberg revealed this week that WhatsApp has surpassed 100 million monthly active users in the United States… The post appeared first on MacDailyNews.

Read more »

Keychron K10 Pro review: All-rounder and affordable keyboard
The Keychron K10 Pro mechanical keyboard is a great pick for Apple users who want a 100% layout that doesn't break the bank.Keychron K10 Pro reviewKeychron makes mechanical keyboards in all sizes and price ranges. The K10 falls in the middle of the road between budget models like the C3 Pro and the more expensive Q5 Pro.Whether you're all about customization or just want something to type on, the K10 brings something to the table. As-is, the typing and upkeep experience is fun and easy, and it's equally simple to mess around with key switches and macros. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Keychron K10 Pro review: All-rounder and affordable keyboard
The Keychron K10 Pro mechanical keyboard is a great pick for Apple users who want a 100% layout that doesn't break the bank.Keychron K10 Pro reviewKeychron makes mechanical keyboards in all sizes and price ranges. The K10 falls in the middle of the road between budget models like the C3 Pro and the more expensive Q5 Pro.Whether you're all about customization or just want something to type on, the K10 brings something to the table. As-is, the typing and upkeep experience is fun and easy, and it's equally simple to mess around with key switches and macros. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

iCloud Private Relay Down: Here’s How to Turn It Off to Avoid Connectivity Problems
Apple’s iCloud Private Relay traffic anonymization service is down for some users, causing various connectivity problems in Safari and other apps. If you’re experiencing problems, turn off iCloud Private Relay temporarily.

Read more »

Use your iPhone to instantly identify plants with this AI-powered app
The Plantum plant ID app uses your iPhone for fast plant identification by photo. It even offers growing tips for gardeners! (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple Music launches new ‘radio spins’ data for artists and labels
Apple is rolling out a new feature to its Apple Music for Artists platform this week. The company says that artists can now see “when and where” their music is being played on radio stations around the world… more…

Read more »

If Apple Mail won’t load images due to ‘network settings,’ here’s why
Macworld If you’ve opened your Mail app this week on your iPhone or Mac and had an issue loading images, it’s not your network. And it’s seemingly related to a feature you might not even be using. According to Apple’s System Status page, there is an issue with iCloud Private Relay this week. iCloud Private Relay acts something like a VPN to keep your DNS records and IP address hidden using a “single, secure connection to maintain privacy and performance.” When that connection gets disrupted, there can be problems. Since Thursday, Apple has reported an ongoing Private Relay outage affecting “some” iCloud+ users. which can affect the experience within apps that use iCloud+, including Safari and Mail. In this case, the issues appear to be manifesting as an error message that appears when new Mail messages arrive: “Your network settings prevent content from loading privately.” Based on the timing, it appears related to the Private Relay issue, which is preventing images from loading as a security measure. In this case, “network settings” doesn’t refer to your home Wi-Fi or wireless connection, but rather the Private Relay mechanism. As long as the problem persists, the message will appear, and Apple doesn’t offer any time frame for when it will be fixed. In the meantime, you have two options: Click the Load Content button under the error message when you need to see an image in an email. Turn off iCloud Private Relay in Settings > Apple ID > iCloud > iCloud Private Relay. However, some iCloud+ users are still seeing the error message despite having iCloud Private Relay turned off on their account, so the issue appears to be affecting iCloud+ accounts that aren’t using the feature. Apple hasn’t updated its status page since the issue was confirmed at 2:34 p.m. PT Thursday, so it’s unclear how widespread the issue is or when it might be restored.

Read more »

Apple TV+ series ‘For All Mankind’ creator Ronald D. Moore give update on ‘Star City’ spin-off
Apple TV+ renewed its globally acclaimed, hit space drama “For All Mankind” for season five and announced a new spinoff series “Star City.” The post appeared first on MacDailyNews.

Read more »

The best MacBook for every student–and how to get the best price
Macworld When it comes to buying a MacBook for school, students are usually in a situation where personal budgets are tight and money needs to be spent wisely. It’s not enough to say that students need the right amount of processing power for the work at hand–students also need to get a good deal and a machine that will last for many years. Finding a good deal is a chore, but we’re here to help. Our automatically-updated price comparison tool helps to make sure you’re getting the best deal and on top of that, we hand-pick deals we think you should look at. What follows below are our MacBook recommendations for students, along with the top deals. Beyond that, we offer tips and information you should know about shopping as a student, so you can save money. Read on, or click the links in the Table of Contents to skip to the section you’re interested in. Read our guide for the best Macs for students if you’re interested in a desktop or laptop computer. Best MacBook Air deals right now Here are some of the best deals we are seeing right now. Best U.S. MacBook Air deals for students Walmart, 13-inch Macbook Air (M1, 256GB SSD): $649 ($350 off, MSRP was $999) Amazon, 13-inch MacBook Air (M2, 256GB SSD): $889 ($100 off, MSRP, $999) Amazon: 13-inch MacBook Air (M4, 256GB SSD): $999 ($100 off MSRP, $1,099) Best U.K. MacBook Air deals for students KRCS, 13-inch MacBook Air, M3 (10-core GPU, 16GB RAM, 512GB) £1,424 (£75 off, RRP £1,499) KRCS, 15-inch MacBook Air, M3 (10-core GPU, 256GB) £1,234 (£65 off, RRP £1,299) KRCS, 15-inch MacBook Air, M3 (10-core GPU, 16GB RAM, 512GB) £1,614 (£85 off, RRP £1,699) For more deals take a look at the best MacBook Air deals this month. Best MacBook Pro deals right now Here are some of the best deals we are seeing right now. Best U.S. MacBook Pro deals for students Amazon, 14-inch MacBook Pro (M3, 8-core CPU, 10-core GPU, 512GB): $1,399 ($200 off, MSRP $1,599) Amazon, 14-inch MacBook Pro (M3 Pro, 12-core GPU, 18-core GPU, 1TB): $2,200 ($199 off, MSRP $2,399) Amazon, 16-inch MacBook Pro (M3 Pro, 12‑core CPU, 18‑core GPU, 512GB): $2,349 ($150 off, MSRP $2,499) Best U.K. MacBook Pro deals for students Amazon, 14-inch MacBook Pro (M3 Pro, 10-core GPU, 14-core GPU, 512GB): £1,540 (£159 off, MSRP £1,699) Amazon, 14-inch MacBook Pro with M3 (8-core CPU, 10-core GPU), 8GB RAM, 1TB SSD: £1,700 (£199 off, MSRP £1,899) Amazon, 14-inch MacBook Pro with M3 Pro (11-core CPU, 14-core GPU), 18GB RAM, 512GB SSD: £1,880 (£219 off, MSRP £2,099) Amazon, 14-inch MacBook Pro with M3 Pro (12-core CPU, 18-core GPU), 18GB RAM, 1TB SSD: £2,230 (£269 off, MSRP £2,499) For up-to-date deals see: Best MacBook Pro deals this month. Best MacBook for high school: M2 MacBook Air The MacBook Air is Apple’s most popular laptop, and for good reason–it’s an excellent combination of processing power, portability, and price. Its M-series processor handles every task–writing papers, presentations, internet research, and even video and audio editing. And when your homework is done, kick back with an Apple TV show or escape with a video game. The best part is you can get one for less than $1,000. The M2 MacBook Air has a 13.3-inch Retina display, and inside its 2.7-pound (1.24-kilogram) body is an M2 processor with 8 CPU cores, 8 GPU cores, 8GB of memory, and a 256GB SSD. It has Wi-Fi built in for connecting to the internet, and two Thunderbolt/USB-C ports for connecting devices. And if you check Amazon or Best Buy, you can usually find it for $900 or lower. New Refurbished Retailer Price $899 View Deal $899 View Deal $989 View Deal $999 View Deal $999 View Deal $999 View Deal $1049 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price MacBook Air (2022) 13.3-inch – Apple M2 8-core and 8-core GPU – 8GB RAM – SSD 256GB $826 View Deal MacBook Air (2022) 13.3-inch – Apple M2 8-core and 10-core GPU – 8GB RAM – SSD 256GB $836.35 View Deal MacBook Air (2022) 13.3-inch – Apple M2 8-core and 8-core GPU – 8GB RAM – SSD 256GB $839 View Deal Price comparison from Backmarket Best MacBook for college: M3 MacBook Air In college, you’re taking a step up in your studies, so you need to step up your laptop with Apple’s M3 MacBook Air. It handles everything the M2 MacBook Air does, but its M3 processor is about 20 percent faster–you’ll appreciate the faster speed when you’re putting together complex presentations and videos. The display is also a little bigger and brighter. The $1,099 13-inch M3 MacBook Air has a 13.6-inch Liquid Retina display, and it has an M3 processor with 8 CPU cores, 8 GPU cores, 8GB of memory, and a 256GB SSD. It weighs 2.7 pounds (1.24 kilograms), comes with Wi-Fi, and has two Thunderbolt/USB-C ports. New Refurbished Retailer Price $899 View Deal $899 View Deal $989 View Deal $999 View Deal $999 View Deal $999 View Deal $1049 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price MacBook Air (2022) 13.3-inch – Apple M2 8-core and 8-core GPU – 8GB RAM – SSD 256GB $826 View Deal MacBook Air (2022) 13.3-inch – Apple M2 8-core and 10-core GPU – 8GB RAM – SSD 256GB $836.35 View Deal MacBook Air (2022) 13.3-inch – Apple M2 8-core and 8-core GPU – 8GB RAM – SSD 256GB $839 View Deal Price comparison from Backmarket Best for MacBook for graduate work: 14-inch M3 Pro MacBook Pro Apple’s 14-inch MacBook Pro comes with an M3 Pro processor, which is 18 percent faster than the M3 in the MacBook Air. If you’re going into a field that involves a lot of data crunching–multimedia and the arts, engineering, or computer science, just to name a few–you’ll need a MacBook that can minimize the amount of time you’ll spend waiting to process data. The M3 Pro MacBook Pro is made for that. The $1,999 14-inch MacBook Pro has an M3 Pro with 11 CPU cores, 14 GPU cores, 18GB of memory, and a 512GB SSD. It has a Liquid Retina XDR display, three Thunderbolt/USB-C ports, an HDMI port, and an SDXC card slot. Retailer Price $1,699 View Deal $1749 View Deal $1999 View Deal $1999 View Deal $1999 View Deal $1999 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket How to use Apple’s Education Store For college students, teachers, faculty, and homeschool teachers of all grades, Apple offers discount pricing in its Education Store. The discounts range from $100/£100 to $200/£200, depending on the MacBook model. You can visit the Education Store in your country by clicking one of the links below. U.S. Apple Education Store U.K. Apple Education Store Canada Education Store Australia Education Store Students need to show proof of school registration to shop at the Apple Education Store. U.K. students need to register with UNiDAYS. We have a separate article with details on how to get an Apple student discount at Apple’s Education Store. Other ways to find MacBook deals The Apple Education Store discount is nice, but you’ll often find the same kind of markdown from third-party retailers. You can use our price comparison tool to see what retailers are offering, and we also hand-select deals in the section at the top of this page. Here are a few other ways to get a good price on a MacBook. Buy a refurbished MacBook. Apple’s Certified Refurbished Store often has good prices on laptops that are both current and past models. Refurbished products are fully reconditioned and are like new–out of the box, you can’t tell the difference between a refurbished and a new MacBook. The price savings can be good–more than the Education Store discount. The only catch is that your choices are limited to what’s in stock, which changes often. Buy an older model. With Apple’s M-series chips, the MacBook’s performance has reached new heights–to a point where a lot of users aren’t anywhere near pushing the limit. Apple is currently on the M3 series of chips, which generally offers about 20 percent more performance than the previous M2 series. But that M2 series (or even the M1) is certainly no slouch, offering a significant boost over the Intel CPUs they replaced. The M2 MacBook Pro is not only worthy of your consideration performance-wise, but it also comes at attractive prices that are often much lower than those in the Education Store. For example, the 12-inch M2 MacBook Pro that was originally priced at $1,299 can be found online for $999.

Read more »

HomeKit Weekly: Smartmi E1 is the best-looking HomeKit air purifier on the market
Air purifiers are one of my favorite HomeKit accessories. Even though I live in an area with pretty decent air quality, I keep them running around our home to clean up the air for my family. I recently picked up the new Smartmi E1, the best-looking HomeKit air purifier on the market. more…

Read more »

These are the best Apple Watch bands for working out in 2024
Whether you're looking for a durable, sweat-proof, or waterproof Apple Watch band for working out — or something comfortable and stretchy for yoga class, we've got you covered.Best Apple Watch bands for working out.Regardless of your preferred workout style, it's important to have an Apple Watch fitness band made of high-quality material that is durable, long-lasting, and reasonably priced. Additionally, it should be distraction-free so you can concentrate on your workout.While the Apple Watch silicone band is a decent choice for workouts, you might find that the silicone gets grimy after a while, and the color fades. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

9to5Mac Daily: July 26, 2024 – The latest on Apple Intelligence timing and safety
On today’s episode of 9to5Mac Daily, we discuss Apple’s agreement to AI safety guidelines established by the Biden administration ahead of the Apple Intelligence launch. We also cover Apple’s invitation to developers for an in-person Apple Intelligence recap. Additionally, we highlight that the number of Android users switching to iPhone has hit a 5-year high. Tune in for all of the latest Apple news! Sponsored by 1Password: Make sure that your family and their data are safe online. Everyone, from children to grandparents, has a digital identity – along with logins and passwords to who-knows-how-many things. Managing these accounts doesn’t have to feel like a chore. 1Password makes it easy to keep your family’s credentials safe online. Try a Free 14 day trial today. more…

Read more »

OpenAI’s Apple deal could be a bigger threat to Google than SearchGPT – analysts
OpenAI 's SearchGPT will have less of an impact on the search-engine giant’s dominance than could OpenAI’s partnership with Apple… The post appeared first on MacDailyNews.

Read more »

The biggest weakness of Apple Maps and how Apple can fix it
Apple Maps has come a long, long way since its initial release with iOS 6 in 2012, and I prefer it almost every way to Google Maps and Waze. However, there’s one reason I still find myself using Google Maps for planning: reviews, ratings, and pictures. more…

Read more »

An engineer has built a classic Mac Plus from modern parts
Apple sold the Mac Plus from 1986 to 1990 — but now this early classic Mac is back with most of the parts made this century, thanks to a very dedicated fan.That's actually a Mac Classic but the screen is showing the output from the clone Mac PlusUsually when someone tells you that they've built their own computer, nod politely and change the subject. Invariably, it's a PC, they're a gamer, and they've ordered a few components and put them together exactly the way they were intended.It's fiddly, and you can end up with a smoking box of now-worthless electronics if you're not careful. But, it's nothing like building a computer from individual chips and circuits. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple Studio Display vs Samsung ViewFinity S9 [U]
A year and a half after Apple launched its Studio Display, Samsung released a direct competitor with its ViewFinity S9 5K monitor. With many of the same features as Studio Display plus some beyond, it’s an interesting alternative. Follow along for how Studio Display vs Samsung ViewFinity S9 stack up. Update 7/26: The ($700 discount) for a limited time – making it a tempting pick over Studio Display. more…

Read more »

Foxconn eyes India for iPad production amid Apple's expansion plans
After setting up operations in India to produce iPhones, Apple assembly partner Foxconn is considering whether to do the same with iPads.Workers in a Foxconn factoryApple has been steadily working to reduce its independence on China as a main source of its manufacturing efforts, with India one of the growing production centers for iPhone. With iPhone assembly well established in India, the stage is set for expansion into other products.According to the Economic Times, Foxconn is considering the possibility of starting to produce iPads in India. Current speculation is that it plans to use its facility in Sreiperumbudur to assemble the tablets. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Listen to new Apple history podcast by two Cult of Mac alumni
A new podcast about Apple history launches this month, hosted by two longtime Mac users and Cult of Mac writers. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Raymond James hikes Apple target price to $250
Apple Intelligence is the personal intelligence system for iPhone, iPad, and Mac that combines the power of generative models with personal… The post appeared first on MacDailyNews.

Read more »

Microsoft starts campaign to make Windows security more like Mac post-CrowdStrike
CrowdStrike has nearly run its full course of damage, and Microsoft is looking ahead to prevent the next such catastrophe. Step one in the company’s playbook? Follow Apple’s lead and make Windows security more Mac-like by limiting kernel access. more…

Read more »

How to copy text from a PDF on a Mac the easy way [Pro Tip]
Simply copying and pasting text in a PDF can be a nightmare. Here’s a better way to copy text from a PDF on a Mac using Live Text. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Deals: M2 iPad Air up to $99 off, 16GB M3 MacBook Air $1,099, Apple Pencil 2, 15W chargers, and more
Friday’s roundup of the absolute best deals on Apple gear and compatible accessories is now ready and waiting down below. First up, we have nearly $100 in savings and new all-time lows on Apple’s latest M2 iPad Air models with pricing starting lower than it ever has at $530. Then we have a very interesting deal on the M3 MacBook Air with 16GB of RAM at $200 off the going rate for a total at $1,099 joined by offers on Apple Pencil 2, this 15W Qi2 car mount charger, Satechi’s wonderful Mac Mini/Studio Hub & Stand, and more. Everything is waiting down below. more…

Read more »

Little Snitch 6.0.3
Maintenance release with improvements and bug fixes for the network traffic management utility. ($59 new, free update, 36.4 MB, macOS 14+)

Read more »

Pixelmator Pro 3.6.5
Adds extended RAW image support to the image editor. ($49.99 new, free update, 668.1 MB, macOS 12+)

Read more »

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services
Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace account, and leverage that to impersonate a domain holder to third-party services that allow logins through Google's "Sign in with Google" feature.

Read more »

Phish-Friendly Domain Registry “.top” Put on Notice
The Chinese company in charge of handing out domain names ending in “.top” has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that .top was the most common suffix in phishing websites over the past year, second only to domains ending in “.com.”

Read more »

Global Microsoft Meltdown Tied to Bad Crowstrike Update
A faulty software update from cybersecurity vendor Crowdstrike crippled countless Microsoft Windows computers across the globe today, disrupting everything from airline travel and financial institutions to hospitals and businesses online. Crowdstrike said a fix has been deployed, but experts say the recovery from this outage could take some time, as Crowdstrike's solution needs to be applied manually on a per-machine basis.

Read more »

Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
At least a dozen organizations with domain names at domain registrar Squarespace saw their websites hijacked last week. Squarespace bought all assets of Google Domains a year ago, but many customers still haven't set up their new accounts. Experts say malicious hackers learned they could commandeer any migrated Squarespace accounts that hadn't yet been registered, merely by supplying an email address tied to an existing domain.

Read more »

Hackers Steal Phone, SMS Records for Nearly All AT&T Customers
AT&T Corp. disclosed today that a new data breach has exposed phone call and text message records for roughly 110 million people -- nearly all of its customers. AT&T said it delayed disclosing the incident in response to "national security and public safety concerns," noting that some of the records included data that could be used to determine where a call was made or text message sent. AT&T also acknowledged the customer records were exposed in a cloud database that was protected only by a username and password (no multi-factor authentication needed).

Read more »

The Stark Truth Behind the Resurgence of Russia’s Fin7
The Russia-based cybercrime group dubbed "Fin7," known for phishing and malware attacks that have cost victim organizations an estimated $3 billion in losses since 2013, was declared dead last year by U.S. authorities. But experts say Fin7 has roared back to life in 2024 -- setting up thousands of websites mimicking a range of media and technology companies -- with the help of Stark Industries Solutions, a sprawling hosting provider is a persistent source of cyberattacks against enemies of Russia.

Read more »

Microsoft Patch Tuesday, July 2024 Edition
Microsoft Corp. today issued software updates to plug 139 security holes in various flavors of Windows and other Microsoft products. Redmond says attackers are already exploiting at least two of the vulnerabilities in active attacks against Windows users.

Read more »

Vulnerability Summary for the Week of July 1, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info 2code -- wpqa_builder  The WPQA Builder WordPress plugin before 6.1.1 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks 2024-07-03 8.8 CVE-2024-2376contact@wpscan.com ABB--ASPECT Enterprise (ASP-ENT-x)  Default credential in install package in ABB ASPECT; NEXUS Series; MATRIX Series version 3.07 allows attacker to login to product instances wrongly configured. 2024-07-01 8.8 CVE-2024-4007cybersecurity@ch.abb.com Adobe--Acrobat for Edge  Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-07-02 7.8 CVE-2024-34122psirt@adobe.com aimeos--ai-admin-graphql  aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue. 2024-07-02 7.1 CVE-2024-39323security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com Apache Software Foundation--Apache HTTP Server  Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue. 2024-07-01 7.5 CVE-2024-39573security@apache.org Arm Ltd--Valhall GPU Firmware  Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Valhall GPU Firmware, Arm Ltd Arm 5th Gen GPU Architecture Firmware allows a local non-privileged user to make improper GPU processing operations to access a limited amount outside of buffer bounds. If the operations are carefully prepared, then this in turn could give them access to all system memory. This issue affects Valhall GPU Firmware: from r29p0 through r46p0; Arm 5th Gen GPU Architecture Firmware: from r41p0 through r46p0. 2024-07-01 7.8 CVE-2024-0153arm-security@arm.com certifi--python-certifi  Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.05.30 and prior to 2024.07.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.07.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues." 2024-07-05 7.5 CVE-2024-39689security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com CHANGING--Mobile One Time Password  CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands. 2024-07-01 7.2 CVE-2024-3123twcert@cert.org.twtwcert@cert.org.tw CocoaPods--CocoaPods  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. It works via an DNS MX. This lookup could be manipulated to also execute a command on the trunk server, effectively giving root access to the server and the infrastructure. This issue was patched server-side with commit 001cc3a430e75a16307f5fd6cdff1363ad2f40f3 in September 2023. This RCE triggered a full user-session reset, as an attacker could have used this method to write to any Podspec in trunk. 2024-07-01 10 CVE-2024-38366security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com CocoaPods--CocoaPods  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so. It was also possible to have all owners removed from a pod, and that made the pod available for the same claiming system. This was patched server-side in commit 71be5440906b6bdfbc0bcc7f8a9fec33367ea0f4 in September 2023. 2024-07-01 9.3 CVE-2024-38368security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com CocoaPods--CocoaPods  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim's session will result in a full takeover of the CocoaPods trunk account. The threat actor could manipulate their pod specifications, disrupt the distribution of legitimate libraries, or cause widespread disruption within the CocoaPods ecosystem. This was patched server-side with commit d4fa66f49cedab449af9a56a21ab40697b9f7b97 in October 2023. 2024-07-01 8.2 CVE-2024-38367security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com dahlia--fedify  Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the `@id` or other resources present within the activity it has received from the web. This activity could reference an `@id` that points to an internal IP address, allowing an attacker to send request to resources internal to the fedify server's network. This applies to not just resolution of documents containing activities or objects, but also to media URLs as well. Specifically this is a Server Side Request Forgery attack. Users should upgrade to Fedify version 0.9.2, 0.10.1, or 0.11.1 to receive a patch for this issue. 2024-07-05 7.2 CVE-2024-39687security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com Delinea--Centrify PAS  Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The application is prone to the path traversal vulnerability allowing arbitrary files reading outside the web publish directory. Versions 23.1-HF7 and on have the patch. 2024-07-02 7.7 CVE-2024-5865vulnerability@kaspersky.com dell -- powerscale_onefs  Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.0 contain use of a broken or risky cryptographic algorithm vulnerability. An unprivileged network malicious attacker could potentially exploit this vulnerability, leading to data leaks. 2024-07-02 7.5 CVE-2024-32852security_alert@emc.com dell -- powerscale_onefs  Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. 2024-07-02 7.8 CVE-2024-32853security_alert@emc.com discourse--discourse  Discourse is an open-source discussion platform. Prior to version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch, Oneboxing against a carefully crafted malicious URL can reduce the availability of a Discourse instance. The problem has been patched in version 3.2.3 on the `stable` branch and version 3.3.0.beta3 on the `tests-passed` branch. There are no known workarounds available for this vulnerability. 2024-07-03 7.5 CVE-2024-35227security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com Edito--Edito CMS  Web services managed by Edito CMS (Content Management System) in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versions were never affected. 2024-07-02 7.5 CVE-2024-4836cvd@cert.plcvd@cert.plcvd@cert.pl evmos--evmos  Evmos is a decentralized Ethereum Virtual Machine chain on the Cosmos Network. Prior to version 19.0.0, a user can create a vesting account with a 3rd party account (EOA or contract) as funder. Then, this user can create an authorization for the contract.CallerAddress, this is the authorization checked in the code. But the funds are taken from the funder address provided in the message. Consequently, the user can fund a vesting account with a 3rd party account without its permission. The funder address can be any address, so this vulnerability can be used to drain all the accounts in the chain. The issue has been patched in version 19.0.0. 2024-07-05 8.8 CVE-2024-39696security-advisories@github.comsecurity-advisories@github.com expresstech -- quiz_and_survey_master  The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 is vulnerable does not validate and escape the question_id parameter in the qsm_bulk_delete_question_from_database AJAX action, leading to a SQL injection exploitable by Contributors and above role 2024-07-02 8.8 CVE-2024-5606contact@wpscan.com flowiseai -- flowise  Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available. 2024-07-01 7.5 CVE-2024-36420security-advisories@github.comsecurity-advisories@github.com flowiseai -- flowise  Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration (unauthenticated), arbitrary origins may be able to make requests to Flowise, stealing information from the user. This CORS misconfiguration may be chained with the path injection to allow an attacker attackers without access to Flowise to read arbitrary files from the Flowise server. As of time of publication, no known patches are available. 2024-07-01 7.5 CVE-2024-36421security-advisories@github.comsecurity-advisories@github.com geoserver -- geoserver  GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed. 2024-07-01 9.8 CVE-2024-36401security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com geoserver--geoserver  GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions. If GeoServer is also deployed as a web archive using the data directory embedded in the `geoserver.war` file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary). Versions 2.23.5 and 2.24.3 contain a patch for the issue. Some workarounds are available. One may change from a Windows environment to a Linux environment; or change from Apache Tomcat to Jetty application server. One may also disable anonymous access to the embeded GeoWebCache administration and status pages. 2024-07-01 7.5 CVE-2024-24749security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com geotools--geotools  GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications. 2024-07-02 9.8 CVE-2024-36404security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com gofiber--fiber  Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. The issue has been addressed in version 2.52.5. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: Either implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server, or regularly rotate session IDs and enforce strict session expiration policies. 2024-07-01 10 CVE-2024-38513security-advisories@github.comsecurity-advisories@github.com gorilla--schema  gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue. 2024-07-01 7.5 CVE-2024-37298security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com Grandstream--GXP2135  An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability. 2024-07-03 8.1 CVE-2024-32937talos-cna@cisco.com Hitachi--JP1/Extensible SNMP Agent for Windows  Incorrect Default Permissions vulnerability in Hitachi JP1/Extensible SNMP Agent for Windows, Hitachi JP1/Extensible SNMP Agent on Windows, Hitachi Job Management Partner1/Extensible SNMP Agent on Windows allows File Manipulation.This issue affects JP1/Extensible SNMP Agent for Windows: from 12-00 before 12-00-01, from 11-00 through 11-00-*; JP1/Extensible SNMP Agent: from 10-10 through 10-10-01, from 10-00 through 10-00-02, from 09-00 through 09-00-04; Job Management Partner1/Extensible SNMP Agent: from 10-10 through 10-10-01, from 10-00 through 10-00-02, from 09-00 through 09-00-04. 2024-07-02 7.8 CVE-2024-4679hirt@hitachi.co.jp home_owners_collection_management_system_project -- home_owners_collection_management_system  A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php?f=save. The manipulation of the argument img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-270167. 2024-07-02 9.8 CVE-2024-6439cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com home_owners_collection_management_system_project -- home_owners_collection_management_system  A vulnerability was found in SourceCodester Home Owners Collection Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-270168. 2024-07-02 9.8 CVE-2024-6440cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com icegram -- email_subscribers_&_newsletters  The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the db parameter in all versions up to, and including, 5.7.25 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2024-07-02 9.8 CVE-2024-6172security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com ICONICS--GENESIS64  Uncontrolled Search Path Element vulnerability in ICONICS GENESIS64 all versions, Mitsubishi Electric GENESIS64 all versions and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute a malicious code by storing a specially crafted DLL in a specific folder when GENESIS64 and MC Works64 are installed with the Pager agent in the alarm multi-agent notification feature. 2024-07-04 7 CVE-2024-1182Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp Johnson Controls--American Dynamics Illustra Essentials Gen 4  Under certain circumstances the web interface will accept characters unrelated to the expected input. 2024-07-02 9.1 CVE-2024-32755productsecurity@jci.comproductsecurity@jci.com jungo -- windriver  Improper privilege management in Jungo WinDriver before 12.1.0 allows local attackers to escalate privileges and execute arbitrary code. 2024-07-02 7.8 CVE-2023-51776cve@mitre.orgcve@mitre.orgcve@mitre.org jungo -- windriver  Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges, execute arbitrary code, or cause a Denial of Service (DoS). 2024-07-02 7.8 CVE-2024-22106cve@mitre.orgcve@mitre.orgcve@mitre.org jungo -- windriver  Improper privilege management in Jungo WinDriver before 12.2.0 allows local attackers to escalate privileges and execute arbitrary code. 2024-07-02 7.8 CVE-2024-25086cve@mitre.orgcve@mitre.orgcve@mitre.org jungo -- windriver  Improper privilege management in Jungo WinDriver before 12.5.1 allows local attackers to escalate privileges and execute arbitrary code. 2024-07-02 7.8 CVE-2024-25088cve@mitre.orgcve@mitre.orgcve@mitre.org jungo -- windriver  Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 allows local attackers to escalate privileges and execute arbitrary code. 2024-07-02 7.8 CVE-2024-26314cve@mitre.orgcve@mitre.orgcve@mitre.org Juniper Networks--Junos OS  An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). If an SRX Series device receives specific valid traffic destined to the device, it will cause the PFE to crash and restart. Continued receipt and processing of this traffic will create a sustained DoS condition. This issue affects Junos OS on SRX Series: * 21.4 versions before 21.4R3-S7.9, * 22.1 versions before 22.1R3-S5.3, * 22.2 versions before 22.2R3-S4.11, * 22.3 versions before 22.3R3, * 22.4 versions before 22.4R3. Junos OS versions prior to 21.4R1 are not affected by this issue. 2024-07-01 7.5 CVE-2024-21586sirt@juniper.net Kiloview--P1/P2  Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution. 2024-07-02 10 CVE-2023-41917cert@ncsc.nl Kiloview--P1/P2  A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code. 2024-07-02 10 CVE-2023-41918cert@ncsc.nl Kiloview--P1/P2  Hardcoded credentials are discovered within the application's source code, creating a potential security risk for unauthorized access. 2024-07-02 9.8 CVE-2023-41919cert@ncsc.nl Kiloview--P1/P2  The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in. 2024-07-02 9.8 CVE-2023-41920cert@ncsc.nl Kiloview--P1/P2  A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target's integrity to achieve an insecure state. 2024-07-02 9.8 CVE-2023-41921cert@ncsc.nl Kiloview--P1/P2  The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials. 2024-07-02 8.8 CVE-2023-41926cert@ncsc.nl Kiloview--P1/P2  The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. 2024-07-02 7.2 CVE-2023-41923cert@ncsc.nl kylephillips -- nested_pages  The Nested Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.7. This is due to missing or incorrect nonce validation on the 'settingsPage' function and missing santization of the 'tab' parameter. This makes it possible for unauthenticated attackers to call local php files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-07-04 8.8 CVE-2024-5943security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com LA-Studio--LA-Studio Element Kit for Elementor  Local File Inclusion vulnerability in LA-Studio LA-Studio Element Kit for Elementor via "LaStudioKit Progress Bar" widget in New Post, specifically in the "progress_type" attribute.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.3.8.1. 2024-07-02 8.5 CVE-2024-37479audit@patchstack.com la-studioweb -- element_kit_for_elementor  The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.8.1 via the 'map_style' parameter. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2024-07-02 8.8 CVE-2024-5349security@wordfence.comsecurity@wordfence.com livemeshelementor -- addons_for_elementor  The Elementor Addons by Livemesh plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.3.7 via several of the plugin's widgets through the 'style' attribute. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2024-07-04 8.8 CVE-2024-2385security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com mastodon--mastodon  Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target server, thus gaining access to the contents of a post not intended for them. Versions 4.1.18 and 4.2.10 contain a patch for this issue. 2024-07-05 8.2 CVE-2024-37903security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com MediaTek, Inc.--MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT8666, MT8667, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788  In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01297806; Issue ID: MSV-1481. 2024-07-01 7.5 CVE-2024-20076security@mediatek.com MediaTek, Inc.--MT2731, MT6739, MT6761, MT6762, MT6763, MT6765, MT6767, MT6768, MT6769, MT6771, MT8666, MT8667, MT8765, MT8766, MT8768, MT8781, MT8786, MT8788  In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01297807; Issue ID: MSV-1482. 2024-07-01 7.5 CVE-2024-20077security@mediatek.com MediaTek, Inc.--MT6768, MT6779, MT8321, MT8385, MT8755, MT8765, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788, MT8789, MT8791T, MT8792, MT8795T, MT8796, MT8797, MT8798  In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08737250; Issue ID: MSV-1452. 2024-07-01 9.8 CVE-2024-20078security@mediatek.com mesbook -- mesbook  Information exposure vulnerability in MESbook 20221021.03 version, the exploitation of which could allow a local attacker, with user privileges, to access different resources by changing the API value of the application. 2024-07-03 7.1 CVE-2024-6426cve-coordination@incibe.es mesbook -- mesbook  Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and disable the application. 2024-07-03 7.5 CVE-2024-6427cve-coordination@incibe.es MESbook--MESbook  External server-side request vulnerability in MESbook 20221021.03 version, which could allow a remote, unauthenticated attacker to exploit the endpoint "/api/Proxy/Post?userName=&password=&uri=base_config_ext is NULL, causing NULL dereference when specifically crafted topology and sequences used. 2024-07-05 not yet calculated CVE-2024-39473416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL commit a421ef303008 ("mm: allow !GFP_KERNEL allocations for kvmalloc") includes support for __GFP_NOFAIL, but it presents a conflict with commit dd544141b9eb ("vmalloc: back off when the current task is OOM-killed"). A possible scenario is as follows: process-a __vmalloc_node_range(GFP_KERNEL | __GFP_NOFAIL) __vmalloc_area_node() vm_area_alloc_pages() -- > oom-killer send SIGKILL to process-a if (fatal_signal_pending(current)) break; -- > return NULL; To fix this, do not check fatal_signal_pending() in vm_area_alloc_pages() if __GFP_NOFAIL set. This issue occurred during OPLUS KASAN TEST. Below is part of the log - > oom-killer sends signal to process [65731.222840] [ T1308] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/apps/uid_10198,task=gs.intelligence,pid=32454,uid=10198 [65731.259685] [T32454] Call trace: [65731.259698] [T32454] dump_backtrace+0xf4/0x118 [65731.259734] [T32454] show_stack+0x18/0x24 [65731.259756] [T32454] dump_stack_lvl+0x60/0x7c [65731.259781] [T32454] dump_stack+0x18/0x38 [65731.259800] [T32454] mrdump_common_die+0x250/0x39c [mrdump] [65731.259936] [T32454] ipanic_die+0x20/0x34 [mrdump] [65731.260019] [T32454] atomic_notifier_call_chain+0xb4/0xfc [65731.260047] [T32454] notify_die+0x114/0x198 [65731.260073] [T32454] die+0xf4/0x5b4 [65731.260098] [T32454] die_kernel_fault+0x80/0x98 [65731.260124] [T32454] __do_kernel_fault+0x160/0x2a8 [65731.260146] [T32454] do_bad_area+0x68/0x148 [65731.260174] [T32454] do_mem_abort+0x151c/0x1b34 [65731.260204] [T32454] el1_abort+0x3c/0x5c [65731.260227] [T32454] el1h_64_sync_handler+0x54/0x90 [65731.260248] [T32454] el1h_64_sync+0x68/0x6c [65731.260269] [T32454] z_erofs_decompress_queue+0x7f0/0x2258 -- > be- >decompressed_pages = kvcalloc(be- >nr_pages, sizeof(struct page *), GFP_KERNEL | __GFP_NOFAIL); kernel panic by NULL pointer dereference. erofs assume kvmalloc with __GFP_NOFAIL never return NULL. [65731.260293] [T32454] z_erofs_runqueue+0xf30/0x104c [65731.260314] [T32454] z_erofs_readahead+0x4f0/0x968 [65731.260339] [T32454] read_pages+0x170/0xadc [65731.260364] [T32454] page_cache_ra_unbounded+0x874/0xf30 [65731.260388] [T32454] page_cache_ra_order+0x24c/0x714 [65731.260411] [T32454] filemap_fault+0xbf0/0x1a74 [65731.260437] [T32454] __do_fault+0xd0/0x33c [65731.260462] [T32454] handle_mm_fault+0xf74/0x3fe0 [65731.260486] [T32454] do_mem_abort+0x54c/0x1b34 [65731.260509] [T32454] el0_da+0x44/0x94 [65731.260531] [T32454] el0t_64_sync_handler+0x98/0xb4 [65731.260553] [T32454] el0t_64_sync+0x198/0x19c 2024-07-05 not yet calculated CVE-2024-39474416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Handle err return when savagefb_check_var failed The commit 04e5eac8f3ab("fbdev: savage: Error out if pixclock equals zero") checks the value of pixclock to avoid divide-by-zero error. However the function savagefb_probe doesn't handle the error return of savagefb_check_var. When pixclock is 0, it will cause divide-by-zero error. 2024-07-05 not yet calculated CVE-2024-39475416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING Xiao reported that lvm2 test lvconvert-raid-takeover.sh can hang with small possibility, the root cause is exactly the same as commit bed9e27baf52 ("Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"") However, Dan reported another hang after that, and junxiao investigated the problem and found out that this is caused by plugged bio can't issue from raid5d(). Current implementation in raid5d() has a weird dependence: 1) md_check_recovery() from raid5d() must hold 'reconfig_mutex' to clear MD_SB_CHANGE_PENDING; 2) raid5d() handles IO in a deadloop, until all IO are issued; 3) IO from raid5d() must wait for MD_SB_CHANGE_PENDING to be cleared; This behaviour is introduce before v2.6, and for consequence, if other context hold 'reconfig_mutex', and md_check_recovery() can't update super_block, then raid5d() will waste one cpu 100% by the deadloop, until 'reconfig_mutex' is released. Refer to the implementation from raid1 and raid10, fix this problem by skipping issue IO if MD_SB_CHANGE_PENDING is still set after md_check_recovery(), daemon thread will be woken up when 'reconfig_mutex' is released. Meanwhile, the hang problem will be fixed as well. 2024-07-05 not yet calculated CVE-2024-39476416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not call vma_add_reservation upon ENOMEM sysbot reported a splat [1] on __unmap_hugepage_range(). This is because vma_needs_reservation() can return -ENOMEM if allocate_file_region_entries() fails to allocate the file_region struct for the reservation. Check for that and do not call vma_add_reservation() if that is the case, otherwise region_abort() and region_del() will see that we do not have any file_regions. If we detect that vma_needs_reservation() returned -ENOMEM, we clear the hugetlb_restore_reserve flag as if this reservation was still consumed, so free_huge_folio() will not increment the resv count. [1] https://lore.kernel.org/linux-mm/0000000000004096100617c58d54@google.com/T/#ma5983bc1ab18a54910da83416b3f89f3c7ee43aa 2024-07-05 not yet calculated CVE-2024-39477416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Do not free stack buffer RSA text data uses variable length buffer allocated in software stack. Calling kfree on it causes undefined behaviour in subsequent operations. 2024-07-05 not yet calculated CVE-2024-39478416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: drm/i915/hwmon: Get rid of devm When both hwmon and hwmon drvdata (on which hwmon depends) are device managed resources, the expectation, on device unbind, is that hwmon will be released before drvdata. However, in i915 there are two separate code paths, which both release either drvdata or hwmon and either can be released before the other. These code paths (for device unbind) are as follows (see also the bug referenced below): Call Trace: release_nodes+0x11/0x70 devres_release_group+0xb2/0x110 component_unbind_all+0x8d/0xa0 component_del+0xa5/0x140 intel_pxp_tee_component_fini+0x29/0x40 [i915] intel_pxp_fini+0x33/0x80 [i915] i915_driver_remove+0x4c/0x120 [i915] i915_pci_remove+0x19/0x30 [i915] pci_device_remove+0x32/0xa0 device_release_driver_internal+0x19c/0x200 unbind_store+0x9c/0xb0 and Call Trace: release_nodes+0x11/0x70 devres_release_all+0x8a/0xc0 device_unbind_cleanup+0x9/0x70 device_release_driver_internal+0x1c1/0x200 unbind_store+0x9c/0xb0 This means that in i915, if use devm, we cannot gurantee that hwmon will always be released before drvdata. Which means that we have a uaf if hwmon sysfs is accessed when drvdata has been released but hwmon hasn't. The only way out of this seems to be do get rid of devm_ and release/free everything explicitly during device unbind. v2: Change commit message and other minor code changes v3: Cleanup from i915_hwmon_register on error (Armin Wolf) v4: Eliminate potential static analyzer warning (Rodrigo) Eliminate fetch_and_zero (Jani) v5: Restore previous logic for ddat_gt- >hwmon_dev error return (Andi) 2024-07-05 not yet calculated CVE-2024-39479416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around. 2024-07-05 not yet calculated CVE-2024-39480416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: media: mc: Fix graph walk in media_pipeline_start The graph walk tries to follow all links, even if they are not between pads. This causes a crash with, e.g. a MEDIA_LNK_FL_ANCILLARY_LINK link. Fix this by allowing the walk to proceed only for MEDIA_LNK_FL_DATA_LINK links. 2024-07-05 not yet calculated CVE-2024-39481416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: bcache: fix variable length array abuse in btree_iter btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain. This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array. 2024-07-05 not yet calculated CVE-2024-39482416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked When requesting an NMI window, WARN on vNMI support being enabled if and only if NMIs are actually masked, i.e. if the vCPU is already handling an NMI. KVM's ABI for NMIs that arrive simultanesouly (from KVM's point of view) is to inject one NMI and pend the other. When using vNMI, KVM pends the second NMI simply by setting V_NMI_PENDING, and lets the CPU do the rest (hardware automatically sets V_NMI_BLOCKING when an NMI is injected). However, if KVM can't immediately inject an NMI, e.g. because the vCPU is in an STI shadow or is running with GIF=0, then KVM will request an NMI window and trigger the WARN (but still function correctly). Whether or not the GIF=0 case makes sense is debatable, as the intent of KVM's behavior is to provide functionality that is as close to real hardware as possible. E.g. if two NMIs are sent in quick succession, the probability of both NMIs arriving in an STI shadow is infinitesimally low on real hardware, but significantly larger in a virtual environment, e.g. if the vCPU is preempted in the STI shadow. For GIF=0, the argument isn't as clear cut, because the window where two NMIs can collide is much larger in bare metal (though still small). That said, KVM should not have divergent behavior for the GIF=0 case based on whether or not vNMI support is enabled. And KVM has allowed simultaneous NMIs with GIF=0 for over a decade, since commit 7460fb4a3400 ("KVM: Fix simultaneous NMIs"). I.e. KVM's GIF=0 handling shouldn't be modified without a *really* good reason to do so, and if KVM's behavior were to be modified, it should be done irrespective of vNMI support. 2024-07-05 not yet calculated CVE-2024-39483416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_MMC_DAVINCI=y. When such a device gets unbound (e.g. using sysfs or hotplug), the driver is just removed without the cleanup being performed. This results in resource leaks. Fix it by compiling in the remove callback unconditionally. This also fixes a W=1 modpost warning: WARNING: modpost: drivers/mmc/host/davinci_mmc: section mismatch in reference: davinci_mmcsd_driver+0x10 (section: .data) - > davinci_mmcsd_remove (section: .exit.text) 2024-07-05 not yet calculated CVE-2024-39484416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: media: v4l: async: Properly re-initialise notifier entry in unregister The notifier_entry of a notifier is not re-initialised after unregistering the notifier. This leads to dangling pointers being left there so use list_del_init() to return the notifier_entry an empty list. 2024-07-05 not yet calculated CVE-2024-39485416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 Linux--Linux  In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race filp- >pid is supposed to be a refcounted pointer; however, before this patch, drm_file_update_pid() only increments the refcount of a struct pid after storing a pointer to it in filp- >pid and dropping the dev- >filelist_mutex, making the following race possible: process A process B ========= ========= begin drm_file_update_pid mutex_lock(&dev- >filelist_mutex) rcu_replace_pointer(filp- >pid, , 1) mutex_unlock(&dev- >filelist_mutex) begin drm_file_update_pid mutex_lock(&dev- >filelist_mutex) rcu_replace_pointer(filp- >pid, , 1) mutex_unlock(&dev- >filelist_mutex) get_pid() synchronize_rcu() put_pid() *** pid B reaches refcount 0 and is freed here *** get_pid() *** UAF *** synchronize_rcu() put_pid() As far as I know, this race can only occur with CONFIG_PREEMPT_RCU=y because it requires RCU to detect a quiescent state in code that is not explicitly calling into the scheduler. This race leads to use-after-free of a "struct pid". It is probably somewhat hard to hit because process A has to pass through a synchronize_rcu() operation while process B is between mutex_unlock() and get_pid(). Fix it by ensuring that by the time a pointer to the current task's pid is stored in the file, an extra reference to the pid has been taken. This fix also removes the condition for synchronize_rcu(); I think that optimization is unnecessary complexity, since in that case we would usually have bailed out on the lockless check above. 2024-07-06 not yet calculated CVE-2024-39486416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67416baaa9-dc9f-4396-8d5f-8c081fb06d67 MediaTek, Inc.--MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6989, MT6990, MT8666, MT8667, MT8673, MT8676, MT8678  In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08720039; Issue ID: MSV-1424. 2024-07-01 not yet calculated CVE-2024-20080security@mediatek.com MediaTek, Inc.--MT2735, MT2737, MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6880, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6980, MT6983, MT6985, MT6989, MT6990, MT8666, MT8667, MT8673, MT8676, MT8678  In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08719602; Issue ID: MSV-1412. 2024-07-01 not yet calculated CVE-2024-20081security@mediatek.com MediaTek, Inc.--MT6761, MT6765, MT6768, MT6781, MT6785, MT6789, MT6833, MT6853, MT6853T, MT6855, MT6873, MT6875, MT6877, MT6879, MT6883, MT6885, MT6886, MT6889, MT6891, MT6893, MT6895, MT6983, MT6985, MT6989, MT8666, MT8667, MT8673, MT8676, MT8678  In gnss service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08044040; Issue ID: MSV-1491. 2024-07-01 not yet calculated CVE-2024-20079security@mediatek.com mudler--mudler/localai  A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality. 2024-07-06 not yet calculated CVE-2024-5616security@huntr.devsecurity@huntr.dev mudler--mudler/localai  A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the length of the error message. This vulnerability can be exploited by an attacker with network access to the LocalAI instance, potentially allowing unauthorized access to internal HTTP(s) servers and partial reading of local files. The issue is fixed in version 2.17. 2024-07-06 not yet calculated CVE-2024-6095security@huntr.devsecurity@huntr.dev n/a--n/a  Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 leaks driver logs that contain addresses of kernel mode objects, weakening KASLR. 2024-07-02 not yet calculated CVE-2022-25477cve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 provides read and write access to the PCI configuration space of the device. 2024-07-02 not yet calculated CVE-2022-25478cve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows for the leakage of kernel memory from both the stack and the heap. 2024-07-02 not yet calculated CVE-2022-25479cve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) before 10.0.22000.31274 allows writing to kernel memory beyond the SystemBuffer of the IRP. 2024-07-02 not yet calculated CVE-2022-25480cve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains a heap-based buffer overflow that allows an attacker to overwrite two bytes at multiple offsets beyond the allocated buffer size: buffer+512*i-2, for i=9, i=10, i=11, etc. 2024-07-03 not yet calculated CVE-2023-52168cve@mitre.orgcve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) contains an out-of-bounds read that allows an attacker to read beyond the intended buffer. The bytes read beyond the intended buffer are presented as a part of a filename listed in the file system image. This has security relevance in some known web-service use cases where untrusted users can upload files and have them extracted by a server-side 7-Zip process. 2024-07-03 not yet calculated CVE-2023-52169cve@mitre.orgcve@mitre.orgcve@mitre.orgcve@mitre.org n/a--n/a  The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sent in a loop via a raw socket. 2024-07-05 not yet calculated CVE-2023-52340cve@mitre.orgcve@mitre.org n/a--n/a  Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email. 2024-07-01 not yet calculated CVE-2024-23736cve@mitre.org n/a--n/a  Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Jira allows attackers to allows attackers to manipulate a user's S/MIME certificate of PGP key via malicious link or email. 2024-07-01 not yet calculated CVE-2024-23737cve@mitre.org n/a--n/a  Lukas Bach yana =

Read more »

The Not-So-Secret Network Access Broker x999xx
Most accomplished cybercriminals go out of their way to separate their real names from their hacker handles. But among certain old-school Russian hackers it is not uncommon to find major players who have done little to prevent people from figuring out who they are in real life. A case study in this phenomenon is "x999xx," the nickname chosen by a venerated Russian hacker who specializes in providing the initial network access to various ransomware groups.

Read more »

Apple has 15-inch M3 MacBook Airs in stock for $200-$260 off MSRP, Certified Refurbished
Apple has Certified Refurbished 15" M3 MacBook Airs in stock today starting at only $1099 and ranging up to $260 off MSRP. These are the cheapest M3-powered 15" MacBook Airs for sale today at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell. The following standard-configurations are available: - 15" MacBook Air/8-Core M3 CPU, 8-Core GPU/8GB RAM/256GB SSD: $1099, $200 off MSRP - 15" MacBook Air/8-Core M3 CPU, 10-Core GPU/8GB RAM/512GB SSD: $1269, $230 off MSRP - 15" MacBook Air/8-Core M3 CPU, 10-Core GPU/16GB RAM/512GB SSD: $1439, $260 off MSRP According the Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple has 13-inch M3 MacBook Airs in stock for $170-$230 off MSRP, Certified Refurbished
Apple has 13" M3 MacBook Airs in stock for $170-$230 off MSRP, Certified Refurbished. Prices start at $929. These are the cheapest M3-powered MacBooks for sale at Apple and also one of the best deals on MacBooks available anywhere. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core M3 CPU, 8-Core GPU/8GB RAM/256GB SSD: $929, $170 off MSRP - 13" M2 MacBook Air/8-Core M3 CPU, 10-Core GPU/8GB RAM/512GB SSD: $1099, $200 off MSRP - 13" M2 MacBook Air/8-Core M3 CPU, 10-Core GPU/16GB RAM/512GB SSD: $1269, $230 off MSRP According the Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

14-inch MacBook Pros with M3 CPUs are on sale for $200 off MSRP, prices start at $1399
Amazon has 14-inch M3 MacBook Pros in stock and on sale for $200 off MSRP. Shipping is free. Note that Amazon's stock tends to come and go, so be sure to check their site often if the model you are after is out of stock: - 14" M3 MacBook Pro (8GB RAM/512GB SSD/Space Gray or Silver): $1399, $200 off MSRP - 14" M3 MacBook Pro (8GB RAM/1TB SSD/Space Gray or Silver): $1599.99, $200 off MSRP Their prices are among the lowest available for new 14" M3 MacBook Pros from any Apple retailer. For the latest prices and sales, see our 14" MacBook Pro Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Best Buy is clearing out Apple Watch Series 9 models on their online store for $100 off MSRP
Best Buy has Apple Watch Series 9 models on sale for $100 off MSRP on their online store today. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). These are the lowest prices available for Series 9 Watches: - 41mm Apple Watch Series 9 GPS: $299, save $100 - 45mm Apple Watch Series 9 GPS: $329, save $100 - 41mm Apple Watch Series 9 GPS + Cellular: $399, save $100 - 45mm Apple Watch Series 9 GPS + Cellular: $429, save $100 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Best Buy is clearing out Apple Watch Series 9 models on their online store for $100 off MSRP
Best Buy has Apple Watch Series 9 models on sale for $100 off MSRP on their online store today. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). These are the lowest prices available for Series 9 Watches: - 41mm Apple Watch Series 9 GPS: $299, save $100 - 45mm Apple Watch Series 9 GPS: $329, save $100 - 41mm Apple Watch Series 9 GPS + Cellular: $399, save $100 - 45mm Apple Watch Series 9 GPS + Cellular: $429, save $100 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch SE models on sale for $50 off MSRP, prices start at $199
Best Buy has all Apple Watch SE models on sale for $50 off MSRP on their online store. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $229, save $50 - 40mm Apple Watch SE GPS + Cellular: $249, save $50 - 44mm Apple Watch SE GPS + Cellular: $279, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch SE models on sale for $50 off MSRP, prices start at $199
Best Buy has all Apple Watch SE models on sale for $50 off MSRP on their online store. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 40mm Apple Watch SE GPS: $199, save $50 - 44mm Apple Watch SE GPS: $229, save $50 - 40mm Apple Watch SE GPS + Cellular: $249, save $50 - 44mm Apple Watch SE GPS + Cellular: $279, save $50 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

16-inch M3 Pro MacBook Pro available today at Apple for up to $440 off MSRP, Certified Refurbished
Apple has a full line of 16" M3 Pro MacBook Pros available, Certified Refurbished, starting at $2119 and ranging up to $440 off MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16-inch M3 Pro MacBook Pros currently available for sale at Apple: - 16" M3 Pro MacBook Pro (18GB/512GB/Black): $2119 save $380 - 16" M3 Pro MacBook Pro (36GB/512GB/Black): $2459 save $440 - 16" M3 Pro MacBook Pro (18GB/512GB/Silver): $2119 save $380 - 16" M3 Pro MacBook Pro (36GB/512GB/Silver): $2459 save $440 See our 16" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily. The post first appeared on MacPrices.net.

Read more »

Get a 16-inch M3 Max MacBook Pro for up to $600 off MSRP today at Apple
Apple has standard-configuration 16" M3 Max MacBook Pros available, Certified Refurbished, starting at $2969 and ranging up to $600 off MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16-inch M3 Max MacBook Pros currently available for sale at Apple: - 16" M3 Max MacBook Pro (14-Core/36GB/1TB/Black): $2969 save $530 - 16" M3 Max MacBook Pro (16-Core/48GB/1TB/Black): $3399 save $600 - 16" M3 Max MacBook Pro (14-Core/36GB/1TB/Silver): $2969 save $530 - 16" M3 Max MacBook Pro (16-Core/48GB/1TB/Silver): $3399 save $600 See our 16" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily. The post first appeared on MacPrices.net.

Read more »

14-inch M3 MacBook Pros with 16GB of RAM on sale for $200-$250 off Apple’s MSRP
B&H Photo has 14" M3 MacBook Pros with 16GB of RAM and 512GB or 1TB SSDs in stock today and on sale for $200-$250 off Apple's MSRP, each including free 1-2 day shipping: - 14" M3 MacBook Pro (16GB RAM/512GB SSD): $1599, $200 off MSRP - 14" M3 MacBook Pro (16GB RAM/1TB SSD): $1749, $250 off MSRP These are the cheapest 14" M3 MacBook Pros available, new, with 16GB of memory. The post first appeared on MacPrices.net.

Read more »

14-inch M3 Pro/M3 Max MacBook Pros available today at Apple for almost $500 off MSRP, Certified Refurbished
Apple has 14" M3 Pro and M3 Max MacBook Pros in stock today and available, Certified Refurbished, starting at $1699 and ranging up to $480 off MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 Pro and M3 Max MacBook Pros currently available for sale at Apple: - 14" M3 Pro MacBook Pro (18GB/512GB/Black): $1699 save $300 - 14" M3 Pro MacBook Pro (18GB/1TB/Black): $2039 save $360 - 14" M3 Max MacBook Pro (36GB/1TB/Black): $2719 save $480 - 14" M3 Pro MacBook Pro (18GB/512GB/Silver): $1699 save $300 - 14" M3 Pro MacBook Pro (18GB/1TB/Silver): $2039 save $360 - 14" M3 Max MacBook Pro (36GB/1TB/Silver): $2719 save $480 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily. The post first appeared on MacPrices.net.

Read more »

Get a 14-inch M3 MacBook Pro starting at only $1359 at Apple, Certified Refurbished
Apple has 14" M3 MacBook Pros, Certified Refurbished, available starting at only $1359 and ranging up to $270 off MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 MacBook Pros currently available for sale at Apple: - 14" M3 MacBook Pro (8GB/512GB/Gray): $1359 save $240 - 14" M3 MacBook Pro (8GB/1TB/Gray): $1529 save $270 - 14" M3 MacBook Pro (8GB/512GB/Silver): $1359 save $240 - 14" M3 MacBook Pro (8GB/1TB/Silver): $1529 save $270 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily. The post first appeared on MacPrices.net.

Read more »