Apple delays ‘The Banker’ theatrical and streami...
Apple has elected to delay the release of its original movie "The Banker," originally slated to debut in theaters on Dec. 6, as filmmakers investigate allegations of historical inaccuracy and sexual misconduct.

Read more »

How to share Apple TV+ with family and friends
Want to make the most of Apple’s streaming video service? Follow along for how to share Apple TV+ with family and friends. more… The post appeared first on 9to5Mac.

Read more »

Tim Cook says your private data is ‘between you and your p...
Tim Cook says that tech companies are doing a poor job creating policies that protect user privacy. The CEO of Apple wants the US government to step in. “I think we can all admit that when you’ve tried to do something and companies haven’t self policed, that it’s time to have rigorous regulation,” he told […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple reportedly cancelling first theatrical movie debut and...
Earlier this week, Apple canceled the premiere of its original film The Banker starring Samuel L. Jackson. It was supposed to debut at the AFI Fest in LA on Nov. 21st, however, after hearing historical inaccuracy and sexual abuse allegations, Apple decided to hold off. A wide theatrical release was originally slated for December 6th with a debut on Apple TV+ after the new year, but now sources are saying those have been canceled as well (via Variety). more… The post Apple reportedly cancelling first theatrical movie debut and TV+ release after pulling from film festival appeared first on 9to5Mac.

Read more »

How to use a mouse with your iPad or iPhone
A vocal number of heavy-duty iPad users have begged for mouse support on the iPad for years, and that support finally exists on iPadOS 13. A little surprisingly, iOS 13 also brings mouse support to the iPhone.It’s not so surprising, though, that Apple chose to bury it deep within the iPhone and iPad’s Accessibility settings. And when you do hook up a mouse through a Bluetooth or wired connection, you’ll still have to deal with an ugly circular cursor that’s meant to mimic a human fingerprint and a few interface complications. We’re glad the feature’s here, but it doesn’t quite work the way we’d hoped. (It is, after all, designed as an Accessibility feature called "AssistiveTouch.")To read this article in full, please click here

Read more »

Tim Cook talks data privacy and DACA in interview
Apple CEO Tim Cook continued to hammer home Apple's corporate values in an interview aired Friday, calling data privacy one of this century's top issues and vowing to fight for immigrant protections until his "toes point up."

Read more »

Over 1.2B profiles found in unsecured server shows severity ...
The discovery of an unprotected data store containing 1.2 billion records of personal information gleamed from data brokerage services offers a glimpse into not only the kind of resources scammers and hackers can acquire about a large number of potential targets, but also the amount of data online services share or sell with other entities.

Read more »

Top 10 Black Friday deals coming next week (that we know of�...
Throughout this week we’ve offered up our comprehensive coverage of the best Black Friday deals with guides covering just about every product category. So if you’re looking for Apple gear, Android phones, TVs, or smart home accessories, we have you covered. But now it’s time to turn our attention to Black Friday as a whole. Below you find the top 10 Black Friday deals for 2019 that we know of so far. more… The post Top 10 Black Friday deals coming next week (that we know of…) appeared first on 9to5Mac.

Read more »

Prison Profiteer Global Tel Link Charges Prisoners by the Mi...
Prison libraries of paper books are slowly disappearing. In their place prisoners are getting tablets. But profits are being made when prisoners send emails, videoconferencing with family, listening to music, and reading. In West Virginia, a company called Global Tel Link has the contract to provide prisoners in ten prisons with “free” tablets, for which they charge $0.05/minute for reading ebooks, primarily drawn from Project Gutenberg, a free online service of volunteer-produced, public domain and CC-licensed ebooks.

Read more »

AirPods Shipments Could Double to 60M This Year
Shipments of AirPods are expected to double this year to 60 million units, driven in part by the AirPods Pro.

Read more »

Take 4K pictures and videos with the portable drone by Mavig...
iLounge has a special deal on the Portable Foldable Ultimate 4K Drone, which allows you to take great aerial shots and videos in HD or 4K easily. The foldable Ultimate… The post Take 4K pictures and videos with the portable drone by Mavigadget [Deal] appeared first on iLounge.

Read more »

Apple Takes Down Online Store Reviews
Apple today has seemingly removed its product listing reviews at the Apple.com store, along with the customer’s ability to read and leave reviews for all Apple products. Affected online Apple… The post appeared first on iLounge.

Read more »

Apple Releases Revamped ‘Everyone Can Code’ Platform
Apple has updated its ‘Everyone can Code‘ curriculum to accommodate middle school and elementary classrooms around the globe. The revamped platform now has new student guides, teacher’s resources and new… The post appeared first on iLounge.

Read more »

Apple’s ‘Music for Business’ Targets Retail Stores, La...
Apple, in collaboration with PlayNetwork is launching ‘Apple Music for Business‘, where retail stores get access to Apple Music which can be played in stores. Licensed music, human-curated content and… The post Apple’s ‘Music for Business’ Targets Retail Stores, Launched appeared first on iLounge.

Read more »

Database of 1.2 Billion Records Found With Scraped Data
A database filled with 1.2 billion records of data was found on the dark web back in October. I hesitate to call this a data breach because: While the collection is impressive for its sheer volume, the data doesn’t include sensitive information like passwords, credit card numbers, or Social Security numbers. It does, though, contain profiles of hundreds of millions of people that include home and cell phone numbers, associated social media profiles like Facebook, Twitter, LinkedIn, and Github, work histories seemingly scraped from LinkedIn, almost 50 million unique phone numbers, and 622 million unique email addresses. In other words this is all data that people have willingly put on their social media profiles. While it can be used for nefarious purposes (especially phone numbers) this is less of a breach and more of a database of scrapes. Nevertheless I’m using our “data breach” tag.

Read more »

Sony’s Dolby Atmos Soundbar w/ Wireless Subwoofer Now $200...
Looking for a great deal on soundbars but don’t want to compromise quality? How about a Sony 2.1 soundbar speaker system for your TV or computer? Sony has made it… The post Sony’s Dolby Atmos Soundbar w/ Wireless Subwoofer Now $200 Off appeared first on iLounge.

Read more »

This Ultra-Portable Monitor Gives Your Laptop a Second Scree...
Check out the Mobile Pixels DUEX Pro, a portable display that connects to your laptop to give you a second display wherever you go. This device connects to your Mac, Windows, Chrome, or Linux laptop via a USB cable, and you attach it physically to the upper lid of your laptop so that it’s always with you. It slides out when you want to use it, and there’s a mirroring mode that allows you to turn it around soo you can share your screen with someone sitting across from you. It’s offers 1080p resolution, and it’s $211 through our deal. Use coupon code BFSAVE15 at checkout to bring it down to $179.35.

Read more »

Apple Watch Series 3 vs Fitbit Versa 2: Even a two-year-old ...
The Fitbit Versa 2 was announced only a month ago and already its biggest competitor is trying to take it down. With the release of the Apple Watch Series 5, Apple cut the price of the Series 3 to $199, a near-30 percent drop over the prior year’s price. But more importantly, it means you can buy an Apple Watch for the same price as Fitbit’s latest smartwatch—99 cents less if you’re being technical.To read this article in full, please click here

Read more »

2020 iPhone could finally sport 6GB of RAM
Apple is reportedly taking an important step to improve the performance of the 2020 iPhone: more RAM. Specifically, next year’s top-tier models will supposedly make the jump from 4 GB of RAM to 6 GB. The change will happen in the replacements for the iPhone 11 Pro and 11 Pro Max, reports Barclays‘s analyst Blayne […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Review: Hue Smart Plug is another capable HomeKit-enabled ou...
The Hue Smart Plug is an expansion of the Hue lineup from smart bulbs into controlling lamps, one that brings the HomeKit-compatible range closer to becoming a whole smart home solution.

Read more »

Apple’s OS Release Approach – TMO Daily Observations 201...
John Martellaro and Bryan Chaffin join host Kelly Guimont to discuss Apple’s recent iOS and macOS releases and improving user experience.

Read more »

Cleverly Reimagined Slax Distro Pushes Portable Linux’...
Slax Linux is a handy portable operating system that can be a useful alternative to bulky, more complicated Linux options that install to a hard drive. However, it is far from a complete out-of-the-box solution. That is not a bad thing, though. Slax works. Copying just one folder from the downloaded ISO directly to a USB drive gives you a fully functional Linux OS.

Read more »

iOS Developers Get Detailed Subscription Notifications
iOS developers get detailed subscription notifications that would let them send customers notifications with billing issues.

Read more »

Apple Removes Customer Reviews From Online Store
Several days ago Apple quietly removed customer reviews from its online store, and we don’t know if they will reappear.

Read more »

‘The Morning Show’ Episode Six Review: Fighting With Fir...
‘The Morning Show’ team head to LA to cover wildfires raging there, but it is only the nearby mountain ranges where things are heating up.

Read more »

∞ The Dalrymple Report: GarageBand, AirPods Pro and autoco...
Dave and I kicked off this week talking about cooking, but moved into how people are using GarageBand on iOS and Mac. We also discussed autocorrect on iOS and whether or not the AirPods Pro leave any room for competition. Brought to you by: Linode: Instantly deploy and manage an SSD server in the Linode Cloud. Get a server running in seconds with your choice of Linux distro, resources, and choice of 10 node locations. Get a $20 credit when you use promocode dalrymple2019 at https://linode.com/dalrymple/. Subscribe to this podcast

Read more »

The 16-inch MacBook Pro is amazing, but it’s still a Mac [...
There’s a great Steve Jobs story that somehow seems relevant in a 2019 MacBook Pro review. You probably know it, but I’ll tell it anyway. After the iPad launch, Jobs supposedly walked into a meeting with the Mac team, carrying an iPad. He woke up the iPad, which happened instantaneously. Then he woke up a […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Investigation Uncovers Unwanted Sexual Behaviour on iOS Chat...
More than 1,500 complaints of unwanted sexual approaches via Random Chat Apps apps in the App Store have been uncovered.

Read more »

E3’s handmade Apple Watch bands are the perfect holiday gi...
Handmade holiday gifts are a great way to show loved ones you really care. But actually making them yourself can lead to disastrous results. So pick up a gorgeous E3 band for Apple Watch instead. They’re lovingly handcrafted at a workshop in New York using only Horween leather, and they’re beautifully rustic but full of […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple wins partial reprieve over VirnetX $503 million patent...
A US appeals court has upheld two rulings that Apple infringed VirnetX patents, but reversed the decision on two others. The nearly decade-long legal case must now go back a Texas judge who will consider further hearings.

Read more »

DDoS-for-Hire Boss Gets 13 Months Jail Time
A 21-year-old Illinois man was sentenced last week to 13 months in prison for running multiple DDoS-for-hire services that launched millions of attacks over several years. This individual's sentencing comes more than five years after KrebsOnSecurity interviewed both the defendant and his father and urged the latter to take a more active interest in his son’s online activities.

Read more »

Ransomware Bites 400 Veterinary Hospitals
National Veterinary Associates (NVA), a California company that owns more than 700 animal care facilities around the globe, is still working to recover from a ransomware attack late last month that affected more than half of those properties, separating many veterinary practices from their patient records, payment systems and practice management software. NVA says it expects to have all facilities fully back up and running normally within the next week.

Read more »

Why Were the Russians So Set Against This Hacker Being Extra...
The Russian government has for the past four years been fighting to keep 29-year-old alleged cybercriminal Alexei Burkov from being extradited by Israel to the United States. When Israeli authorities turned down requests to send him back to Russia -- supposedly to face separate hacking charges there -- the Russians then imprisoned an Israeli woman for seven years on trumped-up drug charges in a bid to trade prisoners. That effort failed as well, and Burkov had his first appearance in a U.S. court last week. What follows are some clues that might explain why the Russians are so eager to reclaim this young man.

Read more »

Orcus RAT Author Charged in Malware Scheme
In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with orchestrating an international malware scheme.

Read more »

Patch Tuesday, November 2019 Edition
Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and in software that runs on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploited in the wild, as well as a sneaky bug in certain versions of Office for Mac that bypasses security protections and was detailed publicly prior to today's patches.

Read more »

Retailer Orvis.com Leaked Hundreds of Internal Passwords on ...
Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

Read more »

Vulnerability Summary for the Week of November 4, 2019
Original release date: November 11, 2019 | Last revised: November 12, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2019-11-01 7.5 CVE-2011-3923MISCEXPLOIT-DBBIDMISCMISCXFMISC aruba_networks -- clearpass_policy_manager Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. 2019-11-06 10 CVE-2016-4401CONFIRM clamav -- clamav There is a possible heap overflow in libclamav/fsg.c before 0.100.0. 2019-11-06 7.5 CVE-2007-0899MISC computing_for_good -- basic_laboratory_information_system Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. 2019-11-06 7.5 CVE-2019-5617MISC computing_for_good -- basic_laboratory_information_system   Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator. 2019-11-06 7.5 CVE-2019-5644MISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview 2019-11-04 7.5 CVE-2013-2259MISCMISCMISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input 2019-11-04 7.5 CVE-2013-4103MISCMISCMISCMISCMISC gri -- gri gri before 2.12.18 generates temporary files in an insecure way. 2019-11-08 7.5 CVE-2008-7291MISC isl_internet_sicherheitslösungen -- arp_guard A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. 2019-11-04 7.5 CVE-2019-18663MISC linux -- linux_kernel A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. 2019-11-07 7.8 CVE-2019-18812MISC linux -- linux_kernel A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.33 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. 2019-11-07 7.8 CVE-2010-2243MISCCONFIRMMISCMLIST linux -- linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. 2019-11-07 7.5 CVE-2019-18814MISC linux -- linux_kernel A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. 2019-11-07 7.8 CVE-2019-18813MISC linux -- linux_kernel An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. 2019-11-04 7.8 CVE-2019-18680MISCMISCMISCMISC linux -- linux_kernel An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. 2019-11-07 7.5 CVE-2019-18805MISCMISC linux -- linux_kernel A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. 2019-11-07 7.8 CVE-2019-18810MISCMISC linux -- linux_kernel A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. 2019-11-07 7.8 CVE-2019-18809MISC linux -- linux_kernel A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. 2019-11-07 7.8 CVE-2019-18811MISC linux-vserver -- linux-vserver linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. 2019-11-06 10 CVE-2006-4243MISC magento -- magento A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods. 2019-11-06 7.5 CVE-2019-8144MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection. 2019-11-06 9 CVE-2019-8159MISC magento -- magento An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities. 2019-11-05 7.5 CVE-2019-8121MISC magento -- magento An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component. 2019-11-06 7.5 CVE-2019-8136MISC magento -- magento An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. 2019-11-06 7.5 CVE-2019-8158MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. 2019-11-06 7.5 CVE-2019-8135MISC minidlna -- minidlna MiniDLNA has heap-based buffer overflow 2019-11-01 7.5 CVE-2013-2739MISCMISC minidlna -- minidlna minidlna has SQL Injection that may allow retrieval of arbitrary files 2019-11-01 7.5 CVE-2013-2738MISCMISCMISCMISC nvu -- nvu Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues. 2019-11-05 7.5 CVE-2005-2354MISCMISCMISC php-gettext -- php-gettext The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. 2019-11-04 7.5 CVE-2015-8980SUSEMLISTMLISTBIDCONFIRMCONFIRMCONFIRM portainer -- portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). 2019-11-07 9 CVE-2019-16872MISC python_sofware_foundation_and_beanbag -- djblets_and_review_board An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. 2019-11-04 7.5 CVE-2013-4409MISCMISCMISCMISCMISCMISCMISCMISCMISCMISC qualcomm -- multiple_products Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10528CONFIRM qualcomm -- multiple_products Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10533CONFIRM qualcomm -- multiple_products Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10505CONFIRM qualcomm -- multiple_products While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 7.5 CVE-2019-10522CONFIRM qualcomm -- multiple_products While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8976, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM8150 2019-11-06 7.5 CVE-2019-2302CONFIRM qualcomm -- multiple_products Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20 2019-11-06 7.5 CVE-2019-10542CONFIRM qualcomm -- multiple_products Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130 2019-11-06 7.5 CVE-2019-10565CONFIRM qualcomm -- multiple_products Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10541CONFIRM qualcomm -- multiple_products Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10534CONFIRM qualcomm -- multiple_products Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439 2019-11-06 10 CVE-2019-10531CONFIRM qualcomm -- multiple_products Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 9.3 CVE-2019-10529CONFIRM qualcomm -- multiple_products Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9205, MDM9650, QCA8081, QCS605, SD 427, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2249CONFIRM qualcomm -- multiple_products Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2283CONFIRM qualcomm -- multiple_products Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2258CONFIRM qualcomm -- multiple_products Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 2019-11-06 7.2 CVE-2019-2246CONFIRM qualcomm -- multiple_products When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24 2019-11-06 10 CVE-2019-2324CONFIRM qualcomm -- multiple_products Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2325CONFIRM qualcomm -- multiple_products Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2285CONFIRM qualcomm -- multiple_products Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2332CONFIRM qualcomm -- multiple_products Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2323CONFIRM qualcomm -- multiple_products Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2331CONFIRM quest -- kace_systems_management_appliance_server_center Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. 2019-11-06 7.5 CVE-2019-12918MISCMISC rbot -- rbot Rbot Reaction plugin allows command execution 2019-11-06 7.5 CVE-2010-2446MISCMISC red_hat -- openshift cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. 2019-11-01 7.5 CVE-2013-0165MISC s9y -- serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. 2019-11-05 7.5 CVE-2011-1134CONFIRMDEBIANSECTRACKMISC salesagility -- suitecrm SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. 2019-11-06 7.5 CVE-2019-18784MISCMISC shadow_and_sudo -- shadow_and_sudo There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process. 2019-11-04 7.2 CVE-2005-4890MISCMISCMISCMISCMISCMISCMISCMISCMISCMISCMISC sonatype  -- nexus_repository_manager There is an OS Command Injection in Nexus Repository Manager 2019-11-07 not yet calculated CVE-2019-12331CONFIRMMISC python_packaging_authority -- python_package_installer The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. 2019-11-05 not yet calculated CVE-2013-5123MISCMISCMISCMISCMISCMISCMISCMISC rapid7 -- metasploit_pro Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. 2019-11-06 not yet calculated CVE-2019-5642CONFIRM red_hat -- 389_directory_server A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 2019-11-08 not yet calculated CVE-2019-14824CONFIRM red_hat -- enterprise_linux_5 frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user. 2019-11-07 not yet calculated CVE-2008-3278MISCMISCMISC red_hat -- jboss_operations_network In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. 2019-11-08 not yet calculated CVE-2008-5083MISCMISC red_hat -- tuned tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. 2019-11-08 not yet calculated CVE-2013-1820MISCMISCMISC red_hat -- virtualization_manager In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform. 2019-11-09 not yet calculated CVE-2009-3552MISCMISCBUGTRAQ samba -- samba A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. 2019-11-06 not yet calculated CVE-2019-14833SUSECONFIRMMISC samba -- samba A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. 2019-11-06 not yet calculated CVE-2019-10218SUSECONFIRMMISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status. 2019-11-06 not yet calculated CVE-2019-16401MISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. 2019-11-06 not yet calculated CVE-2019-16400MISC shibboleth -- shibboleth_service_provider The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default. 2019-11-07 not yet calculated CVE-2010-2450MISCMISCCONFIRM simplesamlphp -- simplesamlphp Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. 2019-11-07 not yet calculated CVE-2019-3465MISCMLISTBUGTRAQMISCDEBIAN simplesamlphp -- simplesamlphp simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. 2019-11-06 not yet calculated CVE-2011-4625MISCMISC strapi -- strapi strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. 2019-11-07 not yet calculated CVE-2019-18818MISCMISCMISC syscp -- syscp syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot. 2019-11-07 not yet calculated CVE-2010-2476MISCMISCMLIST tahoe-lafs -- tahoe-lafs Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. 2019-11-07 not yet calculated CVE-2012-0051MISCMISCMISCMISCMISCCONFIRM termpkg -- termpkg termpkg 3.3 suffers from buffer overflow. 2019-11-06 not yet calculated CVE-2006-3100MISCMISC tmaxsoft -- jeus JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file. 2019-11-08 not yet calculated CVE-2019-17327MISC veritas -- multiple_products An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. 2019-11-05 not yet calculated CVE-2019-18780MISCMISCMISCMISC viber -- viber Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 16 bytes of udid in a binary format, which is located at approximately offset 0x40 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS. 2019-11-06 not yet calculated CVE-2019-18800MISC wolfssl -- wolfssl In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free. 2019-11-09 not yet calculated CVE-2019-18840MISC wordpress -- wordpress A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. 2019-11-08 not yet calculated CVE-2019-17661MISC zte -- mf910s_router Security researcher Shen Ying from the Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. 2019-11-07 not yet calculated CVE-2019-3422CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations. 2019-11-08 not yet calculated CVE-2019-3426CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts. 2019-11-08 not yet calculated CVE-2019-3425CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Study: Ransomware, Data Breaches at Hospitals tied to Uptick...
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security -- or the lack thereof -- may be impacting patient outcomes.

Read more »

Researchers use lasers to hack Siri, Alexa, Google assistant...
Researchers have used programmable low-powered lasers to remotely control voice-activated personal assistants like Apple's Siri, Amazon's Alexa, and Google Assistant from up to 360 feet away. These attacks exploit a vulnerability in microphones using micro-electro-mechanical systems (MEMS), which the researchers have discovered will respond to lasers the same way they will respond to sound. The […]

Read more »

Apple updates its privacy page with sleek new look
A company’s privacy page usually reads like it was written by lawyers—because it usually is. Information is rarely presented in a way that laypeople can understand, and as for making it both easy to consume and easy on the eyes? Forget it. Apple’s new privacy page thinks different. It presents the company’s privacy info in plain […]

Read more »

iPad vs. MacBook: is iPadOS a game changer?
It took Apple more than nine years to recognize that the iPhone and iPad were different enough to warrant separate operating systems: iOS 13 and iPadOS 13. Now, with the changes in the new iPadOS, an iPad could replace a laptop for many people. iPadOS may really be a game changer for mobile computing. But just how effectively can an iPad replace a MacBook?

Read more »

Details of Sprint’s Pre Black Friday Apple iPhone, iPad, a...
Sprint has several iPhone, iPad, and Apple Watch deals ongoing as part of their Pre Black Friday 2019 sale: (1) Sprint has the new 64GB iPhone 11 available for $15 per month for new lines. That’s about 50% off their standard monthly lease of $29.17. Offer is valid until November 24, 2019. The fine print: “Lease the new iPhone 11 for just $15/month: iPhone 11 64GB $15/mo. after $14.17/mo. credit, applied within 2 bills. Reqs. new line and 18-mo. lease with approved credit. If you cancel early, remaining balance due.” (2) Sprint is offering a 50% discount on any Apple Watch, including Apple Watch Series 5 models, with a 24 month lease and new watch plan. Here is the fine print: “Take 50% off any Apple Watch — including Series 5: 50% off via monthly credits, applied within 2 bills. Reqs. 24-month Installment Billing agreement, new watch plan activation, and 1 active handset on account. Early termination results in remaining balance due. Taxes due at sale. Excludes 44mm Stainless with Milanese loop band.” (3) Sprint has the 2018 Apple 64GB iPhone Xr available for $10 per month for 18 months for new lines of service. That’s about 50% off the typical monthly rate for this 2018 phone. The fine print: “iPhone XR 64GB $10/mo. after $15/mo. credit, applied within 2 bills. Reqs. new line and 18-mo. lease with approved credit. If you cancel early, remaining balance due.” (4) Sprint has the new 2019 7th Generation 32GB WiFi + Cellular iPad available starting at only $99.99 through January 9, 2020. Their price is a $360 savings over Apple’s standard MSRP. Here is the fine print: “iPad 7th Gen 32GB $4.17/mo. after $15/mo. credit, applied within 2 bills. Reqs. 24-mo. installment billing agreement, new line on qualifying plan, and 1 active handset on account. If you cancel early, remaining balance due. Taxes due at sale.” These deals are all live at → Read More...

Read more »

Clearance 13″ 1.8GHz MacBook Airs available for only $799
Amazon has the 2017 13″ 1.8GHz/128GB MacBook Air on sale today for only $799 shipped. That’s $250 off Apple’s original MSRP for this model. Focus Camera has this model on sale for $799 as well. Shipping is free, and Focus charges sales tax for NY & NJ residents only. Their prices are the cheapest available for a new MacBook from any Apple reseller. Keep an eye on our MacBook Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

Early Black Friday sale: 13″ 2.4GHz/256GB Space Gray MacBo...
Apple resellers B&H Photo and Amazon are offering the 2019 13″ 2.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro for $1579 today as part of their early 2019 Black Friday sales. That’s $220 off Apple’s MSRP. Their prices are the cheapest available for this model from any Apple reseller. This is the same MacBook Pro sold by Apple in its retail and online stores: B&H Photo: – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Space Gray: $1579 $220 off MSRP Amazon: – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Space Gray: $1579 $220 off MSRP Be sure to select Amazon as the seller rather than a third-party. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

iPhone XS Max Smart Battery Cases for only $59, save $70 (55...
Walmart has Apple iPhone XS Max Smart Battery Cases on sale for $59, in Black or White colors, as part of their early 2019 Black Friday sale. Their price is $70 (55%) off Apple’s MSRP for these cases. Choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store prices → Read More...

Read more »

AT&T Black Friday 2019 deal: Free Apple iPhone XR with n...
AT&T Wireless will include a free 64GB iPhone XR for new or existing customers opening a new line of service, no trade-in required. Offer is valid from 11/22/19 to 12/5/19: The fine print: Get the amazing iPhone XR for $0 “Ends 12/5/19. Req’s new line, $600 on 0% APR 30-mo. agmt & well-qual. credit. $0 after credits over 30 months. If svc cancelled, credits stop & device balance due. $30 Activation and other terms apply. When you buy on a qualifying installment plan with elig. unlimited wireless (min. $75/mo. before discount).” This deal is live today at → Read More...

Read more »

Apple’s new AirPods Pro are in stock at Amazon and on sale...
Amazon has Apple’s new AirPods Pro on sale and in stock today for $234.98 shipped. Their price is about $15 (6%) off Apple’s MSRP and the cheapest price available for these new models from any Apple reseller. Shipping is free. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Is Thick The New Thin In Apple Product Design With Jony Ive ...
FEATURE: 11.22.19- Every Apple user and aficionado knows that the form over function factor in the majority of products designed in California by the tech giant during the past two decades has been on the svelte side of the spectrum but with the man formerly in charge of design at the company since having exited stage right (so to speak), has there been a 360 degree turnaround with thick becoming the new thin in the outward appearance of its hardware and devices? Todd Haselton, technology products editor at CNBC, the financial business oriented news cable channel of NBC News, apparently seems to think so. Apple’s new flagship notebook computer, the 16-inch MacBook Pro, is 2% larger, weighs 0.3lbs heavier, and measures 1mm thicker than the 15-inch model that it replaces according to CNBC technology products editor Todd Haselton.. (Photo: Courtesy of Apple) In an article published on November 13 — the same day last week that the new 16-inch MacBook Pro was announced in Cupertino, California — Haselton opines that Apple has started to make its products thicker in an effort to give people what they want: functionality over form. The technology products editor feels that this is a good thing and gives two recent examples of releases from Apple, first, the 2019 iPhone lineup — the iPhone 11, 11 Pro, and 11 Pro Max (unveiled at a September media event at Apple Park) — and, second, the aforementioned new 16-inch MacBook Pro. **AD: In the market for a brand new 16-inch MacBook Pro? Look no further than MacPrices for the best deals and lowest prices on Apple’s flagship model by heading over to the price tracker for the latest notebook computer offered by the Cupertino, California-based company! “This is a theory,” writes Haselton. “But it seems this may be that there are some design changes being made after the departure of Apple’s former chief design officer Jony Ive. Ive was known for creating gorgeous products but, → Read More...

Read more »

B&H offers $100 discounts on 4-Core and 6-Core Mac minis...
B&H Photo has new 4-Core and 6-Core Mac minis in stock and on sale today for $100 off Apple’s MSRP. Prices start at $699. Overnight shipping is free to many addresses in the US: – 3.6GHz Quad-Core mini: $699 $100 off MSRP – 3.0GHz 6-Core mini: $999 $100 off MSRP Their price are the cheapest available for Mac minis from any Apple reseller. These are the same minis sold by Apple in their retail and online stores. Keep an eye on our Mac mini Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Save $200 today on a 2019 13″ MacBook Air with these Certi...
Apple has a full line of Certified Refurbished 2019 13″ MacBook Airs available starting at only $929 and up to $200 off the cost of new Airs. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $929 $170 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $929 $170 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $929 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1099 $200 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1099 $200 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1099 $200 off MSRP Apple’s refurbished prices are the lowest available for 2019 13″ MacBook Airs anywhere. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

New Verizon Pre-Black Friday 2019 deal: Buy one Apple iPhone...
Buy one new Apple iPhone 11 model or 2018 iPhone XS model at Verizon and get a second one for free. One new line of service required. Offer is valid from November 21, 2019 to November 27, 2019. Here are the details of Verizon’s Pre-Black Friday 2019 iPhone sale: – Buy the latest iPhone, get $700 off a second one. – Add two iPhone XS, iPhone XS Max, iPhone 11, iPhone 11 Pro or iPhone 11 Pro Max smartphones with monthly device payments to your cart. – Add one of these phones as a new smartphone line to your account on any Unlimited plan. – Get $700 credited to your account over 24 months. The fine print: “Up to $1449.99 device payment purchase per phone w/ 1 new smartphone line req’d. 2nd phone: Less $700 promo credit applied over 24 mos; promo credit ends if eligibility req’s are no longer met; 0% APR.” This deal is live on Verizon’s → Read More...

Read more »

AirPods with Wireless Charging Case on sale today for $163 s...
Abt Electronics has 2019 AirPods with the Wireless Charging Case on sale today for $163 shipped. Their price is $36 off Apple’s MSRP, and it’s currently the cheapest price for these AirPods from any Apple reseller. For AirPod price & sales from 24+ Apple resellers, see our AirPods Price Tracker, → Read More...

Read more »

Apple continues to offer 2017 13″ Dual-Core non-Touch Bar ...
Apple has Certified Refurbished 2017 13″ 2.3GHz Dual-Core non-Touch Bar MacBook Pros still available starting at $1019. An standard Apple one-year warranty is included with each model, outer cases are new, and shipping is free: – 13″ 2.3GHz/128GB Space Gray MacBook Pro (MPXQ2LL/A): $1019 original MSRP $1299 – 13″ 2.3GHz/256GB Space Gray MacBook Pro (MPXT2LL/A): $1189 original MSRP $1499 – 13″ 2.3GHz/128GB Silver MacBook Pro (MPXR2LL/A): $1019 original MSRP $1299 – 13″ 2.3GHz/256GB Silver MacBook Pro (MPXU2LL/A): $1189 original MSRP $1499 Their prices represent the cheapest 13″ MacBook Pros for sale at Apple. Keep an eye on our 13″ MacBook Pro Price Tracker for the latest prices → Read More...

Read more »