Apple HomeKit is the best smart home platform
I haven't used much in the way of smart home technology but I've done a lot of research on it in preparation for having at least a "less dumb" home. When it comes to privacy and security, what Apple has and has planned for HomeKit attracts me the most.∞ Read this on The Loop

Read more »

Don’t feel bad for the iPad
I certainly don't feel bad for it. As a matter of fact, I still lust for an iPad Pro and an Apple Pencil.∞ Read this on The Loop

Read more »

Stars of Apple TV+’s ‘Visible – Out on Television’ A...
In the latest Apple TV+ clip, some of the stars featured in the series Visible – Out On Television, share moments when they nearly gave up. The likes of Ellen DeGeneres, Laverne Cox, and Adam Lambert all appear in the series and explain the difficult times they went through. The series is available now with an Apple TV+ subscription.

Read more »

Apple woos new generation of storytellers with anime ad for ...
Apple created a special new ad for customers in Japan that highlights the different ways the Mac has been showcased on some of the most popular anime shows in the country. Cut together with scenes from shows like Mr. Osomatsu, NEW GAME!!, your name., Weathering with You and more, the brilliant ad encourages anime fans […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

FCC listing reveals HomeKit support should arrive with Ecobe...
We got our first look at Ecobee’s upcoming smart camera with voice control last year, then got a real-life image in July. Now an FCC listing for the device has confirmed that it will come with HomeKit support. more… The post FCC listing reveals HomeKit support should arrive with Ecobee smart camera appeared first on 9to5Mac.

Read more »

UK’s MI5 chief wants ‘exceptional access’ to encryptio...
MI5’s director general Andrew Parker has called on technology companies to find a way to allow spy agencies “exceptional access” to encrypted messages… The post UK’s MI5 chief wants ‘exceptional access’ to encryption appeared first on MacDailyNews.

Read more »

HomeKit Weekly: iSmartgate Pro is an easy to install HomeKit...
Since I started building out my HomeKit home, one of the areas I haven’t touched is my garage doors. I had investigated various adaptors over the years, but I have an off-brand garage door opener that never seemed to be on the compatibility list. I recently came across a model that did work with my particular opener, so I was thrilled to be able to pick it up and get it installed. I’ve had the iSmartGate Pro garage door opener installed for the past few weeks, and I couldn’t be happier with it. If you are looking for a HomeKit garage door opener, read on to see how to it works, and how I am using it. more… The post HomeKit Weekly: iSmartgate Pro is an easy to install HomeKit garage door opener appeared first on 9to5Mac.

Read more »

Take $99 off 10.2-inch iPad, plus latest Best Buy flash sale...
Friday’s best deals include up to $99 off 10.2-inch iPad, a new Best Buy Flash Sale, and notable discounts on Mac mini. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more… The post Take $99 off 10.2-inch iPad, plus latest Best Buy flash sale in today’s best deals appeared first on 9to5Mac.

Read more »

Panicked selling of AAPL lets Apple buy back billions cheapl...
Media-induced panic related to the coronavirus outbreak has caused stocks to crash in value, with Apple's share price dropping to levels not seen since early December, back before it was appreciated how well Apple's iPhone 11, wearables, services, and other offerings had performed during holiday sales. That drop affords Apple a rare opportunity to snatch up billions of its shares at a discount nobody could have otherwise imagined possible.

Read more »

First Apple Store to Launch in India in 2021, Online Store W...
CUPERTINO – Apple CEO Tim Cook announced his company would open its first physical Apple Store in India in 2021, and that the company would launch its own online store later in 2020.

Read more »

How to Create a Honeypot URL With URL Canary
A service I recently discovered is URL Canary. It creates a honeypot URL that you can then put in a location such as your cloud storage. It alerts you if that URL has been accessed. URL Canary will catch automated robots and crawlers, as well as manual human attackers. The only time it won’t catch an attacker is if they don’t see the canary, or they don’t find it sufficiently-compelling and opt not to visit it. Since you have control of the URL and the domain name, you can make your canaries as compelling as possible for your specific use case. There’s a similar service I know of called CanaryTokens.

Read more »

Apple dumping Intel for ARM-powered Macs would be a good thi...
While it would be a huge task, Apple dumping Intel would be a good thing for ARM-powered Macs, but as with most things, there would be difficulties and downsides. The post Apple dumping Intel for ARM-powered Macs would be a good thing appeared first on MacDailyNews.

Read more »

9to5Mac Daily: February 28, 2020 – iPad Pro Smart Keyboard...
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Hyper:  Hyper’s next-gen of USB-C Hubs is now available to preorder. Thanks to Hyper, we’re also giving 9to5Mac readers the chance to win Apple’s new Mac Pro worth $6000 this month.

Read more »

Love that bass? These RIOT HiFi Over-Ear Headphones will mak...
Do you love the deep, resonant bass of a good pair of over-ear headphones? How about crisp trebles that make you believe the band is playing right in front of you? The RIOT HiFi Over-Ear Headphones provide great sound and won’t cost you an 🦾 and a 🦵!

Read more »

Carriers Could be Fined $200M For Selling Location Data
The FCC is preparing to fine four major cellular carriers roughly US$200 million for selling location data of customers.

Read more »

Three Reasons You Might Want a Home Security Camera
Home security cameras are all the rage, but you have to start with the reason you want one in the first place. Do you want to record criminal behavior? Spot wildlife? Know your kids came in before midnight? It’s all about intent, and many people discover they have multiple overlapping desires.

Read more »

President Trump may invoke emergency powers to combat corona...
President Donald Trump’s administration is considering invoking special powers according to two U.S. officials who requested anonymity… The post President Trump may invoke emergency powers to combat coronavirus appeared first on MacDailyNews.

Read more »

Coronavirus fears erase 20% of Apple’s market cap
Coronavirus has hit Apple shares hard. Despite initially shrugging off the disruption of the outbreak, Apple is currently trading down more than 20% from its record record high. That makes it one of the hardest hit stocks on the Dow Jones Industrial Average thanks to coronavirus. Apple climbed to $327.85 on January 29. At time […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

∞ Apple Japan, anime commercial
[VIDEO] Big fan of anime, and love this cut-together commercial from Apple Japan (video embedded in main Loop post). Check out all the different Apple logo homages in the different scenes. Whimsy. Nice. Courtesy of Google Translate, this is the English translation of the video description: Beyond the Mac, new stories are born one after another. A story that is not yet in this world. Come on, you too. Me too!

Read more »

How to add text to photos on iPhone & iPad with Markup
Do you ever edit photos on your iPhone? Perhaps to crop them for posting on social media? Or to add circles and arrows to highlight a funny bit? The linked article takes this one step further and shows you how to add text to your annotations.∞ Read this on The Loop

Read more »

∞ Lady Gaga teases “Stupid Love”, shot on iPhone 11 Pr...
[VIDEO] Terrific work. Great set, costumes, colors, movement and, of course, great music from the creative mind of Stefani Joanne Angelina Germanotta. Video embedded in main Loop post.

Read more »

9 questions about the rumored iPad Smart Keyboard with track...
First things first, this from a paywalled article from The Information that's been making a lot of noise: Apple is planning to release an iPad keyboard accessory later this year that will include a built-in trackpad, the latest step in its effort to position the tablet device as an alternative to laptop computers, according to a person familiar with the matter. The company will likely release the accessory alongside the next version of the iPad Pro expected later this year, the person added. And this, from the headline linked article by Jason Snell: I’m excited. For a long time I’ve been an advocate for iPad keyboards and pointing devices, and this potential product would offer a way for Apple to differentiate the iPad Pro from its increasingly capable lower-end iPads. But I’ve got a lot of questions, too. Follow the link. These are some thoughtful questions. A few thoughts of my own: Is there a need for a pointing device? Are we approaching an uncanny valley with a device that looks an awful lot like a MacBook with a touchscreen, but without the unifying elements like the Finder and window-management system that make a MacBook so intuitive to use? From this article by The Verge's Dieter Bohn: I don’t want Apple to fall back on the crutch of just using desktop OS paradigms to solve the iPad’s user interface intuitiveness problem. The last thing we should want is for the iPad to turn into a Mac. It’s on a different path and it would be a shame to have those ideas tossed out the window just so we can have more traditional windows on the iPad. I'm in the same camp as Dieter. I'd hate to see the lines between the MacBook and iPad get blurry. As is, I know when to reach for my iPad, my iPhone and my Mac. Different tools for different jobs. If the report is true, it will be interesting to see what Apple has in mind.∞ Read this on The Loop

Read more »

Apple’s over-the-air OS recovery will solve a huge problem
The ability to perform a clean restore on an iPhone or iPad without a Mac or PC is a huge deal. Apple's over-the-air OS recovery will solve a huge problem… The post appeared first on MacDailyNews.

Read more »

9to5Mac Happy Hour 266: iPad Pro Smart Keyboard Trackpad, AR...
Benjamin and Zac discuss the latest report that Apple is planning to release an iPad Pro Smart Keyboard with a trackpad, new Powerbeats4 leaks, the latest Ming-Chi Kuo prediction on Macs dropping Intel, HomeKit routers, and much more. 9to5Mac Happy Hour is available on Apple Podcasts, Spotify, Stitcher, TuneIn or through our RSS feed for Overcast and other podcast players. New episodes are released every Friday. Sponsored by Hyper: Preorder the new HyperDrive GEN2: Next Generation USB-C Hub for $59 (40% off the expected retail price). Enter the Mac Pro Giveaway. Sponsored by Zapier:Right now through the end of the month, try Zapier free by going to our special link Zapier.com/HAPPYHOUR Sponsored by LinkedIn Jobs: Go to LinkedIn.com/HAPPYHOUR and get $50 OFF toward your first job post!

Read more »

How to take a screenshot on a MacBook Pro
There may be as many ways to take a screenshot off your 16-inch MacBook Pro as there are reasons to take them, but Apple could make it a lot more obvious what's possible and how to do it.

Read more »

Comment: It’s time for governments to learn how end-to-end...
There’s an emerging health crisis at the moment, besides coronavirus: the head injuries caused by techies banging their heads on their desks at each piece of evidence that governments don’t understand how end-to-end encryption works. The latest example of this, reported in the Guardian, was the head of Britain’s domestic counterintelligence and security agency, MI5, calling on tech companies like Apple and Facebook to continue to offer end-to-end encryption, but to provide MI5 access “on an exceptional basis”…  more… The post Comment: It’s time for governments to learn how end-to-end encryption works appeared first on 9to5Mac.

Read more »

[Update: Released] Lady Gaga teases her new music video enti...
Lady Gaga is back with a new single, “Stupid Love,” which will be officially available on February 28. The pop star shared a teaser that revealed the clip was shot entirely with an iPhone. more… The post [Update: Released] Lady Gaga teases her new music video entirely filmed on iPhone appeared first on 9to5Mac.

Read more »

Long-awaited Crossy Road follow-up comes to Apple Arcade
Crossy Road Castle, the long-awaited follow-up to Hipster Whale’s 2014 game Crossy Road has landed on Apple Arcade. The game takes the same updated Frogger concept that made the original game such a hit, but swaps out the roads and cars for a procedurally generated endless castle tower the player has to climb. Check out […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

June 2005: there were worries that the ‘sun will set o...
At the 2005 Apple Worldwide Developer Conference, Steve Jobs announced that the first Macs with Intel processors would arrive a year after the event. Instead, Apple worked to get this done in half that time.

Read more »

Fed seen cutting rates amid virus threat, low inflation
Traders are betting that the U.S. Federal Reserve may move aggressively to cut rates due the effects of the COVID-19 coronavirus outbreak… The post appeared first on MacDailyNews.

Read more »

Zyxel 0day Affects its Firewall Products, Too
On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products.

Read more »

Red Hat Security Advisory 2020-0568-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Zyxel Fixes 0day in Network Storage Devices
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a "ZyXEL") is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

Read more »

Switch default apps on iPhone or iPad for better security an...
Modern operating systems, both on the desktop and on mobile devices, include plenty of “stock apps”—apps provided by default so you can use your device without needing a lot of third-party software. You get an email app, a calendar, a web browser, a messaging app, and more. This wasn’t always the case; I remember when […]

Read more »

Red Hat Security Advisory 2020-0559-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Hackers Were Inside Citrix for Five Months
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.

Read more »

Encoding Stolen Credit Card Data on Barcodes
Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the U.S. Secret Service, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code.

Read more »

Red Hat Security Advisory 2020-0515-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability has been addressed.

Read more »

Pay Up, Or We’ll Make Google Ban Your Ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google's AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher's ads with so much bot and junk traffic that Google's automated anti-fraud systems suspend the user's AdSense account for suspicious traffic.

Read more »

Vulnerability Summary for the Week of February 10, 2020
Original release date: February 17, 2020The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- framemaker   Adobe Framemaker versions 2019.0.4 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-02-13 10 CVE-2020-3740CONFIRM ajaxeplorer -- ajaxeplorer   Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php). 2020-02-11 10 CVE-2013-4267MISCMISCMISC artica -- pandora_fms   functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. 2020-02-12 9 CVE-2020-8947MISCMISCMISC atutor -- atutor   confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. 2020-02-11 7.5 CVE-2014-9753MISCMISCMISCMISCMISC belkin -- n300_router   An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." 2020-02-07 10 CVE-2013-3091MISCMISCMISC biscom -- secure_file_transfer   Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. 2020-02-07 7.5 CVE-2020-8796MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/175922 bosch -- bvms_mobile_video_service   Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = V3.0), SCALANCE S612 (All versions >= V3.0), SCALANCE S623 (All versions >= V3.0), SCALANCE S627-2M (All versions >= V3.0). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. 2020-02-11 5 CVE-2019-13925MISC siemens -- multiple_scalance_switches   A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (all versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (all versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known. 2020-02-11 4.3 CVE-2019-13924MISC siemens -- multiple_simatic_devices   A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 PN/DP CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions). Affected devices contain a vulnerability that could cause a Denial-of-Service condition of the web server by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device’s web server. Beyond the web service, no other functions or interfaces are affected by the Denial-of-Service condition. 2020-02-11 5 CVE-2019-13940MISCMISC siemens -- ozw672_and_772_web_servers   A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system. 2020-02-11 5 CVE-2019-13941MISC simple_machines -- simple_machines_forum   File Disclosure in SMF (SimpleMachines Forum) character exists. This causes a denial of service in which the recipient cannot read all of their messages. 2020-02-12 not yet calculated CVE-2020-7957CONFIRMCONFIRMMISC dovecot -- dovecot   lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. 2020-02-12 not yet calculated CVE-2020-7046CONFIRMCONFIRMMISC drupal -- drupal   The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field. 2020-02-11 not yet calculated CVE-2013-4225MISCMISCMISCMISC easyxdm -- easyxdm   Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file. 2020-02-14 not yet calculated CVE-2013-5212MISCXF etherpad -- etherpad   Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297. 2020-02-13 not yet calculated CVE-2015-3309MISCMISCMISC extrun -- ilbo   ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors. 2020-02-14 not yet calculated CVE-2020-5532MISCMISCMISC fasterxml -- jackson-databind   FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 2020-02-10 not yet calculated CVE-2020-8840MISC foxit -- phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400. 2020-02-14 not yet calculated CVE-2020-8846MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560. 2020-02-14 not yet calculated CVE-2020-8855MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9358. 2020-02-14 not yet calculated CVE-2020-8845MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9591. 2020-02-14 not yet calculated CVE-2020-8853MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of JPEG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9606. 2020-02-14 not yet calculated CVE-2020-8854MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9640. 2020-02-14 not yet calculated CVE-2020-8856MISCMISC foxit -- reader This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9416. 2020-02-14 not yet calculated CVE-2020-8852MISCMISC foxit -- reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862. 2020-02-14 not yet calculated CVE-2020-8857MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9414. 2020-02-14 not yet calculated CVE-2020-8847MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9406. 2020-02-14 not yet calculated CVE-2020-8851MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9407. 2020-02-14 not yet calculated CVE-2020-8848MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9415. 2020-02-14 not yet calculated CVE-2020-8850MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413. 2020-02-14 not yet calculated CVE-2020-8849MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102. 2020-02-14 not yet calculated CVE-2020-8844CONFIRMMISC free_reprintables -- articlefr   A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information. 2020-02-13 not yet calculated CVE-2014-4170MISCMISCMISCMISC freebsd -- bsd_libc   regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. 2020-02-12 not yet calculated CVE-2011-3336FULLDISCBIDMISCBUGTRAQ fujitsu -- multiple_products   The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V11 and other versions, Interstage Job Workload Server V8, Interstage List Works V10 and other versions, Interstage Studio V12 and other versions, Interstage Web Server Express V11, Linkexpress V5, Safeauthor V3, ServerView Resource Orchestrator V3, Systemwalker Cloud Business Service Management V1, Systemwalker Desktop Keeper V15, Systemwalker Desktop Patrol V15, Systemwalker IT Change Manager V14, Systemwalker Operation Manager V16 and other versions, Systemwalker Runbook Automation V15 and other versions, Systemwalker Security Control V1, and Systemwalker Software Configuration Manager V15. 2020-02-07 not yet calculated CVE-2019-13163CONFIRM git -- git   Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. 2020-02-12 not yet calculated CVE-2014-9390MISCMISCMISCMISCMISCMISCMISC gitlab -- gitlab   GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. 2020-02-14 not yet calculated CVE-2019-15592MISCMISC gitlab -- gitlab   GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. 2020-02-14 not yet calculated CVE-2019-15594MISCMISC global_payments -- php-sdk   Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. 2020-02-14 not yet calculated CVE-2019-20455MISCMISC gocloud -- mutliple_devices   Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring. 2020-02-12 not yet calculated CVE-2020-8949MISC google -- android In notifyNetworkTested and related functions of NetworkMonitor.java, there is a possible bypass of private DNS settings. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-122652057 2020-02-13 not yet calculated CVE-2020-0028MISC google -- android   In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-141552859 2020-02-13 not yet calculated CVE-2020-0005MISC google -- android   It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520 2020-02-13 not yet calculated CVE-2020-0014MISC google -- android   In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel 2020-02-13 not yet calculated CVE-2020-0030MISC google -- android   The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. 2020-02-12 not yet calculated CVE-2011-2343CONFIRMMISC google -- android   In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-67319274 2020-02-13 not yet calculated CVE-2019-2200MISC google -- android   In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139017101 2020-02-13 not yet calculated CVE-2020-0015MISC google -- android   In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140419401 2020-02-13 not yet calculated CVE-2020-0026MISC google -- android   In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892 2020-02-13 not yet calculated CVE-2020-0017MISC google -- android   In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049 2020-02-13 not yet calculated CVE-2020-0018MISC google -- android   In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144040966 2020-02-13 not yet calculated CVE-2020-0027MISC google -- android   In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731 2020-02-13 not yet calculated CVE-2020-0020MISC google -- android   In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could lead to remote denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141413692 2020-02-13 not yet calculated CVE-2020-0021MISC google -- android   In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715 2020-02-13 not yet calculated CVE-2020-0022FULLDISCMISC google -- android   In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871 2020-02-13 not yet calculated CVE-2020-0023MISC hashicorp -- sentinel HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. 2020-02-14 not yet calculated CVE-2019-19879MISC hcl -- appscan_standard_edition   HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. 2020-02-14 not yet calculated CVE-2019-4392MISC hitachi -- command_suite_and_automation_director   A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21032MISCCONFIRM hitachi -- multiple_products   A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21033MISCCONFIRM hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7208MISC hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7209MISC ibm -- tivoli_monitoring_service   IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647. 2020-02-13 not yet calculated CVE-2019-4592XFCONFIRM ibm -- urbancode_deploy_and_urbancode_build IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248. 2020-02-13 not yet calculated CVE-2019-4666XFCONFIRMCONFIRM intel -- converged_security_and_management_engine   Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access. 2020-02-13 not yet calculated CVE-2019-14598MISC intel -- e1000e/82574l_network_controller_devices   A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex, 33 hex, or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image. 2020-02-13 not yet calculated CVE-2013-1634MISCMISCMLISTMLISTSECTRACKXF intel -- manycore_platform_software_stack   Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0563MISC intel -- renesas_electronics_usb   Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0560MISC intel -- sgx_software_development_kit Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0561MISC intel --  raid_web_console_2 Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0562MISC intel --  raid_web_console_3_for_windows Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0564MISC invision_power_services -- invision_power_board   Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. 2020-02-12 not yet calculated CVE-2013-3725MISC istio -- istio   An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4. 2020-02-14 not yet calculated CVE-2020-8843MISCMISCCONFIRM joomla! -- joomla!   Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. 2020-02-12 not yet calculated CVE-2011-4906CONFIRMEXPLOIT-DBMISC joomla! -- joomla!   TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. 2020-02-12 not yet calculated CVE-2011-4908MISCEXPLOIT-DBMLIST jsreport -- jsreport   An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8128MISC jsreport -- script-manager   An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8129MISC juniper -- junos_os   Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. 2020-02-11 not yet calculated CVE-2014-6447CONFIRMMISC kaseya -- virtual_system_administrator   Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. 2020-02-13 not yet calculated CVE-2015-6589MISCMISCMISCMISC kde -- paste_applet   The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack. 2020-02-11 not yet calculated CVE-2013-2120MISCMISCMISCMISCMISC kde -- paste_applet   The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output. 2020-02-11 not yet calculated CVE-2013-2213MISCMISCMISC kinetica -- kinetica   The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command. 2020-02-11 not yet calculated CVE-2020-8429MISCMISC lenovo -- ez_media_&_backup_center A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page. 2020-02-14 not yet calculated CVE-2019-19758CONFIRM lenovo -- multiple_devices   Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled. 2020-02-14 not yet calculated CVE-2019-6190CONFIRM lenovo -- xclarity_administrator   An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. 2020-02-14 not yet calculated CVE-2019-19757CONFIRM lenovo -- xclarity_administrator   An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. 2020-02-14 not yet calculated CVE-2019-6194CONFIRM lenovo -- xclarity_administrator   An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes. 2020-02-14 not yet calculated CVE-2019-6193CONFIRM lenovo -- xclarity_controller   An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. 2020-02-14 not yet calculated CVE-2019-6195CONFIRM lexmark -- multiple_devices   Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. 2020-02-13 not yet calculated CVE-2019-18791MISCCONFIRM libuv -- libuv   The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition. 2020-02-11 not yet calculated CVE-2014-9748MISCMISCMISCMISCMISC linux -- linux_kernel   ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. 2020-02-14 not yet calculated CVE-2020-8992MISC lvm2 -- lvm2   vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. 2020-02-14 not yet calculated CVE-2020-8991MISC magento -- magento Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. 2020-02-13 not yet calculated CVE-2012-6091MLISTBIDXF mailu -- mailu   In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354 2020-02-13 not yet calculated CVE-2020-5239MISCCONFIRM mambo -- mambo_cms Mambo CMS through 4.6.5 has multiple XSS. 2020-02-12 not yet calculated CVE-2011-2499MLIST mantisbt -- mantisbt   A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. 2020-02-13 not yet calculated CVE-2020-8981MISCMISC matestack-ui-core_gem_for_ruby_on_rails -- matestack-ui-core_gem_for_ruby_on_rails matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. 2020-02-13 not yet calculated CVE-2020-5241CONFIRM maxum_development_corporation -- rumpus_ftp   A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html. 2020-02-10 not yet calculated CVE-2019-19664MISCMISC maxum_development_corporation -- rumpus_ftp_server   A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html. 2020-02-10 not yet calculated CVE-2019-19662MISCMISC mcafee -- endpoint_security   Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. 2020-02-14 not yet calculated CVE-2020-7251CONFIRM microsoft -- multiple_windows_products An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0728MISCBUGTRAQ microsoft -- multiple_windows_products An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0714MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0745, CVE-2020-0792. 2020-02-11 not yet calculated CVE-2020-0715MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0727MISC microsoft -- multiple_windows_products   A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0708MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0719, CVE-2020-0720, CVE-2020-0721, CVE-2020-0722, CVE-2020-0723, CVE-2020-0724, CVE-2020-0725, CVE-2020-0726, CVE-2020-0731. 2020-02-11 not yet calculated CVE-2020-0691MISC microsoft -- office_online_server   A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0695MISC microsys -- promotic   Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service. 2020-02-13 not yet calculated CVE-2014-1617MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. 2020-02-13 not yet calculated CVE-2013-7287MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm 2020-02-12 not yet calculated CVE-2013-7286MISCMISC moxa -- mgate_5105-mb-eip_devices   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. 2020-02-14 not yet calculated CVE-2020-8858MISCMISC netgear -- cg3100_devices   A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information. 2020-02-13 not yet calculated CVE-2014-3919MISC netis -- wf2471_devices   Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter. 2020-02-12 not yet calculated CVE-2020-8946MISC nvidia -- graphics_drivers   A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. 2020-02-12 not yet calculated CVE-2012-0951MISCMISC nxp -- kw41z_devices   The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet. 2020-02-12 not yet calculated CVE-2019-17519MISC openconnect_project -- openconnect_vpn_client OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection. 2020-02-13 not yet calculated CVE-2013-7098CONFIRM openvpn -- access_server OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). 2020-02-13 not yet calculated CVE-2020-8953CONFIRM openx -- openx_ad_server   A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code 2020-02-14 not yet calculated CVE-2013-4211MISCMISCMISCMISCMISC otrs -- itsm_and_faq   A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code. 2020-02-12 not yet calculated CVE-2013-2637MISCMISCMISCMISC palo_alto_networks -- expedition_migration_tool   Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions. 2020-02-12 not yet calculated CVE-2020-1977CONFIRM palo_alto_networks -- globalprotect   A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS. 2020-02-12 not yet calculated CVE-2020-1976CONFIRM palo_alto_networks -- pan-os   Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. 2020-02-12 not yet calculated CVE-2020-1975CONFIRM pcre -- pearl_compatible_regular_expressions   An out-of-bounds read was discovered in PCRE before 10.34 when the pattern X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. 2020-02-14 not yet calculated CVE-2019-20454MISCMISCMISCMISC podman -- podman   A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. 2020-02-11 not yet calculated CVE-2020-1726CONFIRM prestashop -- prestashop   PrestaShop before 1.4.11 allows logout CSRF. 2020-02-14 not yet calculated CVE-2013-4792MISC prestashop -- prestashop   PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. 2020-02-14 not yet calculated CVE-2013-4791MISC prismview -- prismview_system_and_prismview_player   The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.) 2020-02-10 not yet calculated CVE-2019-20451MISC proglottis -- gpgme   The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. 2020-02-12 not yet calculated CVE-2020-8945MISCMISCMISCMISC progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. 2020-02-14 not yet calculated CVE-2020-8611MISCCONFIRMCONFIRMCONFIRM progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS. 2020-02-14 not yet calculated CVE-2020-8612MISCCONFIRMCONFIRMCONFIRM python-mode -- python-mode A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. 2020-02-12 not yet calculated CVE-2013-5106MISC qemu -- qemu   An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. 2020-02-11 not yet calculated CVE-2020-1711CONFIRMMISCMISC qnap -- viocard-300_devices   QNAP VioCard 300 has hardcoded RSA private keys. 2020-02-13 not yet calculated CVE-2013-6277MISCMISC realtek -- ndis_driver_rt64x64.sys   Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0. 2020-02-12 not yet calculated CVE-2019-11867MISCMISC red_hat -- openshift_enterprise   The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. 2020-02-12 not yet calculated CVE-2014-0234MISCMISCMISCMISCMISC runc -- runc   runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) 2020-02-12 not yet calculated CVE-2019-19921SUSEMISCMISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. 2020-02-13 not yet calculated CVE-2020-8804MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. 2020-02-13 not yet calculated CVE-2020-8803MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. 2020-02-13 not yet calculated CVE-2020-8802MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows PHAR Deserialization. 2020-02-13 not yet calculated CVE-2020-8801MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. 2020-02-13 not yet calculated CVE-2020-8800MISCMISCMISC samsung -- s6_edge_smartphone   Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter. 2020-02-12 not yet calculated CVE-2015-7890MISCMISCMISC sap -- business_objects_intelligence_platform Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6189MISCMISC sap -- enterprise_resource_planning_and_s/4hana   VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check. 2020-02-12 not yet calculated CVE-2020-6188MISCMISC sap -- host_agent SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability. 2020-02-12 not yet calculated CVE-2020-6183MISCMISC sap -- host_agent   SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6186MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management. 2020-02-12 not yet calculated CVE-2020-6192MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation. 2020-02-12 not yet calculated CVE-2020-6191MISCMISC sap -- mobile_platform   SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server. 2020-02-12 not yet calculated CVE-2020-6177MISCMISC sap -- netweaver   SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6187MISCMISC sap -- netweaver   SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6193MISCMISC sap -- netweaver_and_abap_platform   Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability. 2020-02-12 not yet calculated CVE-2020-6181MISCMISC sap -- netweaver_and_s/4hana Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6184MISCMISC sap -- netweaver_and_s/4hana   Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability. 2020-02-12 not yet calculated CVE-2020-6185MISCMISC sap -- netweaver_as_java   Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6190MISCMISC shaman -- shaman   Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password. 2020-02-12 not yet calculated CVE-2011-4338MISCMISC siemens -- multiple_devices   A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All Versions < V4.5), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All Versions < V4.6), PROFINET Driver for Controller (All Versions < V2.1), RUGGEDCOM RM1224 (All versions < V4.3), SCALANCE M-800 / S615 (All versions < V4.3), SCALANCE W700 IEEE 802.11n (All versions

Read more »

Cryptocurrency 101 – Part 1: Blockchain and basic concepts
This is the first in a series of articles exploring Bitcoin, cryptocurrencies and their fundamental technologies, and how you might find these technologies useful and use them safely. You’ve likely heard about Bitcoin, which is a type of cryptocurrency or digital currency, and perhaps you’ve wondered what all the fuss is about. What exactly are […]

Read more »

Gazelle has iPhone 11 models available for up to $280 off Ap...
Gazelle is offering a range of discounted pre-owned unlocked Apple iPhone 11 models starting at $569. iPhones are offered in Fair, Good, and Excellent conditions, and multiple colors are available. Each iPhone has to pass Gazelle’s 30-point inspection process, comes with a charger, is offered with no contract, and includes a 30-day return policy: – 64GB iPhone 11: $569, $130 off MSRP – 128GB iPhone 11: $599, $150 off MSRP – 256GB iPhone 11: $689, $160 off MSRP – 64GB iPhone 11 Pro: $809, $190 off MSRP – 256GB iPhone 11 Pro: $929, $220 off MSRP – 512GB iPhone 11 Pro: $1079, $270 off MSRP – 64GB iPhone 11 Pro Max: $889, $210 off MSRP – 256GB iPhone 11 Pro Max: $1019, $230 off MSRP – 512GB iPhone 11 Pro Max: $1169, $280 off MSRP A range of models are also available tied to AT&T, Sprint, T-Mobile, and Verizon. See these iPhones today at → Read More...

Read more »

Back in stock! Apple’s 4-core and 6-core 2018 Mac minis, C...
Apple has Certified Refurbished 2018 Mac minis available on their online store for $120-$170 off the cost of new models. Each mini comes with a new outer case plus a standard Apple one-year warranty. Shipping is free: – 3.6GHz Quad-Core mini: $679 $120 off MSRP – 3.0GHz 6-Core mini: $929 $170 off MSRP Keep an eye on our Mac mini Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

10″ 128GB iPads on sale today at Amazon for $100 off Apple...
Amazon has new 10.2″ 128GB WiFI iPads for $100 off Apple’s MSRP. These are the same iPads sold by Apple in their retail and online stores. Note that some sale prices may be restricted to certain colors. Amazon’s prices are the lowest available for these models from any Apple reseller: – 2019 10.2″ 128GB WiFi iPad: $329.99 $100 off MSRP Keep an eye on our iPad Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Orcam MyEye 2 Is Inspiration Apple Needs To Make Its AR Smar...
EDITORIAL: 02.28.20- It’s no secret that Apple is planning to further expand into the wearables segment, working quietly behind the scenes to create its own smart glasses — as rumors have suggested in a report from Macworld magazine — which will feature, among other things, augmented reality (AR), however, such a product can’t be enjoyed or, much less, used by an individual who is visually impaired, but, an artificial vision device not designed in California, rather, outside of Silicon Valley is an innovation that the tech giant should emulate and incorporate into its future wearable in order to make it accessible for those without sight. As a long-time user of Apple’s hardware and devices who has had to adapt in recent years, being completely blind for the past seven (a fact that my regular readers have been privy to), accessibility is of concern to me personally, especially when it comes to the Cupertino, California-based company’s products, and, with February being “Low Vision Awareness Month” (a lesser known celebration than the more widely celebrated “Black History Month” in comparison) it’s a perfect time to discuss the use of technology to assist those who can not see. As the tech giant designs and develops its AR smart glasses, an issue it needs to address head on is this very factor, and, all it has to do for its inspiration is to look no further than to a wearable made for the visually impaired that is already on the market. The Orcam MyEye 2 artificial vision device, right, seen mounted onto the frame of a pair of eyeglasses. (Photo: Orcam Technologies) Enter the Orcam MyEye 2 artificial vision device. The MyEye is not a pair of smart glasses, per se, as the device itself simply attaches magnetically with the provided mounting hardware accessory to any user’s eyewear —although a pair of faux eyeglasses are included with the product — such as those blind people, like myself, who wear sunglasses → Read More...

Read more »

Boost Mobile 1-day Flash Sale: $100 off all Apple iPhones + ...
Boost Mobile is offering Apple’s 2019 iPhone 11 and 11 Pro models for $100 off MSRP. Boost is also offering the same $100 discount on new previous-generation iPhone XS, XR, X, 8, and 7 models. For today only, 2/28/20, Boost will take an extra 10% off all iPhone using promo code FLASHFEB2020. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the Sprint network, and they offer plans beginning at $50 per month for one line. No annual contract → Read More...

Read more »

13″ 1.4GHz Silver MacBook Pros on sale for $150 off Apple�...
B&H Photo has new 2019 13″ 1.4GHz Silver MacBook Pros on sale for $150 off Apple’s MSRP today with prices starting at $1149. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1349 $150 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple resellers offer $150-$170 discounts on new 13″ MacBo...
Amazon has new 2019 13″ MacBook Airs on sale for $150-$170 off Apple’s MSRP, with prices starting at $949, each including free shipping. These are the same MacBook Airs Apple sells in their retail and online stores. Be sure to select Amazon as the seller during checkout, rather than a third party: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $949 $150 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1129 $170 off MSRP B&H Photo has 13″ MacBook Airs prices on sale starting at $949 as well. Overnight shipping is free to many locations in the US: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $949 $150 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1129 $170 off MSRP For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

B&H is again offering $100 discounts on Mac minis with m...
B&H Photo has 4-Core and 6-Core Mac minis on sale for $100 off Apple’s standard MSRP, with prices starting at only $699. Overnight shipping is free to many US addresses: – 3.6GHz Quad-Core mini: $699 $100 off MSRP – 3.0GHz 6-Core mini: $999 $100 off MSRP These are the same Mac minis sold by Apple in their retail and online stores. B&H’s prices are the lowest currently available from any Apple reseller. Keep an eye on our Mac mini Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

B&H Photo drops iMac prices, offers models for up to $25...
B&H Photo has new 2019 21″ and 27″ 5K iMacs in stock today and on sale for up to $250 off Apple’s MSRP, with prices starting at only $999. These are the same iMacs sold by Apple in their retail and online stores, and B&H’s prices are the lowest available for these models: – 27″ 3.0GHz 6-Core 5K iMac: $1599 $200 off MSRP – 27″ 3.1GHz 6-Core 5K iMac: $1799 $200 off MSRP – 27″ 3.7GHz 6-Core 5K iMac: $2049 $250 off MSRP – 21″ 2.3GHz 2-Core iMac: $999 $100 off MSRP – 21″ 3.6GHz 4-Core 4K iMac: $1149 $150 off MSRP – 21″ 3.0GHz 6-Core 4K iMac: $1329 $170 off MSRP See our iMac Price Tracker for the latest sales and prices from Apple and → Read More...

Read more »

Flash sale! 11″ 64GB WiFi iPad Pro for $674, $125 off Appl...
Walmart has the 11″ 64GB WiFi iPad Pro on sale on their online store today for $674. That’s $125 off Apple’s MSRP for this model and the cheapest price available from any Apple reseller. Choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price → Read More...

Read more »

Sale! Get the 256GB 13″ Silver MacBook Air for $300 off to...
Amazon has new 2019 13″ 1.6GHz/256GB MacBook Airs, in Silver, on sale today for only $999 shipped. Their price is $300 off Apple’s MSRP for this model, and it’s the cheapest price for a 256GB MacBook Air from any Apple reseller. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Check their site for the latest availability of this MacBook Air. See our 13″ MacBook Air Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Verizon offers free iPhone 7 to customers opening new line o...
Verizon is offering a free 32GB iPhone 7 for new or existing customers who open a new line of service, no trade-in required. Cost of the phone is credited to your account monthly over 24 months. The fine print: “$349.99 purchase on device payment or at retail price & new smartphone line req’d. Less $349.99 promo credit applied to account over 24 mos; promo credit ends if eligibility req’s are no longer met; 0% APR.” This deal is live at → Read More...

Read more »