iOS 17 will autofill verification codes in Safari from the Mail app
Safari in iOS 17 is getting smarter and will automatically autofill OTP and login codes received in the Mail app. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

9to5Mac Daily: June 05, 2023 – WWDC recap live from Apple Park
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by CleanMyMac X: Check out CleanMyMac X, the all-in-one Mac maintenance tool. Run CleanMyMac X to gear up your Mac for the groundbreaking additions announced at this year’s WWDC. Get 5% off.  Sponsored by Mosyle: Mosyle is the only Apple Unified Platform. Mosyle is the only solution that fully integrates 5 different applications on a single Apple-only platform, allowing businesses to easily and automatically deploy, manage & protect all their Apple devices. more… The post appeared first on 9to5Mac.

Read more »

Here are the winners of the 2023 Apple Design Awards
Every year, Apple nominates multiple apps available in the App Store to compete for the Apple Design Awards at WWDC. Following the keynote this morning, the company has now announced the winners of the 2023 Apple Design Awards, “celebrating 12 best-in-class apps and games.” more… The post appeared first on 9to5Mac.

Read more »

iOS 17 feature roundup: StandBy, NameDrop, Contact Posters, more
The WWDC keynote was jam-packed with news and didn't even include everything coming to iOS 17. Here are all of the features we've found so far.iOS 17 has a lot of new featuresApple flew through the software portion of its WWDC keynote to ensure there was space for the Apple Vision Pro and visionOS. So, although iOS 17 wasn't the focus, it still held plenty of new features for users and developers. Read more...

Read more »

iPadOS 17: Here’s a first look at the customizable Lock Screen
Apple today announced iPadOS 17, which introduces new ways to customize the Lock Screen and interact with widgets. Just like the iPhone last year with iOS 16, iPad now has a customizable Lock Screen with different font styles and widgets. Read on for a first look at how it works. more… The post appeared first on 9to5Mac.

Read more »

Apple Design Awards twelve winners revealed
Apple has selected twelve winning apps and games across six categories for the Apple Design Awards.Apple Design AwardsEach WWDC, the best apps and games on the App Store compete for top honors from Apple. The winners were chosen from 36 finalists which demonstrated outstanding technical achievement. Read more...

Read more »

Vision Pro: I just tried Apple’s first spatial computer, and here’s what I think
At WWDC 2023, Apple officially unveiled its new Vision Pro headset, which it describes as a “revolutionary spatial computer.” I was in the crowd at today’s keynote when it was announced, and shortly thereafter, I was whisked away on a golf cart to go try out the Apple Vision Pro. When I arrived at the demo building on the far corner of Apple Park, I was then whisked away once again … into an alternate world powered by visionOS. more… The post appeared first on 9to5Mac.

Read more »

iOS 17 iPhone StandBy: How to use and customize the smart display feature
One of the headlining new features with iOS 17 is a smart landscape display mode for iPhone when it’s charging. Coming with different clock faces, widgets, access to photos, and more, here’s how to use and customize the iOS 17 iPhone Standby display. more… The post appeared first on 9to5Mac.

Read more »

Apple published a new Press Release
Apple just published a new Press Release:WWDC23 highlights

Read more »

Apple Announces iOS 17 With StandBy Charging Mode, Better Autocorrect
At WWDC today, Apple debuted iOS 17. "Highlights include new safety features, a built-in journaling app, a new nightstand mode, redesigned contact cards, better auto-correct and voice transcription, and live voicemail," reports The Verge. "And you'll be able to drop the 'hey' from 'Hey Siri.'" From the report: Your contact book is getting an update with a new feature called posters, which turns contact cards into flashy marquee-like images that show up full-screen on your recipient's iPhone when you call them. They use a similar design language as the redesigned lock screens, with bold typography options and the ability to add Memoji, and will work with third-party VoIP apps. There's also a new live transcription feature for voicemail that lets you view a transcript of the message a caller is leaving in real time. You can choose to ride it out or pick up the call, and it's all handled on-device. You'll also be able to leave a message on FaceTime, too. Some updates to messages include the ability to filter searches with additional terms, a feature that jumps to the most recent message so you can catch up more easily, transcriptions of voice messages -- similar to what the Pixel 7 series introduced -- and a series of new features called Check In that shares your live location and status with someone else. It can automatically send a message to a friend when you've arrived home, and it can share your phone's battery and cell service status to help avoid confusion if you're in a dead zone. Stickers are getting an overhaul, too, with the ability to add any emoji or photo cutout as a "sticker" positioned on iMessages or anywhere within the system. Live photos can be turned into animated stickers, too, and you can now add effects to stickers. AirDrop gets an update to send contact information -- cleverly called NameDrop -- which will send your selected email addresses and phone numbers (and your poster) just by bringing two iPhones near each other. It also works between an iPhone and an Apple Watch. Photos can be shared the same way, and if the file is a big one, it's now possible to move out of range while continuing the download. iOS 17 also includes keyboard updates, including enhancements to autocorrect. It now relies on a new language model for better accuracy, plus an easier shortcut to revert to the original word you wrote if necessary. There's now in-line predictive typing and sentence-level autocorrections to correct more grammatical mistakes. It'll finally learn your favorite cuss words, too; Apple's Craig Federighi even made a "ducking" joke onstage. Dictation uses a new AI model, too, that's more accurate. A new app called Journal automatically suggests moments that you might want to commemorate in a journal entry. Your entries can include photos, music, and activities, and you can schedule reminders for yourself to start writing. It's end-to-end encrypted, too, to keep things private. StandBy is a new mode for charging that turns the screen into a status display with the date and time. It can show information from Live Activities, widgets, and smart stacks and automatically turns on when your phone is in landscape mode while charging. You can swipe to the right to see some of your highlighted photos, and it comes with customizable clockfaces. Siri will surface visual results in StandBy, and the display shifts to a red tone at night to avoid disrupting sleep. Last but not least, Siri gets a boost, too, and finally lets you drop the "hey" from "Hey Siri." It will also recognize back-to-back commands. iOS 17 is available to developers today, with a public beta released next month. Read more of this story at Slashdot.

Read more »

First look at Vision Pro: Apple nails the hardware (and the experience)
First impressions of Vision Pro headset sound like Apple scored with the industrial design and overall "experience" of mixed-reality headset. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Vision Pro and everything else Apple announced during the WWDC keynote
Macworld Apple’s big keynote presentation to kick off WWDC 2023 was over two hours long. I’m as excited about new products as the next person, but who has that kind of time? If you want to catch up on everything Apple announced but don’t have two hours to watch the video, we’ve got your back. Here’s a quick summary of the announcements, with links to our further coverage when you want to dive in and learn more. 15-inch MacBook Air Apple The M2 MacBook is getting a big brother, as we’ve long suspected. It’s essentially identical to the 13-inch M2 model, only with a bigger 15-inch display. Prices start at a very reasonable $1,299, and the 13-inch M2 MacBook Air gets a price drop to $1,099. Read more about the 15-inch MacBook Air. M2 Ultra and Mac Studio update Apple Apple kept the Mac segment going with updates to the Mac Studio to support M2 Max and M2 Ultra. While the M2 Max could already be found in the 16-inch MacBook Pro, M2 Ultra is new. Just like M1 Ultra, M2 Ultra is basically two M2 Max chips bonded together with a super-fast interconnect. Mac Studio with M2 Max starts at $1,999 and with M2 Ultra at $3,999. Read more about M2 Max and M2 Ultra in Mac Studio. Mac Pro with Apple Silicon Apple The Mac Studio with M2 Ultra not enough Mac for you? Apple finally completed its transition to Apple Silicon with a new Mac Pro. It’s built into an enclosure identical to the Intel-based model but sports an M2 Ultra, eight Thunderbolt ports, and six PCIe gen 4 slots. The slots support upgrades like storage, networking, and A/V interfaces, but it doesn’t appear that you’ll be able to upgrade the RAM or graphics in the Apple Silicon Mac Pro. Prices start at $6,999, exactly $3,000 more than the similarly-configured Mac Studio. Read more about the Mac Pro with Apple Silicon. iOS 17 Apple WWDC 2023 Naturally, Apple will be updating iOS on a billion iPhones this fall, and iOS 17 brings lots to be excited about. There’s a new contact sharing and airdrop experience where you just bring your iPhones near each other, custom contact posters, a brand new autocorrect using new technology and interface, live real-time voicemail transcriptions, a new StandBy mode for charging stands, and much more. Read more about the biggest iOS 17 features. iPadOS 17 Apple The customizable lock screen from iOS 16 comes to iPad, but there’s more, like interactive widgets (also in iOS 17), improvements to Stage Manager, FaceTime, Live Activities, and the Health app just to name a few. Read more about iPadOS 17. macOS 14 Sonoma Apple The name for version 14 is macOS Sonoma, and it includes widgets anywhere on the desktop, Game Mode and a new game porting kit for developers, big updates to Safari, slow-motion video screensavers, and more. Plus, of course, most of the core features of iOS and iPadOS, like improved autocorrect and PDF autofill, are coming to macOS as well. Read more about macOS Sonoma. Adaptive Audio for AirPods If you have 2nd-generation AirPods Pro, they’ll get a new Adaptive Audio mode that blends together transparency and noise-canceling. It cancels the annoying background noise but allows significant sounds to come through. Conversation Awareness lowers the volume of what you’re listening to and enhances the sounds of people speaking with you in front of you. Personalized Volume uses machine learning to learn your volume preferences with different kinds of content and environmental conditions. Automatic Switching between Apple devices is faster and more reliable, and with AirPods Pro, Max, or 3rd-gen AirPods you can mute or unmute yourself when on a call with a quick squeeze of the stem (or tap of the Digital Crown on AirPods Max). Read more about the new AirPods features coming this fall. New AirPlay features AirPlay is getting smart, with Siri suggestions based on how you start AirPlay sessions from your iPhone or iPad. AirPlay is coming to hotels–you’ll be able to scan a QR code on the hotel TV and connect to it via AirPlay with your iPhone or iPad to easily stream your own content. Apple Music and CarPlay collaborative playlists This fall, SharePlay is coming to CarPlay. When you connect your iPhone to CarPlay, passengers in your car will get prompted on their own iPhones to join the session. Then they can control playback, add tracks, and so on. tvOS 17 Apple There’s an all-new Control Center in tvOS 17, you can use your iPhone to locate your Siri Remote, and more. But the big new feature is FaceTime on Apple TV. It uses Continuity Camera like macOS does, to wirelessly connect to your iPhone and use it as your camera and microphone. It works simultaneously with SharePlay too, so you can watch content in sync together while on your FaceTime call. Read more about tvOS 17. watchOS 10 Apple The Apple Watch is getting a big overhaul in watchOS 10. Scrolling the crown from your watch face shows a smart stack of interactive widgets. The apps themselves have been redesigned throughout watchOS. There are new features in workouts like Cycling, Hiking, and new workout APIs for third-party developers. You can log your mood in the mindfulness app, and the watch will be able to tell how much time you spend in daylight. Read more about watchOS 10. One More Thing… Apple Vision Pro! Apple The biggest part of the keynote was devoted to “One More Thing”: Apple Vision Pro, the poorly-kept secret of Apple’s big mixed reality headset. It sports a pair of incredibly high-resolution micro-OLED displays (greater than 4K per eye!), a curved OLED external display so others can see your eyes, a crazy number of sensors and cameras (12 cameras, five sensors, and six microphones), and is powered by two main chips: an M1 processor and a new R1 processor that handles all the sensor data in just a few milliseconds to avoid latency. This is Apple’s next big computing platform. As the Mac introduced personal computing, and the iPhone portable computing, Vision Pro is meant to introduce spatial computing. It’s loaded with features, from new ways to enjoy video content in a virtual theater, the ability to run all your favorite apps simultaneously in floating windows of whatever size you want, new ways to use FaceTime and SharePlay, a virtual Mac display, taking and viewing 3D photos and videos, and so much more. There will be an App Store of course, with custom Vision Pro apps as well as thousands of compatible iPhone and iPad apps. Naturally, all this insane technology doesn’t come cheap. Apple Vision Pro will start at $3,499 when it is released in the spring of 2024. Read more about Apple Vision Pro. Apple, iOS, Mac, Virtual Reality

Read more »

12 Compelling Features Coming to Apple’s Operating Systems in 2023
Apple has pulled back the curtains on the new features it’s adding to iOS 17, iPadOS 17, macOS 15, watchOS 10, and tvOS 17. Here are the 12 that Adam Engst finds the most immediately interesting.

Read more »

Apple Vision Pro developer kits will be available
Developers will be able to apply for an Apple Vision Pro developer kit, but no details are available yet.Apple Vision ProApple's next platform is spatial computing, and the Apple Vision Pro is the first step into that future. Developers will need to prepare their apps for the new product line, but the headset won't be available until early 2024. Read more...

Read more »

macOS Sonoma brings new Lock Screen with aerial wallpapers, here’s how it works
macOS Sonoma, or macOS 14, is the new version of the Mac operating system. It comes with multiple new features, such as desktop widgets, FaceTime and iMessage enhancements, web app support, and new tools for editing PDFs. But macOS Sonoma also has a new Lock Screen and aerial wallpapers. Read on as we detail how it works. more… The post appeared first on 9to5Mac.

Read more »

Three New Macs Complete the Apple Silicon Transition
With the release of the M2 Ultra-based Mac Pro alongside a new 15-inch MacBook Air and upgraded Mac Studio, Apple has completed its promised transition of moving the entire Mac line to Apple silicon.

Read more »

iPadOS 17 brings a raft of new features in better-than-expected update
Macworld At WWDC 2023 today Apple previewed iPadOS 17, this year’s main software update for the iPad. While pre-event rumors suggested this would be a quiet refresh, there were several worthwhile changes and new features that are good news for iPad owners. “iPadOS powers our most versatile device and enables users to do so many things on iPad, and now with iPadOS 17, we deliver an experience that’s even more personal and capable,” said Craig Federighi, Apple’s senior vice president of Software Engineering. Lock screen & widgets Last year iPhone users got the new ability to customize their lock screens, but tablet users missed out. iPadOS 17 now brings this option to the iPad. You can set photo shuffles or Live Photos as the background, customize the font and colors, and generally stylize the look in the way you prefer: having the clock digits partly covered by an element of the image is a particularly nice effect. The lock screen is also now the home of Live Activities, so you can follow sports scores or the progress of your Uber driver without having to open a dedicated app or even unlock your iPad. Those numbers must be gigantic!Apple The lock screen can also now be customized with widgets, and while these were previously available on the home screen in iPadOS, Apple boasts that iPad widgets will become more interactive this year. Whereas, for example, the Reminders widget in iPadOS 16 effectively just shows your reminders–tapping on the widget then opens the app–the equivalent in iPadOS 17 lets you tick off tasks without having to open the app. Stickers and audio transcripts: Messages gets interactive Apple announced some fun and handy updates to the iPad’s all-important Messages app to match those in iOS 17. You can create stickers, including animated stickers based on Live Photos, and drop these into message threads; these are collected in a drawer accessible from the keyboard. There’s a new button to jump to the last read message in group chats, helping you catch up with the conversation. And audio messages are transcribed automatically so you can easily get the gist without having to play them out loud. Apple iPadOS 17 doesn’t appear to get iOS 17’s Check-In feature, which lets you set up a contact to be automatically notified when you get home (and can share information with them such as location, battery level, and cell service if things go awry). Presumably, this is less of a priority on the iPad, which is carried around less than the iPhone. While we’re on the subject of communication, FaceTime in iPadOS 17 gains the option to leave video and audio messages when the recipient doesn’t pick up, and Reactions such as hearts and balloons. New Health app We’ve been waiting a long time for this one. Health, which arrived on the iPhone in iOS 8 an astonishing nine years ago, has finally come to the iPad. Granted, the iPad is less obviously a health-related device than the iPhone–it doesn’t get carried around when exercising, it doesn’t (currently) pair with the Apple Watch–but its larger screen is perfect for viewing health data and trends sourced from other Apple devices you own. Getting clever with PDFs Here for once is a new feature that hasn’t landed on the iPhone. PDFs are easier to edit in iPadOS 17 because it uses machine learning to identify fields that you’ll want to fill in, then suggests (where appropriate) autofill information scraped from Contacts. Apple This also applies to the Notes app, which has been designed to handle PDFs more effectively. PDFs appear full width in Notes in iPadOS 17, and you can annotate PDFs right in the note. If you’re sharing a note with someone else, you can collaborate on PDFs and changes appear in real-time. Apple Getting productive with Safari iPad owners will be able to create multiple browsing Profiles, each of which will have its own history, cookies, and bookmarks. By switching between these you can be more productive when in work mode, personal mode, and so on. There are also changes to Private Browsing: Apple says this feature now allows you to lock a window with Face ID/Touch ID, and remove cross-site trackers. Other changes Let’s go quickfire on some other changes in iPadOS 17: Multiple timers can run at once.Stage Manager is more flexible about window layout.Reminders can make grocery shopping easier by automatically grouping together related items.In Maps, you can download maps and use them offline.Visual Look Up can recognize more things, including food and the symbols on laundry labels.And Siri can be activated by just saying “Siri” rather than “Hey Siri.” We’re extremely unconvinced of the benefits of this, given that Siri already false positives around once a day with the two-word trigger phrase, but hopefully this is optional (or Siri has become more accurate at hearing). Which iPads will get iPadOS 17, and when? The first developer beta version of iPadOS 17 is available now, while the full public release will appear in the fall. It will be a free software update for iPad (6th gen and later), iPad mini (5th gen), iPad Air (3rd gen), 12.9-inch iPad Pro (2nd gen), 10.5-inch iPad Pro, and 11-inch iPad Pro (1st gen). iPad

Read more »

Best MacBook trade-in values following the 15-inch MacBook Air launch
The all-new 15-inch MacBook Air has officially arrived. Whether you’re definitely picking one up or are curious about how much you could get for your current laptop, here’s a breakdown of the best MacBook trade-in values. You can also get a 10% cash bonus from our official trade-in partner Decluttr with code “9TO5MAC23“. more… The post appeared first on 9to5Mac.

Read more »

Apple Announces New Mac Pro With M2 Ultra, PCI Expansion Slots, and $6999 Price
At WWDC today, Apple announced a new Mac Pro powered by the M2 Ultra chip. 9to5Mac reports: The chassis design of the machine appears to be the same as the 2019 Intel Mac Pro. The Mac Pro features eight Thunderbolt ports and six PCI slots for modular expansion. The base model config Mac Pro starts at $6999. Mac Pro with M2 Ultra features a 24-core CPU, up to 76-core GPU and 192 GB RAM. It also features two HDMI ports, dual 10-gigabit Ethernet, and a 32-core Neural Engine for machine learning tasks. It also features the latest wireless connectivity with Wi-Fi 6E and Bluetooth 5.3. You'll be able to order the new Mac Pro today via Apple.com. Read more of this story at Slashdot.

Read more »

Developers gain new SDK tools for Privacy Label generation and security checks
Apple is creating new tools around third-party SDK use to simplify developer software pipelines, like Privacy Label generation.A Privacy Label for TikTokWhen developers build their apps, they often use third-party SDKs to implement different features. These can add up quickly and cause some difficulties when tracking down privacy implications for each one or for when it's time to update a specific SDK. Read more...

Read more »

First iOS 17, macOS Sonoma, watchOS 10 developer betas now ready for testing
With macOS Sanoma, iOS 17, iPadOS 17, watchOS 10 and tvOS 17 all unveiled at WWDC23 on Monday, Apple made the initial betas available to developers. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Snag a versatile drone that captures 4K images for less than $80
Whether for professional or recreational purposes, don't get priced out. Snag an HD camera-equipped drone for a surprisingly low price. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Five ways Vision Pro is different from anything Apple—or anyone—has ever made
Some instant analysis of Apple's boldest product experiment in years.

Read more »

Even at $3,500, Apple’s Vision Pro headset looks like a relative bargain
People might be squawking about the $3,499 price tag of Apple’s new Vision Pro headset, but let’s put things in perspective. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple will make dev kits available to help developers build and test apps for Vision Pro headset
Apple unveiled the Apple Vision Pro headset today at WWDC in part to reinforce the developer story behind it; the company wants a vibrant app ecosystem to emerge for this new spatial computing platform, even if the first iteration of the headset will not be a mass consumer hit. To help developers build and test their apps for visionOS, Apple has announced several initiatives. This includes hands-on labs and availability of Apple Vision Pro dev kits. more… The post appeared first on 9to5Mac.

Read more »

Apple’s biggest reveals at WWDC23
The Keynote from Apple WWDC23 was jam-packed with huge announcements, including new and updated operating systems and loads of new computers. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

You can now take FaceTime calls on your Apple TV 4K
Macworld Along with iOS 17, watchOS 10, and macOS 14 Sonoma, Apple today announced tvOS 17, which includes a few new nice-to-have features, including a redesigned Control Center and the ability to locate a lost Apple TV remote with your iPhone. But the main reason you’ll want to update this fall is FaceTime. That’s right, Apple is finally bringing the FaceTime app for video calls on Apple TV 4K. Using Continuity Camera and the iPhone, users will be able to wirelessly connect to the iPhone while presenting calls on your television. With the advantage of the bigger screen, Apple is also introducing Split View for Apple TV which lets users enjoy watching shows or movies while on a call. Apple says video conferencing apps from Cisco, Zoom, and others will launch on Apple TV later this year. Other apps are likely to follow thanks to the expansion of the Continuity Camera API to Apple TV 4K.  Apple has been rumored to be working on a new Apple TV with a built-in camera, so this new feature could be a signal that a proper camera is coming for the Apple TV 4K. tvOS 17 will be available for all Apple TV 4K and Apple TV HD models following a beta testing period. The FaceTime feature is limited to Apple TV 4K models. Apple TV

Read more »

Apple avoids “AI” hype at WWDC keynote by baking ML into products
Apple prefers using "machine learning," or just having AI work in the background.

Read more »

Apple Announces macOS Sonoma With Desktop Widgets and Game Mode
At WWDC today, Apple announced macOS Sonoma, the latest version of its Mac operating system that includes new features like desktop widgets, aerial screensavers, a new Game mode, and enhancements to apps like Messages and Safari. MacRumors reports: The first feature that Apple detailed was new interactive widgets, which can now be placed right on your desktop. Widgets blend into your desktop wallpaper to not be obtrusive when you're working, and with Continuity you can use the same widgets from your iPhone on your Mac. macOS Sonoma also introduces enhanced video conferencing features, including Presenter Overlay to allow a user to display themselves in front of the content they are sharing. Reactions let users share how they feel within a video session, and Screen Sharing has been improved with a simplified process. As is usual with macOS updates, Safari is getting numerous new features within Sonoma. There's an update to Private Browsing that provides greater protection from trackers and from people who might have access to the user's device. Profiles within Safari offer a way to separate browsing between topics, like having one for work and one for personal browsing. There's also a new way to create web apps that work like normal apps and let you get to your favorite website faster. When you're not actively using macOS Sonoma, the new screen savers feature slow-motion videos of various locations worldwide. They shuffle between landscape, Earth, underwater, or cityscape themes, similar to what you'll see on tvOS. For gamers, there's a new Game Mode in macOS Sonoma that delivers an optimized gaming experience with smoother and more consistent frame rates. It dramatically lowers audio latency with AirPods and reduces input latency with game controllers, and it works with any game on Mac. A beta version of macOS Sonoma is now available via the Apple Developer Program, with a public beta launching next month. As Ars Technica notes, the macOS Sonoma update will only run on a couple generations of Intel Macs. "[I]f you're using anything made before 2018 or anything without an Apple T2 chip in it, you won't be able to run the new OS." Read more of this story at Slashdot.

Read more »

Apple’s software updates for AirPods will soon unlock powerful new capabilities
This fall, software updates across AirPods will unlock powerful new capabilities to transform the personal audio experience. AirPods Pro (2nd generation) become easier to use across environments and interactions with three powerful new features The post appeared first on MacDailyNews.

Read more »

Vulnerability Summary for the Week of May 29, 2023
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis. High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info wordpress -- wordpress A vulnerability classified as critical has been found in Portfolio Gallery Plugin up to 1.1.8 on WordPress. This affects an unknown part. The manipulation leads to sql injection. It is possible to initiate the attack remotely. Upgrading to version 1.1.9 is able to address this issue. The name of the patch is 58ed88243e17df766036f4857041edaf358076d3. It is recommended to upgrade the affected component. The identifier VDB-230085 was assigned to this vulnerability. 2023-05-28 9.8 CVE-2014-125101MISCMISCMISC itrsgroup -- ninja A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084. 2023-05-28 9.8 CVE-2021-4336MISCMISCMISCMISC huawei -- emui Lack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds read. 2023-05-26 9.8 CVE-2021-46887MISC audiocodes -- device_manager_express An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form. 2023-05-29 9.8 CVE-2022-24627MISC audiocodes -- device_manager_express An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/. 2023-05-29 9.8 CVE-2022-24629MISC microsoft -- windows_10 Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability 2023-05-31 9.8 CVE-2022-35744MISC shopbeat -- shop_beat_media_player Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Insecure Permissions. 2023-05-30 9.8 CVE-2022-36246MISC sprecher_automation -- sprecon-e_cpu Hardcoded Credentials in multiple SPRECON-E CPU variants of Sprecher Automation allows an remote attacker to take over the device. These accounts should be deactivated according to Sprecher's hardening guidelines. 2023-06-01 9.8 CVE-2022-4333MISC huawei -- harmonyos The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service. 2023-05-26 9.8 CVE-2022-48478MISC huawei -- harmonyos The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service. 2023-05-26 9.8 CVE-2022-48479MISC samsung -- galaxy_store Improper scheme validation from InstantPlay Deeplink in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. 2023-05-26 9.8 CVE-2023-21514MISC wade_digital_design_co_ltd. -- fantsy Wade Graphic Design FANTSY has a vulnerability of insufficient authorization check. An unauthenticated remote user can exploit this vulnerability by modifying URL parameters to gain administrator privileges to perform arbitrary system operation or disrupt service. 2023-06-02 9.8 CVE-2023-28698MISC elite_technology_corp. -- web_fax ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service. 2023-06-02 9.8 CVE-2023-28701MISC tenda -- ac6_firmware A vulnerability classified as critical was found in Tenda AC6 US_AC6V1.0BR_V15.03.05.19. Affected by this vulnerability is the function fromDhcpListClient. The manipulation leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-230077 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-05-27 9.8 CVE-2023-2923MISCMISCMISC supcontech -- simfield_firmware A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. Affected by this issue is some unknown functionality of the file /admin/reportupload.aspx. The manipulation of the argument files[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230078 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-05-27 9.8 CVE-2023-2924MISCMISCMISC jizhicms -- jizhicms A vulnerability was found in JIZHICMS 2.4.5. It has been classified as critical. Affected is the function index of the file TemplateController.php. The manipulation of the argument webapi leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230082 is the identifier assigned to this vulnerability. 2023-05-27 9.8 CVE-2023-2927MISCMISCMISC sourcecodester -- students_online_internship_timesheet_system A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is an unknown function of the file rendered_report.php of the component GET Parameter Handler. The manipulation of the argument sid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230142 is the identifier assigned to this vulnerability. 2023-05-29 9.8 CVE-2023-2955MISCMISCMISC sourcecodester -- faculty_evaluation_system A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is some unknown functionality of the file index.php?page=edit_user. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230150 is the identifier assigned to this vulnerability. 2023-05-29 9.8 CVE-2023-2962MISCMISCMISC erikoglu_technology -- ermon Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Erikoglu Technology ErMon allows Command Line Execution through SQL Injection, Authentication Bypass.This issue affects ErMon: before 230602. 2023-06-02 9.8 CVE-2023-3000MISC tuzitio -- camaleon_cms Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. 2023-05-26 9.8 CVE-2023-30145MISCMISCMISCMISCMISC hitron_technologies_inc. -- hitron_coda-5310 Hitron Technologies CODA-5310 Telnet function with the default account and password, and there is no warning or prompt to ask users to change the default password and account. An unauthenticated remote attackers can exploit this vulnerability to obtain the administrator’s privilege, resulting in performing arbitrary system operation or disrupt service. 2023-06-02 9.8 CVE-2023-30603MISC hitron_technologies_inc. -- hitron_coda-5310 It is identified a vulnerability of insufficient authentication in the system configuration interface of Hitron Technologies CODA-5310. An unauthorized remote attacker can exploit this vulnerability to access system configuration interface, resulting in performing arbitrary system operation or disrupt service. 2023-06-02 9.8 CVE-2023-30604MISC okfn -- ckan CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object. Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1. Users are advised to upgrade. There are no known workarounds for these issues. 2023-05-26 9.8 CVE-2023-32321MISCMISC samsung -- galaxy_store XSS vulnerability from InstantPlay in Galaxy Store prior to version 4.5.49.8 allows attackers to execute javascript API to install APK from Galaxy Store. 2023-05-26 9.6 CVE-2023-21516MISC shopbeat -- shop_beat_media_player Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to IDOR via controlpanel.shopbeat.co.za. 2023-05-30 9.1 CVE-2022-36247MISC haxx -- curl An information disclosure vulnerability exists in curl

Read more »

Ask Fitis, the Bear: Real Crooks Sign Their Malware
Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. This post is a deep dive on "Megatraffer," a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015.

Read more »

Discord Admins Hacked by Malicious Bookmarks
A number of Discord communities focused on cryptocurrency have been hacked this past month after their administrators were tricked into running malicious Javascript code disguised as a Web browser bookmark.

Read more »

Vulnerability Summary for the Week of May 22, 2023
  The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis. High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info cbot -- chatbot Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. 2023-05-25 9.9 CVE-2023-2882MISC cbot -- chatbot Channel Accessible by Non-Endpoint vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7. 2023-05-25 9.9 CVE-2023-2885MISC linux -- linux_kernel An issue was discovered in netfilter in the Linux kernel before 5.10. There can be a use-after-free in the packet processing context, because the per-CPU sequence count is mishandled during concurrent iptables rules replacement. This could be exploited with the CAP_NET_ADMIN capability in an unprivileged namespace. NOTE: cc00bca was reverted in 5.12. 2023-05-21 9.8 CVE-2020-36694MISCMISCMISCMISC huawei -- emui Lack of length check vulnerability in the HW_KEYMASTER module. Successful exploitation of this vulnerability may cause out-of-bounds read. 2023-05-26 9.8 CVE-2021-46887MISC thingsforrestaurants -- quick_restaurant_reservations Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin

Read more »

Phishing Domains Tanked After Meta Sued Freenom
The number of phishing websites tied to domain name registrar Freenom dropped precipitously in the months surrounding a recent lawsuit from social networking giant Meta, which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to those abusive domains.

Read more »

When Does Your iPhone Become Unsafe to Use? – Intego Mac Podcast Episode 293
A new hacking tool, BrutePrint, can unlock lots of smartphones, but not iPhones. Router infections can be hard to remove, and we wonder why Apple got out of the wi-fi business. And we take a close look at whether it's safe to use an iPhone, if it can no longer run the latest version of iOS. The post When Does Your iPhone Become Unsafe to Use? – Intego Mac Podcast Episode 293 appeared first on The Mac Security Blog.

Read more »

Interview With a Crypto Scam Investment Spammer
Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. What follows is an interview with a Russian hacker responsible for a series of aggressive crypto spam campaigns that recently prompted several large Mastodon communities to temporarily halt new registrations. According to the hacker, their spam software has been in private use until the last few weeks, when it was released as open source code.

Read more »

Vulnerability Summary for the Week of May 15, 2023
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis. High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info ideasoft --rental_module Unrestricted Upload of File with Dangerous Type vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Command Injection, Using Malicious Files, Upload a Web Shell to a Web Server.This issue affects Rental Module: before 23.05.15. 2023-05-20 10 CVE-2023-2712MISC wago -- multiple_products In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. 2023-05-15 9.8 CVE-2023-1698MISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability was found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this issue is the function manager_category of the file admin/?page=categories/manage_category of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-228884. 2023-05-12 9.8 CVE-2023-2668MISCMISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been classified as critical. This affects an unknown part of the file admin/?page=categories/view_category of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-228885 was assigned to this vulnerability. 2023-05-12 9.8 CVE-2023-2669MISCMISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/?page=user/manage_user. The manipulation leads to improper access controls. The attack can be initiated remotely. VDB-228886 is the identifier assigned to this vulnerability. 2023-05-12 9.8 CVE-2023-2670MISCMISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability classified as critical has been found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file items/view.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228888. 2023-05-12 9.8 CVE-2023-2672MISCMISC companymaps_project -- companymaps SQL injection vulnerability found in Maximilian Vogt companymaps (cmaps) v.8.0 allows a remote attacker to execute arbitrary code via a crafted script in the request. 2023-05-12 9.8 CVE-2023-29809MISCMISC judging_management_system_project -- judging_management_system SQL injection vulnerability found in Judging Management System v.1.0 allows a remote attacker to execute arbitrary code via the contestant_id parameter. 2023-05-12 9.8 CVE-2023-30246MISCMISC storage_unit_rental_management_system_project -- storage_unit_rental_management_system File Upload vulnerability found in Oretnom23 Storage Unit Rental Management System v.1.0 allows a remote attacker to execute arbitrary code via the update_settings parameter. 2023-05-12 9.8 CVE-2023-30247MISCMISC codesys -- multiple_products An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47379MISC codesys -- multiple_products An authenticated remote attacker may use a stack based  out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47380MISC codesys -- multiple_products An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47381MISC codesys -- multiple_products An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47382MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47383MISC codesys -- multiple_products An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47384MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47385MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47386MISC codesys -- multiple_products An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47387MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47388MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47389MISC codesys -- multiple_products An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution. 2023-05-15 8.8 CVE-2022-47390MISC google -- chrome Out of bounds write in ChromeOS Audio Server in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker to potentially exploit heap corruption via crafted audio file. (Chromium security severity: High) 2023-05-12 8.8 CVE-2023-2457MISCMISC google -- chrome Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: High) 2023-05-12 8.8 CVE-2023-2458MISCMISC ideasoft -- rental_module Authorization Bypass Through User-Controlled Key vulnerability in "Rental Module" developed by third-party for Ideasoft's E-commerce Platform allows Authentication Abuse, Authentication Bypass.This issue affects Rental Module: before 23.05.15. 2023-05-20 8.8 CVE-2023-2713MISC codesys -- development_system_v3 Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application. 2023-05-15 7.7 CVE-2022-4048MISC codesys -- multiple_products In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service. 2023-05-15 7.5 CVE-2022-47391MISC rosariosis -- rosariosis Storage of Sensitive Data in a Mechanism without Access Control in GitHub repository francoisjacquet/rosariosis prior to 11.0. 2023-05-12 7.5 CVE-2023-2665CONFIRMMISC froxlor -- froxlor Allocation of Resources Without Limits or Throttling in GitHub repository froxlor/froxlor prior to 2.0.16. 2023-05-12 7.5 CVE-2023-2666CONFIRMMISC Back to top  Medium Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source & Patch Info codesys -- multiple_products Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition. 2023-05-15 6.5 CVE-2022-47378MISC codesys -- multiple_products An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition. 2023-05-15 6.5 CVE-2022-47392MISC codesys -- multiple_products An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation. 2023-05-15 6.5 CVE-2022-47393MISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/. The manipulation of the argument page leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-228883. 2023-05-12 6.1 CVE-2023-2667MISCMISC lost_and_found_information_system_project -- lost_and_found_information_system A vulnerability was found in SourceCodester Lost and Found Information System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file classes/Master.php?f=save_inquiry of the component Contact Form. The manipulation of the argument fullname/contact/message leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-228887. 2023-05-12 6.1 CVE-2023-2671MISCMISC companymaps_project -- companymaps Cross Site Scripting (XSS) vulnerability in vogtmh cmaps (companymaps) 8.0 allows attackers to execute arbitrary code. 2023-05-12 6.1 CVE-2023-29808MISCMISCMISC jerryscript -- jerryscript Jerryscript 3.0 *commit 1a2c047) was discovered to contain an Assertion Failure via the component parser_parse_class at jerry-core/parser/js/js-parser-expr.c. 2023-05-12 5.5 CVE-2023-31913MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 05dbbd1) was discovered to contain out-of-memory issue in malloc. 2023-05-12 5.5 CVE-2023-31914MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the jmem_heap_finalize at jerry-core/jmem/jmem-heap.c. 2023-05-12 5.5 CVE-2023-31916MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 1a2c047) was discovered to contain an Assertion Failure via the parser_parse_function_arguments at jerry-core/parser/js/js-parser.c. 2023-05-12 5.5 CVE-2023-31918MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the jcontext_raise_exception at jerry-core/jcontext/jcontext.c. 2023-05-12 5.5 CVE-2023-31919MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the vm_loop at jerry-core/vm/vm.c. 2023-05-12 5.5 CVE-2023-31920MISC jerryscript -- jerryscript Jerryscript 3.0 (commit 05dbbd1) was discovered to contain an Assertion Failure via the ecma_big_uint_div_mod at jerry-core/ecma/operations/ecma-big-uint.c. 2023-05-12 5.5 CVE-2023-31921MISC ibm -- planning_analytics_local IBM Planning Analytics Local 2.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 250454. 2023-05-12 5.4 CVE-2023-28520MISCMISC ibm -- spectrum_protect IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325. 2023-05-12 4.9 CVE-2023-27863MISCMISC codesolz -- easy_ad_manager Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CodeSolz Easy Ad Manager plugin

Read more »

When does an old iPhone become unsafe to use?
When Apple stops issuing security updates for older iPhones, they become unsafe to use. But exactly how long can you safely keep using an old iPhone? The post appeared first on The Mac Security Blog.

Read more »

Expect .zip and .mov domains to be used in phishing and malware attacks
Back in 2014, Google became the owner of several new “top-level domains.” Called a TLD for short, a top-level domain is the “dot-something” at the end of a domain name, for example .com or .net. Two of the new TLDs that Google registered were .zip and .mov. You probably recognize that .zip is also a […] The post appeared first on The Mac Security Blog.

Read more »

Urgent Patches: macOS Ventura 13.4, iOS 16.5 fix 3 actively exploited vulns
On Thursday, May 18, Apple released updates to all of its operating systems. The updates included new features as well as security-related fixes—including for three “actively exploited” vulnerabilities. Let’s take a look at the highlights of each update. In this article: Apple addresses three zero-day vulnerabilities macOS Ventura 13.4 macOS Monterey 12.6.6 macOS Big Sur […] The post appeared first on The Mac Security Blog.

Read more »

Apple launches Back to School 2023 promotion, get up to $150 with select Macs and $100 with select iPads
Apple today launched their 2023 Back to School Promotion. From now until October 2, 2023, Education customers receive a free $150 Apple Gift Card with the purchase of a new MacBook Air, MacBook Pro, or 24-inch iMac. A free $100 Gift Card is included with Mac minis. Education customers receive a free $100 Apple Gift Card with the purchase of any new iPad Air or […] The post first appeared on MacPrices.net.

Read more »

Apple launches Back to School 2023 promotion, get up to $150 with select Macs and $100 with select iPads
Apple today launched their 2023 Back to School Promotion. From now until October 2, 2023, Education customers receive a free $150 Apple Gift Card with the purchase of a new MacBook Air, MacBook Pro, or 24-inch iMac. A free $100 Gift Card is included with Mac minis. Education customers receive a free $100 Apple Gift Card with the purchase of any new iPad Air or […] The post first appeared on MacPrices.net.

Read more »

Apple drops prices on M1 Max and M1 Ultra Mac Studios by as much as $440, Certified Refurbished
Apple has dropped prices on clearance M1 Max and M1 Ultra Mac Studios in their Certified Refurbished store. Each Mac Studio comes with Apple’s one-year warranty, and shipping is free: – Mac Studio (10-Core M1 Max CPU): $1529 was $1799 – Mac Studio (20-Core M1 Ultra CPU): $3059 was $3599 Their prices are the lowest available for a Mac Studio among the resellers we track. […] The post first appeared on MacPrices.net.

Read more »

Apple drops Certified Refurbished 13-inch M2 MacBook Air prices to a new low of only $929
Apple has lowered prices on Certified Refurbished 13″ M2 MacBook Airs prices by $150-$160 to a new low starting price of $929. These are the cheapest M2-powered MacBooks for sale at Apple and also the best deal on MacBooks available anywhere. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M2 MacBook Air/8-Core M1 Silicon CPU, […] The post first appeared on MacPrices.net.

Read more »

Apple drops prices on the 13-inch M2 MacBook Air by $100 to $1099
As part of their introduction of the new 15″ MacBook Air at WWDC 2023 today, Apple dropped prices on the existing 13″ M2 MacBook Air models by $100 to a new starting price of $1099 and only $1099 for Education customers. Step up to the model with 512GB of SSD storage for a new price of $1399, $100 lower as well. All other options remain […] The post first appeared on MacPrices.net.

Read more »

Apple introduces updated Mac Studio and Mac Pro models with M2 Ultra CPUs
Apple announced the latest Mac Studio and Mac Pro today, the most powerful Macs ever made. The Mac Studio is up to 6x faster than the most powerful Intel-based 27-inch iMac, and up to 3x faster than its predecessor with M1 Ultra. The Mac Pro, now featuring M2 Ultra, is up to 3x faster than the previous-generation Intel-based model. Both Mac Studio and Mac Pro […] The post first appeared on MacPrices.net.

Read more »

Apple introduces the new 15-inch M2 MacBook Air for $1299
Apple released the long-anticipated 15-inch MacBook Air today, the world’s thinnest laptop of its size, offering a 15.3-inch Liquid Retina display, M2 performance, up to 18 hours of battery life, and a near-silent fan-less design. Along with a six-speaker sound system, a 1080p FaceTime HD camera, MagSafe charging, and macOS Ventura, the 15-inch MacBook Air provides a powerful and portable experience. It is available for […] The post first appeared on MacPrices.net.

Read more »

Apple Watch Sale: Take $60 off all Series 8 Models at Sams Club online through June 18th
Sams Club has Apple Watch Series 8 models on sale for $60 off Apple’s MSRP from now through June 18, 2023. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): – 41mm Apple Watch Series 8 GPS + Cellular: $429.98 $60 off MSRP – 45mm Apple […] The post first appeared on MacPrices.net.

Read more »

Apple has 27-inch Studio Displays on sale for up to $350 off MSRP
Apple has Studio Display models available in their Certified Refurbished store for up to $350 off MSRP. Each display comes with Apple’s one-year warranty and ships free. The following models are available: Tilt Adjustable Stand: – Studio Display (Standard glass): $1359 $240 off MSRP – Studio Display (Nano glass): $1609 $290 off MSRP Tilt & Height Adjustable Stand: – Studio Display (Standard glass): $1699 $300 […] The post first appeared on MacPrices.net.

Read more »

Clearance 12.9-inch iPad Pros available at Apple starting at $889
Apple has Certified Refurbished 2021 12″ M1 iPad Pros available in their online store in a variety of configurations. Models start at $889 and range up to $350 off Apple’s original MSRP. Each iPad Pro comes with Apple’s standard one-year warranty, features a new outer case, and is in like-new condition. These iPads might be the right thing for you if you’re looking to save […] The post first appeared on MacPrices.net.

Read more »

Clearance 12.9-inch iPad Pros available at Apple starting at $889
Apple has Certified Refurbished 2021 12″ M1 iPad Pros available in their online store in a variety of configurations. Models start at $889 and range up to $350 off Apple’s original MSRP. Each iPad Pro comes with Apple’s standard one-year warranty, features a new outer case, and is in like-new condition. These iPads might be the right thing for you if you’re looking to save […] The post first appeared on MacPrices.net.

Read more »

Apple Magic Keyboard for 12-inch iPad Pro on sale for $179, save $170
Walmart has the Black or White Apple Magic Keyboard for the 12″ iPad Pro on sale for $179.99 shipped. Their price is $170 off MSRP, and it’s the lowest price for a new 12″ Magic Keyboard available today For the latest sales and prices, see our iPad Keyboards Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »