Hands-on: 85+ new macOS Big Sur changes and features [Video]
After going in depth with iOS 14 earlier this week, today we focus on macOS Big Sur. The biggest takeaway from my hands-on time with the follow up to macOS Catalina is that Apple’s latest OS is clearly being designed with the future in mind. Although it’s unmistakably Mac, Big Sur is a departure from previous versions of macOS in terms of aesthetics. Everything, from the dock, to the menu bar, to window chrome, icons, and even sounds have been updated. Watch our hands-on video walkthrough as we discuss over 85 macOS Big Sur changes and features, and be sure to subscribe to 9to5mac on YouTube for more videos. more… The post appeared first on 9to5Mac.

Read more »

Adorama 4th of July Sale: Up to 65% off MacBook Pro/Air, iPa...
The Adorama 4th of July sale is now in full swing. This year’s event features a range of notable discounts including MacBook Pro and MacBook Air configurations, along with a substantial collection of price drops in the smart home and entertainment categories. A series of Mirrorless and DLSR cameras, lenses, drones, headphones, and more are also joining in the celebration this weekend with as much as 65% in savings. Head below for a closer look. more… The post Adorama 4th of July Sale: Up to 65% off MacBook Pro/Air, iPad, accessories, more appeared first on 9to5Mac.

Read more »

Visualizing the size of Amazon, the world’s most valuable ...
Amazon is a remarkable success story that may destroy retail commerce through market dominance.∞ Read this on The Loop

Read more »

How “Have I Been Pwned” became the keeper of the interne...
I've used the site for years but always with a sense of dread.∞ Read this on The Loop

Read more »

Reddit app update incoming after triggering iOS 14 clipboard...
Reddit has become the latest high-profile service to confirm it will be updating its iOS app to stop copying data from the clipboard, following complaints of it repeatedly triggering iOS 14's new privacy-focused clipboard monitoring system.Reddit logo on a clipboardApple's clipboard snooping feature included in iOS 14 alerts users to instances when third-party apps attempt to access the clipboard on an iPhone or iPad. The triggering of alerts by apps used in the current developer betas has led to companies scrambling to make changes to stop the alert from popping up at times when users aren't consciously expecting the clipboard to be accessed.Read more...

Read more »

AirPods vs AirPods Pro: Apple’s earbuds go head-to-head
If you're trying to decide between the two, Engst can help.∞ Read this on The Loop

Read more »

iOS 14: iCloud Keychain now alerts users about leaked passwo...
In addition to the redesigned Home screen with widgets, App Library, and features like Car Key, iOS 14 and iPadOS 14 brings important enhancements to iCloud Keychain. Apple has made improvements to give users access to more helpful information about their passwords. Read on for a hands-on look at what’s changed on iCloud Keychain with iOS 14. more… The post iOS 14: iCloud Keychain now alerts users about leaked passwords, more appeared first on 9to5Mac.

Read more »

Podcast of the Week: Missing in Alaska
One of the aspects of Apple Podcasts that I really think is better than any other podcast app is the Browse section. I look at it on a weekly basis to see what’s new, trending, etc. I was recently looking at the top podcast list and came across Missing in Alaska. more… The post appeared first on 9to5Mac.

Read more »

Inside an indie dev’s ‘overnight success’ [Cult of Mac...
David William Hearn, co-creator of revolutionary iPad music notation app StaffPad, reveals the decade-long quest that earned the app an Apple Design Award. You’ll find that story, plus the usual roundup of iPhone and Mac news and rumors, in this week’s free issue of Cult of Mac Magazine. It’s packed with Apple how-tos and reviews, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple @ Work: What’s the impact of changing default apps o...
WWDC 2020 has come and gone, and while there is a lot to unpack for the consumer side, there is a considerable amount to unpack on the enterprise side as well. One of my favorite slides of the entire keynote is where they show the grab bag features that didn’t make air time but are often very important. This year, one of the key things I noticed for enterprise and K–12 customers was the ability to set default email and browsers on iPad and iPhone. What does this mean for enterprise and K–12 customers as they look ahead to iOS 14? more… The post Apple @ Work: What’s the impact of changing default apps on iOS for enterprise customers? appeared first on 9to5Mac.

Read more »

Today in Apple history: Steve Jobs visits the Soviet Union
July 4, 1985: Steve Jobs visits Moscow for the first time, with the aim of selling Macs to the Russians. During his two-day trip, Jobs lectures computer science students in the Soviet Union, attends a Fourth of July party at the American embassy and discusses opening a Mac factory in Russia. He also reportedly almost runs afoul […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

A setup journey of epic magnitude starts with a single step ...
It took web designer Carlos Azaustre a span of three years to piece together his setup. Everything was carefully chosen. To start off, the Madrid based front-end engineer has the Samsung 34-inch UltraWide Monitor. He previously had a 24-inch FullHD Monitor but after a few years of wear-and-tear he decided it was time to make […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iOS 14 exposes LinkedIn app reading users’ clipboards in b...
We recently covered that TikTok was caught reading users’ clipboards on iPhone and iPad thanks to the new privacy features of iOS 14. This week, iOS 14 users also noticed that the LinkedIn app is copying and pasting from the clipboard in the background for no apparent reason, which raised some concerns. more… The post iOS 14 exposes LinkedIn app reading users’ clipboards in background, company says it’s a bug appeared first on 9to5Mac.

Read more »

Apple files to halt future patent lawsuits from Zipit Wirele...
Apple is seeking a declaratory judgement to determine that it does not infringe on two instant messaging patents owned by a company named Zipit Wireless, which previously leveled claims against the tech giant.Credit: AppleIn a complaint filed Friday with the U.S. District Court for the Northern District of California, Apple argues that it does not infringe on Zipit's intellectual property. Zipit Wireless is the creator of a secure messaging platform.Read more...

Read more »

Hands-on: Everything you can do with the new iPhone App Libr...
A major new change that comes with iOS 14 alongside home screen widgets is the iPhone App Library. The feature offers a new way to manage the many apps you’ve got with auto-generated categories, a new alphabetical view, the ability to hide app pages, and more. Read on for a hands-on look at how to use the new iPhone App Library in iOS 14. more… The post Hands-on: Everything you can do with the new iPhone App Library in iOS 14 appeared first on 9to5Mac.

Read more »

LinkedIn blames bug for clipboard snooping discovered by iOS...
LinkedIn claims that clipboard snooping behavior, recently revealed in the firm's iOS app by a new iOS 14 data privacy feature, is caused by a software bug.Credit: LinkedInOn Thursday, a portfolio portal developer testing Apple's iOS 14 beta release discovered that the LinkedIn app was copying the contents of their clipboard after every keystroke. When ZDNet reached out to LinkedIn, the company said the issue was tied to a bug in its software.Read more...

Read more »

Apple survey is latest hint that iPhone 12 might not come wi...
Adding weight to recent reports that the iPhone 12 will ship without a charger in the box, Apple supposedly sent a survey to someone who recently traded in a handset to ask if he’s still using the wall charger. The responses from him and others could help the company decide whether it should leave out […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Assign tasks to others with Reminders in iOS 14 [Pro tip]
Ready to start delegating some of your responsibilities to someone else? It’s easier than ever with Reminders in iOS 14 and iPadOS 14, which gives you the ability to assign tasks to other people. Find out how in this pro tip. The ability to assign tasks to others is key for those working on shared […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple Launches an Apple Card Web Portal
Apple has at last launched a Web portal for the Apple Card so you no longer need to rely on your iPhone to check your balance or pay your bill. But it doesn’t provide all the capabilities available in the Wallet app.

Read more »

Firefox 78
The last major release of the Web browser that will run in macOS 10.9 Mavericks, 10.10 Yosemite, and 10.11 El Capitan. (Free, 71.0 MB)

Read more »

Firefox 78
The last major release of the Web browser that will run in macOS 10.9 Mavericks, 10.10 Yosemite, and 10.11 El Capitan. (Free, 71.0 MB)

Read more »

Tested: elago’s latest AirPods Pro cases re-create iconic ...
Editor’s note: Tested with 9to5Toys is a new series focused on everyday accessories and essentials to take your setup to the next level, starting with the new Anker PowerExpand Elite Dock. Have a product you’d like to see us review? Sound off in the comment section below!   elago has been cranking out fun Apple accessories for a while now. In recent years, the brand has turned its attention to unique add-ons for your iPhone, iPad, and AirPods. Almost all of them are made from a soft and flexible plastic, which allow for each product to easily slide in and out when needed. Not to mention, the material won’t scratch up your beloved tech either. On the latest episode of Tested with 9to5Toys, we’re taking a close up look at elago’s newest AirPods Pro case. In recent months, elago has introduced a range of new products for Apple’s high-end AirPods, and now we’re going to see what all the fuss is about. more… The post Tested: elago’s latest AirPods Pro cases re-create iconic designs appeared first on 9to5Mac.

Read more »

Celebrate Independence Day with these iTunes movies and TV s...
It is Independence Day weekend in the United States, so Apple is holding a special iTunes sale for movies and TV shows. Celebrate your American patriotism with these deals.iTunes Movie DealsThis Week's DealsRead more...

Read more »

New features that absolutely should be in iPadOS 15 [Opinion...
Apple unveiled iPadOS 14 last week but it’s thin on exciting new features for tablet users. Fortunately, Apple’s developers are surely already thinking about iPadOS 15. Here are some suggestions to get them started. The capabilities of this hugely popular tablet have grown tremendously in recent years. Some of my recommendations significantly further that progress. […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

AirPods Versus AirPods Pro: Apple’s Earbuds Go Head-to-Hea...
Through a series of circumstances, Adam Engst ended up with both a pair of AirPods and a pair of AirPods Pro. When free to choose one or the other at any time, which did he pick? The answer—and what he recommends—might surprise you.

Read more »

Apple wants your iPhone to replace your passport and driver�...
I'm sure that kind of world is coming fairly soon and maybe I'm just a curmudgeon but there is no way I would do this. I've lost/forgotten my phone too many times to allow something as important as my passport to reside on it. Now, if it means I'd have my passport or driver's license handy but use the iPhone for ease of use, then I can see that. But I would never let it replace (as in, leave at home) those things. Hell, I still carry around credit cards for those still all-too-frequent times when I can't use my iPhone.∞ Read this on The Loop

Read more »

How to downgrade to iOS 13 after installing the iOS 14 beta
If you caved and installed the iOS 14 or iPadOS 14 betas on your iPhone and iPad, and now you’re running into problems, you’ll be pleased to know you can downgrade to iOS 13. It’s a relatively simple process that shouldn’t take you long, and as long as you’ve backed up, you won’t lose too […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple surveying users about iPhone AC adapters amid rumors t...
Apple is surveying users in Brazil about the USB Power Adapters that came packaged in their iPhones, likely for market research concerning the ubiquitous iPhone accessory.Apple is surveying users about its 5W USB adapter amid rumors that it'll stop including it with iPhones.Specifically, the survey appears to ask users what they did with the USB adapter that came with their old iPhones. It comes iPhone 12" in 2020.Read more...

Read more »

Bag AirPods Pro at a brand-new low of just $202
Now is the time to treat yourself to AirPods Pro! Amazon is offering renewed models that look and work as good as new for just $202 — the lowest price we’ve seen so far on Apple’s best wireless buds. Bag yours before they’re all gone. AirPods Pro take everything that makes AirPods so magical and combines […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Save $50 on the new Apple iPad Mini
If you are looking for an Amazon deal for iPad Mini, then you are lucky. Now if you buy the iPad Mini Wi-Fi-only model with 256GB storage in Silver is available at a $50 discount. The original price of this model of the iPad Mini is $549, when you buy it on Amazon you will only pay $499. Apple iPad The post appeared first on iLounge.

Read more »

E-Verify’s “SSN Lock” is Nothing of the Sort
One of the most-read advice columns on this site is a 2018 piece called "Plant Your Flag, Mark Your Territory," which tried to impress upon readers the importance of creating accounts at websites like those at the Social Security Administration, the IRS and others before crooks do it for you. A key concept here is that these services only allow one account per Social Security number -- which for better or worse is the de facto national identifier in the United States. But KrebsOnSecurity recently discovered that this is not the case with all federal government sites built to help you manage your identity online. A reader who was recently the victim of unemployment insurance fraud said he was told he should create an account at the Department of Homeland Security's myE-Verify website, and place a lock on his Social Security number (SSN) to minimize the chances that ID thieves might abuse his identity for employment fraud in the future.

Read more »

New Mac Ransomware-wiper-spyware ThiefQuest discovered – I...
New malware targeting the Mac was discovered this week; it's a hybrid ransomware-wiper-spyware, but you don't need to worry if you don't download pirated software. We also discuss how a journalist's iPhone was hacked by him visiting a website, look at issues with the TikTok app on iOS, and look at how Google is now auto-deleting new user history after 18 months.

Read more »

Google to Auto-Delete User History After 18 Months
Google has announced that the company will now automatically delete user's history after 18 months, but you can tweak this setting, opting to have it deleted after three months, or never.

Read more »

New Mac ransomware-spyware ThiefQuest in the wild
On Monday, June 29, Intego began investigating new Mac malware spreading in the wild via BitTorrent. Although it has telltale signs of ransomware, the ThiefQuest malware turns out to be much more nefarious and complex.

Read more »

Ransomware Gangs Don’t Need PR Help
We've seen an ugly trend recently of tech news stories and cybersecurity firms trumpeting claims of ransomware attacks on companies large and small, apparently based on little more than the say-so of the ransomware gangs themselves. Such coverage is potentially quite harmful and plays deftly into the hands of organized crime. Often the rationale behind couching these events as newsworthy is that the attacks involve publicly traded companies or recognizable brands, and that investors and the public have a right to know. But absent any additional information from the victim company or their partners who may be affected by the attack, these kinds of stories and blog posts look a great deal like ambulance chasing and sensationalism.

Read more »

Intego interviewed about home-centric shift in cybersecurity
In a recent interview, Josh Long explains how Intego meets the needs of work-at-home and learn-at-home users, and how cybersecurity is evolving due to the pandemic.

Read more »

COVID-19 ‘Breach Bubble’ Waiting to Pop?
The COVID-19 pandemic has made it harder for banks to trace the source of payment card data stolen from smaller, hacked online merchants. On the plus side, months of quarantine have massively decreased demand for account information that thieves buy and use to create physical counterfeit credit cards. But fraud experts say recent developments suggest both trends are about to change -- and likely for the worse.

Read more »

Vulnerability Summary for the Week of June 22, 2020
Original release date: June 29, 2020  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- shiro   Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. 2020-06-22 7.5 CVE-2020-11989MISC conjur -- oss_helm_chart   In Conjur OSS Helm Chart before 2.0.0, a recently identified critical vulnerability resulted in the installation of the Conjur Postgres database with an open port. This allows an attacker to gain full read & write access to the Conjur Postgres database, including escalating the attacker's privileges to assume full control. A malicious actor who knows the IP address and port number of the Postgres database and has access into the Kubernetes cluster where Conjur runs can gain full read & write access to the Postgres database. This enables the attacker to write a policy that allows full access to retrieve any secret. This Helm chart is a method to install Conjur OSS into a Kubernetes environment. Hence, the systems impacted are only Conjur OSS systems that were deployed using this chart. Other deployments including Docker and the CyberArk Dynamic Access Provider (DAP) are not affected. To remediate this vulnerability, clone the latest Helm Chart and follow the upgrade instructions. If you are not able to fully remediate this vulnerability immediately, you can mitigate some of the risk by making sure Conjur OSS is deployed on an isolated Kubernetes cluster or namespace. The term "isolated" refers to: - No other workloads besides Conjur OSS and its backend database are running in that Kubernetes cluster/namespace. - Kubernetes and helm access to the cluster/namespace is limited to security administrators via Role-Based Access Control (RBAC). 2020-06-22 7.7 CVE-2020-4062MISCCONFIRM dmitry -- deepmagic_information_gathering_tool   A stack-based buffer overflow in DMitry (Deepmagic Information Gathering Tool) 1.3a might allow remote WHOIS servers to execute arbitrary code via a long line in a response that is mishandled by nic_format_buff. 2020-06-19 7.5 CVE-2020-14931MISC gitlab -- gitlab_community_and_enterprise_editions   A Denial of Service vulnerability allowed exhausting the system resources in GitLab CE/EE 12.0 and later through 13.0.1 2020-06-19 7.8 CVE-2020-13273CONFIRMMISC mattermost -- mattermost_desktop_app   An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection. 2020-06-19 7.5 CVE-2016-11064CONFIRM mattermost -- mattermost_desktop_app   An issue was discovered in Mattermost Desktop App before 4.4.0. The Same Origin Policy is mishandled during access-control decisions for web APIs, aka MMSA-2020-0006. 2020-06-19 7.5 CVE-2020-14456CONFIRM mattermost -- mattermost_desktop_app   An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. 2020-06-19 7.5 CVE-2019-20856CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access. 2020-06-19 7.5 CVE-2017-18915CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy. 2020-06-19 7.5 CVE-2017-18920CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.2 and 5.1.1. Authorization could be bypassed if the channel name were not the same in the params and the body. 2020-06-19 7.5 CVE-2018-21251CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address. 2020-06-19 7.5 CVE-2017-18908CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file. 2020-06-19 7.5 CVE-2017-18912CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows attackers to gain privileges by accessing unintended API endpoints on a user's behalf. 2020-06-19 7.5 CVE-2017-18885CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows SQL injection during the fetching of multiple posts. 2020-06-19 7.5 CVE-2017-18888CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report. 2020-06-19 7.5 CVE-2017-18900CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. A password-reset link could be reused. 2020-06-19 7.5 CVE-2016-11074CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.8.0. It mishandles brute-force attacks against MFA. 2020-06-19 7.5 CVE-2019-20881CONFIRM mergeobjects -- mergeobjects   The mergeObjects utility function is susceptible to Prototype Pollution. 2020-06-19 7.5 CVE-2020-7679MISCMISCMISC qualcomm -- multiple_snapdragon_products   Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack of validation checks in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 7.5 CVE-2020-3661CONFIRMMISC qualcomm -- multiple_snapdragon_products   While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8096AU, MDM9607, MSM8909W, MSM8996, MSM8996AU, QCN7605, QCS605, SC8180X, SDA845, SDX20, SDX24, SDX55, SM8150, SXR1130 2020-06-22 7.2 CVE-2019-14047CONFIRMMISC qualcomm -- multiple_snapdragon_products   kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ6018, IPQ8074, MSM8996, MSM8996AU, Nicobar, QCS605, Rennell, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 7.2 CVE-2019-10597CONFIRM qualcomm -- multiple_snapdragon_products   Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 7.5 CVE-2020-3663CONFIRMMISC qualcomm -- multiple_snapdragon_products   Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-22 7.5 CVE-2020-3662CONFIRMMISC qualcomm -- multiple_snapdragon_products   Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-06-22 7.5 CVE-2020-3660CONFIRMMISC qualcomm -- multiple_snapdragon_products   Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, IPQ6018, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6574AU, QCA6584AU, QCA9377, QCA9379, QCA9886, QCM2150, QCS405, QCS605, QM215, Rennell, SC7180, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130 2020-06-22 7.5 CVE-2020-3614CONFIRMMISC qualcomm -- multiple_snapdragon_products   Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130 2020-06-22 10 CVE-2019-14062CONFIRMMISC qualcomm -- multiple_snapdragon_products   Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow when processing large data or non-standard feedback messages in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8076, APQ8096, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130 2020-06-22 7.5 CVE-2019-14073CONFIRMMISC qualcomm -- multiple_snapdragon_products   Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, Kamorta, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, Nicobar, QCM2150, QCS605, QM215, Rennell, SA415M, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, SXR1130 2020-06-22 7.5 CVE-2019-14080CONFIRMMISC qualcomm -- multiple_snapdragon_products   Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in SM8150 2020-06-22 7.2 CVE-2020-3613CONFIRMMISC qualcomm -- snapdragon_consumer_iot   Improper access due to socket opened by the logging application without specifying localhost address in Snapdragon Consumer IOT, Snapdragon Mobile in APQ8053, Rennell, SDX20 2020-06-22 10 CVE-2020-3628CONFIRMMISC rtslib-fb -- rtslib-fb   Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved. 2020-06-19 7.5 CVE-2020-14019MISC ruby_on_rails -- ruby_on_rails   A deserialization of untrusted data vulnernerability exists in rails < 5.2.5, rails < 6.0.4 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE. 2020-06-19 7.5 CVE-2020-8165MISCMISCMLIST sourcecodester -- pisay_online_e-learning_system   Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email, user_pass, and id parameters on the admin login-portal and the edit-lessons webpages. 2020-06-22 7.5 CVE-2020-14972MISCMISC squirrelmail -- squirrelmail   compose.php in SquirrelMail 1.4.22 calls unserialize for the $attachments value, which originates from an HTTP POST request. 2020-06-20 7.5 CVE-2020-14933MISC squirrelmail -- squirrelmail   compose.php in SquirrelMail 1.4.22 calls unserialize for the $mailtodata value, which originates from an HTTP GET request. This is related to mailto.php. 2020-06-20 7.5 CVE-2020-14932MISC tendenci -- tendenci   Tendenci 12.0.10 allows unrestricted deserialization in appshelpdeskviewsstaff.py. 2020-06-21 7.5 CVE-2020-14942MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aapanel -- aapanel   aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or restart) to the setting menu of Sotfware Store. 2020-06-21 6.5 CVE-2020-14950MISC alpine -- alpine   Alpine before 2.23 silently proceeds to use an insecure connection after a /tls is sent in certain circumstances involving PREAUTH, which is a less secure behavior than the alternative of closing the connection and letting the user decide what they would like to do. 2020-06-19 5 CVE-2020-14929MISCMLIST apache -- archiva   Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects. 2020-06-19 5 CVE-2020-9495MISCMLISTMLISTMLISTMLISTMLIST bitdefender -- total_security_2020   Improper Input Validation vulnerability in the Safepay browser component of Bitdefender Total Security 2020 allows an external, specially crafted web page to run remote commands inside the Safepay Utility process. This issue affects Bitdefender Total Security 2020 versions prior to 24.0.20.116. 2020-06-22 6.8 CVE-2020-8102MISC bt_ctroms -- terminal_os_port_portal_ct-464   An issue was discovered in BT CTROMS Terminal OS Port Portal CT-464. Account takeover can occur because the password-reset feature discloses the verification token. Upon a getverificationcode.jsp request, this token is transmitted not only to the registered phone number of the user account, but is also transmitted to the unauthenticated HTTP client. 2020-06-19 4.3 CVE-2020-14930MISCMISC dolibarr -- dolibarr   A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey). 2020-06-19 4.3 CVE-2020-14475MISC ec-cube -- ec-cube   Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors. 2020-06-19 5.5 CVE-2020-5590MISCMISCMISC fortinet -- fortideceptor   An insufficient session expiration vulnerability in FortiDeceptor 3.0.0 and below allows an attacker to reuse the unexpired admin user session IDs to gain admin privileges, should the attacker be able to obtain that session ID via other, hypothetical attacks. 2020-06-22 6.8 CVE-2020-6644CONFIRM gitlab -- gitlab_community_and_enterprise_editions   User email verification bypass in GitLab CE/EE 12.5 and later through 13.0.1 allows user to bypass email verification 2020-06-19 5 CVE-2020-13265CONFIRMMISCMISC gitlab -- gitlab_community_and_enterprise_editions   Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link 2020-06-19 4.3 CVE-2020-13262CONFIRMMISCMISC gitlab -- gitlab_community_and_enterprise_editions   Kubernetes cluster token disclosure in GitLab CE/EE 10.3 and later through 13.0.1 allows other group maintainers to view Kubernetes cluster token 2020-06-19 5 CVE-2020-13264CONFIRMMISCMISC gitlab -- gitlab_community_and_enterprise_editions   User is allowed to set an email as a notification email even without verifying the new email in all previous GitLab CE/EE versions through 13.0.1 2020-06-19 4 CVE-2020-13276CONFIRMMISCMISC gitlab -- gitlab_community_and_enterprise_editions   An authorization issue in the mirroring logic allowed read access to private repositories in GitLab CE/EE 10.6 and later through 13.0.5 2020-06-19 4 CVE-2020-13277CONFIRMMISCMISC gitlab -- gitlab_community_and_enterprise_editions   OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow 2020-06-19 6.5 CVE-2020-13272CONFIRMMISCMISC gitlab -- gitlab_enterprise_edition   A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 2020-06-19 5.5 CVE-2020-13275CONFIRMMISCMISC gogs -- gogs   In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. 2020-06-21 4 CVE-2020-14958MISCMISC ibm -- security_secret_server   IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 177514. 2020-06-24 4.3 CVE-2020-4323XFCONFIRM ibm -- security_secret_server   IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 179988. 2020-06-24 4.3 CVE-2020-4413XFCONFIRM ibm -- security_secret_server   IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 177599. 2020-06-24 5 CVE-2020-4327XFCONFIRM ibm -- security_secret_server   IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178181. 2020-06-24 5 CVE-2020-4341XFCONFIRM ibm -- security_secret_server   IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182. 2020-06-24 5 CVE-2020-4342XFCONFIRM ibm -- security_secret_server   IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 177511. 2020-06-24 4.3 CVE-2020-4322XFCONFIRM information_builders -- webfocus_business_intelligence   In WebFOCUS Business Intelligence 8.0 (SP6), the administration portal allows remote attackers to read arbitrary local files or forge server-side HTTP requests via a crafted HTTP request to /ibi_apps/WFServlet.cfg because XML external entity injection is possible. This is related to making changes to the application repository configuration. 2020-06-22 5.8 CVE-2020-14204MISC information_builders -- webfocus_business_intelligence   WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters. 2020-06-22 4.3 CVE-2020-14202MISC information_builders -- webfocus_business_intelligence   WebFOCUS Business Intelligence 8.0 (SP6) allows a Cross-Site Request Forgery (CSRF) attack against administrative users within the /ibi_apps/WFServlet(.ibfs) endpoint. The impact may be creation of an administrative user. It can also be exploited in conjunction with CVE-2016-9044. 2020-06-22 6.8 CVE-2020-14203MISC mattermost -- mattermost_desktop_app   An issue was discovered in Mattermost Desktop App before 4.2.2. It allows attackers to execute arbitrary code via a crafted link. 2020-06-19 6.8 CVE-2019-20861CONFIRM mattermost -- mattermost_desktop_app   An issue was discovered in Mattermost Desktop App before 4.4.0. Prompting for HTTP Basic Authentication is mishandled, allowing phishing, aka MMSA-2020-0007. 2020-06-19 4.3 CVE-2020-14455CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname. 2020-06-19 4 CVE-2017-18918CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled. 2020-06-19 6.4 CVE-2016-11072CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 5.13.0. Non-members may fetch a team's slash commands. 2020-06-19 5 CVE-2019-20862CONFIRM mattermost -- mattermost_server An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via a goto_location response to a slash command. 2020-06-19 4.3 CVE-2017-18881CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 2.2.0. It allows XSS via a crafted link. 2020-06-19 4.3 CVE-2016-11082CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window. 2020-06-19 4.3 CVE-2016-11083CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a redirect URL. 2020-06-19 4.3 CVE-2016-11079CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS can occur via OpenGraph data. 2020-06-19 4.3 CVE-2017-18882CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It allows XSS via a Legal or Support setting. 2020-06-19 4.3 CVE-2016-11073CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not in place. 2020-06-19 4.3 CVE-2016-11071CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview. 2020-06-19 4.3 CVE-2016-11063CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during user activation/deactivation. 2020-06-19 4 CVE-2019-20873CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens. 2020-06-19 5 CVE-2017-18917CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the author_link field of a Slack attachment. 2020-06-19 4.3 CVE-2017-18879CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.10.0. An attacker can bypass the intended appearance of the Edited flag after changing a post's file ID. 2020-06-19 4 CVE-2019-20870CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 2.1.0. It allows XSS via CSRF. 2020-06-19 4.3 CVE-2016-11084CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the title_link field of a Slack attachment. 2020-06-19 4.3 CVE-2017-18880CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.8.1, 4.7.4, and 4.6.3. WebSocket events were accidentally sent during certain user-management operations, violating user privacy. 2020-06-19 4 CVE-2018-21260CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory. 2020-06-19 4.3 CVE-2017-18909CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized. 2020-06-19 4.3 CVE-2017-18892CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It potentially allows attackers to obtain sensitive information (credential fields within config.json) via the System Console UI. 2020-06-19 4 CVE-2016-11078CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.1, 5.0.2, and 4.10.2. An attacker could use the invite_people slash command to invite a non-permitted user. 2020-06-19 4 CVE-2018-21253CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links. 2020-06-19 4 CVE-2017-18910CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or change a post's appearance. 2020-06-19 4 CVE-2016-11065CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.8.0, 5.7.2, 5.6.5, and 4.10.7. Changes to e-mail addresses do not require credential re-entry. 2020-06-19 4 CVE-2019-20879CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.3.0. It mishandles timing. 2020-06-19 4.3 CVE-2018-21249CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.4.0. It mishandles possession of superfluous authentication credentials. 2020-06-19 5 CVE-2018-21248CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 2.2.0. It allows unintended access to information stored by a web browser. 2020-06-19 4 CVE-2016-11081CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It offers superfluous APIs for a Team Administrator to view account details. 2020-06-19 4 CVE-2016-11080CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It has a superfluous API in which the System Admin can change the account name and e-mail address of an LDAP account. 2020-06-19 4 CVE-2016-11077CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page. 2020-06-19 4.3 CVE-2017-18877CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.7.1, 5.6.4, 5.5.3, and 4.10.6. It does not honor flags API permissions when deciding whether a user can receive intra-team posts. 2020-06-19 4 CVE-2019-20887CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.7. It allows a bypass of e-mail address discovery restrictions. 2020-06-19 4 CVE-2019-20890CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API. 2020-06-19 4 CVE-2017-18889CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page. 2020-06-19 4.3 CVE-2017-18913CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Changes, within the application, to e-mail addresses are mishandled. 2020-06-19 4 CVE-2019-20878CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header. 2020-06-19 4.3 CVE-2017-18907CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file. 2020-06-19 4.3 CVE-2017-18904CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page. 2020-06-19 4.3 CVE-2017-18921CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.18.0, 5.17.2, 5.16.4, 5.15.4, and 5.9.7. CSRF can sometimes occur via a crafted web site for account takeover attacks. 2020-06-19 6.8 CVE-2019-20841CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled. 2020-06-19 5 CVE-2017-18905CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting. 2020-06-19 5 CVE-2017-18899CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.1. It allows attackers to cause a denial of service via the invite_people slash command. 2020-06-19 5 CVE-2018-21258CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. Display names allow XSS. 2020-06-19 4.3 CVE-2017-18893CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.11.0. An attacker can interfere with a channel's post loading via one crafted post. 2020-06-19 5 CVE-2019-20867CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction. 2020-06-19 5 CVE-2017-18916CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It allows attackers to obtain sensitive information about team URLs via an API. 2020-06-19 5 CVE-2016-11075CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints. 2020-06-19 5 CVE-2017-18902CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document. 2020-06-19 5 CVE-2017-18901CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change. 2020-06-19 5 CVE-2016-11069CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.7.0, 4.6.2, and 4.5.2. An attacker could authenticate to a different user's account via a crafted SAML response. 2020-06-19 6.5 CVE-2018-21263CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.7, 5.6.3, 5.5.2, and 4.10.5. It mishandles permissions for user-access token creation. 2020-06-19 5 CVE-2019-20889CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang. 2020-06-19 5 CVE-2017-18898CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.12.0, 5.11.1, 5.10.2, 5.9.2, and 4.10.10. The login page allows CSRF. 2020-06-19 6.8 CVE-2019-20865CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint. 2020-06-19 5 CVE-2017-18896CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.16.0. It allows attackers to cause a denial of service (markdown renderer hang) via many backtick characters. 2020-06-19 5 CVE-2019-20857CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint. 2020-06-19 5 CVE-2017-18895CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation. 2020-06-19 5 CVE-2017-18919CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name. 2020-06-19 5 CVE-2017-18871CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.18.0. An attacker can send a user_typing WebSocket event to any channel. 2020-06-19 5 CVE-2019-20847CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.17.0. It allows remote attackers to cause a denial of service (client-side application crash) via a LaTeX message. 2020-06-19 5 CVE-2019-20854CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.16.1, 5.15.2, 5.14.5, and 5.9.6. It allows attackers to obtain sensitive information (local files) during legacy attachment migration. 2020-06-19 5 CVE-2019-20855CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL. 2020-06-19 5 CVE-2016-11076CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.8.0. The first user is sometimes inadvertently a system admin. 2020-06-19 5 CVE-2019-20886CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server. 2020-06-19 6.4 CVE-2017-18911CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It discloses the team creator's e-mail address to members. 2020-06-19 5 CVE-2017-18887CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.11.0. Invite IDs were improperly generated. 2020-06-19 5 CVE-2019-20868CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows a password reset to proceed while an e-mail address is being changed. 2020-06-19 5 CVE-2019-20875CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.8.0. It does not honor the domain requirement when processing a join request for an open team. 2020-06-19 5 CVE-2019-20882CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection. 2020-06-19 5.8 CVE-2017-18897CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Desktop App before 4.4.0. Attackers can open web pages in the desktop application because server redirection is mishandled, aka MMSA-2020-0008. 2020-06-19 5.8 CVE-2020-14454CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. It allows attackers to obtain sensitive information during a role change. 2020-06-19 5 CVE-2019-20874CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover. 2020-06-19 5.5 CVE-2017-18894CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. Users can deactivate themselves, bypassing a policy. 2020-06-19 5.5 CVE-2019-20876CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled. 2020-06-19 5.1 CVE-2017-18903CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed. 2020-06-19 5 CVE-2016-11062CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 1.2.0. It allows attackers to cause a denial of service (memory consumption) via a small compressed file that has a large size when uncompressed. 2020-06-19 5 CVE-2015-9548CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information. 2020-06-19 5 CVE-2016-11066CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection. 2020-06-19 5 CVE-2016-11068CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.9.0, 5.8.1, 5.7.3, and 4.10.8. The Markdown library allows catastrophic backtracking. 2020-06-19 5 CVE-2019-20871CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist. 2020-06-19 5 CVE-2017-18914CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.13.0. Incoming webhook creation is not properly restricted. 2020-06-19 5 CVE-2019-20863CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.15.0. Login access control can be bypassed via crafted input. 2020-06-19 5 CVE-2019-20859CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 5.15.0. It allows attackers to cause a denial of service (CPU consumption) via crafted characters in a SQL LIKE clause to an APIv4 endpoint. 2020-06-19 5 CVE-2019-20858CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands. 2020-06-19 6.5 CVE-2017-18886CONFIRM mattermost -- mattermost_server   An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang. 2020-06-19 5 CVE-2016-11067CONFIRM mutt -- mutt_and_neomutt   Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data (e.g., from a man-in-the-middle attacker) and evaluates it in a TLS context, aka "response injection." 2020-06-21 4.3 CVE-2020-14954MISCMISCMISCMISCMISCMISCDEBIANDEBIAN octopus -- deploy   In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. 2020-06-19 4 CVE-2020-14470MISC php-fusion -- php-fusion   A SQL injection vulnerability in PHP-Fusion 9.03.50 affects the endpoint administration/comments.php via the ctype parameter, 2020-06-22 6.5 CVE-2020-14960MISCMISCMISC qualcomm -- multiple_snapdragon_products   Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, APQ8096AU, APQ8098, IPQ6018, IPQ8074, Kamorta, MDM9150, MDM9205, MDM9206, MDM9207C, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA8081, QCM2150, QCN7605, QCS404, QCS405, QCS605, QM215, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2019-14094CONFIRMMISC qualcomm -- multiple_snapdragon_products   Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCA6574AU, QCS405, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 6.4 CVE-2020-3658CONFIRMMISC qualcomm -- multiple_snapdragon_products   Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8998, Nicobar, QCS404, QCS405, QCS605, Rennell, SA415M, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2019-14076CONFIRMMISC qualcomm -- multiple_snapdragon_products   Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9607, QCS405, Rennell, Saipan, SC8180X, SDX55, SM8150, SM8250, SXR2130 2020-06-22 4.6 CVE-2019-14091CONFIRMMISC qualcomm -- multiple_snapdragon_products   Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8905, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2020-3626CONFIRMMISC qualcomm -- multiple_snapdragon_products   Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, Saipan, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2020-3635CONFIRMMISC qualcomm -- multiple_snapdragon_products   Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snapdragon Consumer IOT, Snapdragon Mobile in Kamorta, QCS605, Rennell, Saipan, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2020-3642CONFIRMMISC qualcomm -- multiple_snapdragon_products   A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being out of range in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996, MSM8996AU, QCA6174A, QCA9377, QCA9379, SDM439, SDM636, SDM660, SDX20, SDX24, SM8150 2020-06-22 4.6 CVE-2020-3665CONFIRMMISC qualcomm -- multiple_snapdragon_products   Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8096AU, APQ8098, Kamorta, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCM2150, QCS605, QM215, Rennell, Saipan, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-06-22 4.6 CVE-2020-3676CONFIRMMISC rack -- rack   A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix. 2020-06-19 5 CVE-2020-8184MISCMISC red_hat -- quay   A vulnerability was found in quay-2, where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name. 2020-06-22 4.3 CVE-2019-3865CONFIRM ruby_on_rails -- ruby_on_rails   A CSRF vulnerability exists in rails

Read more »

Russian Cybercrime Boss Burkov Gets 9 Years
A well-connected Russian hacker once described as “an asset of supreme importance” to Moscow was sentenced on Friday to nine years in a U.S. prison after pleading guilty to running a site that sold stolen payment card data, and to administering a highly secretive crime forum that counted among its members some of the most elite Russian cybercrooks.

Read more »

What’s Coming in macOS Big Sur and iOS 14 – Intego Mac P...
This week, Apple announced the new features for its coming operating system updates: macOS Big Sur, and iOS 14. They also announced a big change to Mac hardware. Josh and Kirk discuss the changes coming, and take a close look at security and privacy features in these operating systems.

Read more »

New Charges, Sentencing in Satori IoT Botnet Conspiracy
The U.S. Justice Department today criminally charged a Canadian and a Northern Ireland man for allegedly conspiring to build multiple botnets that enslaved hundreds of thousands of routers and other Internet of Things (IoT) devices for use in large-scale distributed denial-of-service (DDoS) attacks. In addition, a defendant in the United States was sentenced to drug treatment and 18 months community confinement for his admitted role in the conspiracy.

Read more »

July 4th Sale: Woot offers wide range of Macs for under $100...
Amazon-owned Woot is blowing out a wide range of Apple Macs and iPads for July 4th staring at $279 and ranging up to just over $1000. Models vary from older iPads and 11″ MacBook Airs to some newer iMacs and Retina MacBook Pros. Check out the available models here on Woot, and note that many Macs will sell out quickly at these prices. Sale → Read More...

Read more »

Apple Pro Display XDR with Nano-Texture Glass on sale today ...
Abt Electronics has Apple’s new 32″ Pro Display XDR model with the nano-texture glass in stock and on sale today for up to $144 off MSRP. Shipping is free: – Pro Display XDR (nano-texture glass): $5855.44 $144 off MSRP Keep an eye on our Apple Pro Display XDR Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

New 2020 Mac mini on sale for up to $100 off Apple’s MSRP
Amazon has Apple’s new 2020 Mac minis on sale today for $40-$100 off MSRP with prices starting at $759. Shipping is free: – 2020 4-Core Mac mini: $759 $40 off MSRP – 2020 6-Core Mac mini: $998.99 $100 off MSRP For the latest Mac mini sales and deals, see our Mac mini Price Tracker, → Read More...

Read more »

July 4th Sale: $100 off every 2020 13″ MacBook Air at thes...
Apple resellers have new 2020 13″ MacBook Airs on sale for $100 off Apple’s MSRP as part of their July 4th sales. Starting at $899, these are the cheapest new 2020 MacBooks for sale anywhere: (1) B&H Photo has Apple’s new 2020 13″ 4-Core and 6-Core MacBook Airs on sale today for $100 off Apple’s MSRP, starting at only $899. Expedited shipping is free to many addresses in the US. The MacBook Airs are the same models sold by Apple in their retail and online stores: – 13″ 4-Core Space Gray MacBook Air: $899.99 $100 off MSRP – 13″ 4-Core Silver MacBook Air: $899 $100 off MSRP – 13″ 4-Core Gold MacBook Air: $899 $100 off MSRP – 13″ 6-Core Space Gray MacBook Air: $1199 $100 off MSRP – 13″ 6-Core Silver MacBook Air: $1199 $100 off MSRP – 13″ 6-Core Gold MacBook Air: $1199 $100 off MSRP (2) Amazon has new 2020 13″ MacBook Airs in stock and on sale today for $100 off Apple’s MSRP as well, starting at $899. These are the same 13″ MacBook Airs sold by Apple in their retail and online stores: – 13″ 1.1GHz Dual-Core MacBook Air (Space Gray): $899.99 $100 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air (Silver): $899 $100 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air (Gold): $899 $100 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air (Space Gray): $1199 $100 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air (Silver): $1199 $100 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air (Gold): $1199 $100 off MSRP Amazon’s prices are highly dynamic, meaning they can change hourly. We list their lowest price of the day for each MacBook Air. If you see a higher price, check their site later or add a MacBook Air to your shopping cart and check later in the day to see if the price has dropped. Keep an eye on our 13″ MacBook Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

This hidden deal on Apple’s site can save you up to $25 on...
Are you a local, state, or federal government employee? If so, Apple offers special government pricing on their products, including AirPods, for you as well as immediate family members. Here’s how much you can save on Apple AirPods products: – AirPods Pro: $224, save $25 – AirPods with Wireless Charging Case: $179, save $20 – AirPods with Charging Case: $143, save $16 Federal government employee can shop here on Apple’s site. State and local government employees can shop here. Discounts are available on the rest of Apple’s products as well, ranging as high as $360 off MSRP for the new Mac → Read More...

Read more »

Apple Watch Series 3 models on sale for new low prices, star...
Amazon has Apple Watch Series 3 GPS models on sale for $30 off MSRP, starting at only $169. Their prices are the lowest available for these models from any Apple reseller. Choose Amazon as the seller rather than a third-party, and note that Amazon stock fluctuates, so be sure to check their site for the latest availability. Shipping is free: – 38mm Apple Watch Series 3 GPS: $169 $30 off MSRP – 42mm Apple Watch Series 3 GPS: $199 $30 off MSRP A limited supply remains available at these prices. Note that optional Apple Watch bands may be extra. For the latest prices from Apple and its resellers, see our Apple Watch → Read More...

Read more »

Deal Alert! Get these refurbished 2018 13″ MacBook Airs fo...
Apple has restocked and lowered prices on select Certified Refurbished 2018 13″ MacBook Airs, starting at only $679. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $679 original MSRP $1199 – 13″ 1.6GHz/128GB MacBook Air Silver: $679 original MSRP $1199 Note that we expect these models to sell out quickly–act now if you’re interested. These are the cheapest MacBooks for sale today at Apple. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

July 4th Sale: 13″ 2.0GHz MacBook Pros for $200 off Apple�...
B&H Photo has new 2020 13″ 2.0GHz MacBook Pros on sale for $200 off Apple’s MSRP as part of their July 4th sale. Prices start at $1599. These are the same MacBook Pros sold by Apple in their retail and online stores, and B&H’s prices are the lowest available for these models from any Apple reseller: – 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1599.99 $200 off MSRP – 13″ 2.0GHz/512GB MacBook Pro Silver: $1599 $200 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Silver: $1799 $200 off MSRP For the latest prices and sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

July 1 only: $100 off Apple iPhone 11, 11 Pro, and SE at Boo...
Boost Mobile is offering Apple iPhone 11, 11 Pro, and iPhone 11 Pro Max models for $100 off MSRP with service. Their discount reduces the cost of an iPhone 11/64GB to $599, iPhone 11 Pro to $899 for the 64GB model, and $999 for the 64GB iPhone 11 Pro Max. They have 2020 Apple iPhone SE models available for $100 off MSRP as well, with service. Their discount reduces the cost of an iPhone SE/64GB to $299, $349 for the 128GB model, and $449 for the 256GB iPhone SE. For July 1st only, use code FLASHJULY2020 to take an additional 10% off these phones. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the Sprint network, and they offer plans beginning at $50 per month for one line. No annual contract is required. Note that availability at Boost can vary — check their site for the latest stock status. For the latest Apple iPhone prices, see our iPhone Price Tracker, → Read More...

Read more »

Apple offers $50-$100 Education discount on iPad Pros, plus ...
Purchase a new 12.9″ or 11″ iPad Pro at Apple using your Education discount, and Apple will take $50-$100 off their MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. As part of their Back to School promotion for 2020, Apple will include one free pair Apple AirPods (with charging case) with the purchase of an iPad Pro. You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $199) or Apple AirPods Pro for only $90 (regularly $249). Promotion runs through early September. The following Apple Education discounts apply to 2020 iPad Pros: – 12.9″ 128GB WiFi iPad Pro: $899 $100 off – 12.9″ 256GB WiFi iPad Pro: $999 $100 off – 12.9″ 512GB WiFi iPad Pro: $1199 $100 off – 12.9″ 1TB WiFi iPad Pro: $1399 $100 off – 12.9″ 128GB WiFi + Cellular iPad Pro: $1049 $100 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1149 $100 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1349 $100 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1549 $100 off – 11″ 128GB WiFi iPad Pro: $749 $50 off – 11″ 256GB WiFi iPad Pro: $849 $50 off – 11″ 512GB WiFi iPad Pro: $1049 $50 off – 11″ 1TB WiFi iPad Pro: $1249 $50 off – 11″ 128GB WiFi + Cellular iPad Pro: $899 $50 off – 11″ 256GB WiFi + Cellular iPad Pro: $999 $50 off – 11″ 512GB WiFi + Cellular iPad Pro: $1199 $50 off – 11″ 1TB WiFi + Cellular iPad Pro: $1399 $50 off Not in the US? Click for the Canada or the → Read More...

Read more »

Apple has Series 5 Apple Watch models available for $60 off ...
Apple has Certified Refurbished Apple Watch Series 5 WiFi models available for $60 off MSRP, starting at $339. Each Watch includes Apple’s standard one-year warranty and free shipping: – 44mm Apple Watch Series 5 WiFi: $369 $60 off MSRP – 40mm Apple Watch Series 5 WiFi: $339 $60 off MSRP For the latest sales & deals, see our Apple Watch Price Tracker, → Read More...

Read more »

Use our exclusive price trackers at MacPrices.net to find th...
Looking for a new 2020 13″ MacBook Air or one of the new 2020 iPad Pros? Our Apple award-winning price trackers are the best place to look for the lowest prices and latest sales on Apple gear. Scan our price trackers for the latest information on sales, bundles, and availability on systems from Apple’s authorized internet/catalog resellers. We update the trackers continuously: – 16″ MacBook Pros – 13″ MacBook Pros – 13″ MacBook Airs – iMacs – iMac Pros – Mac minis – Mac Pros – Pro Display XDR – 7.9″ iPad minis – 10.2″ iPads – 10.5″ iPad Airs – 12″ iPad Pros – 11″ iPad Pros – Apple Watch – Apple TVs – Apple AirPods – iPhones Other price trackers include HomePods, Keyboards & Pointers, iPod touch, Smart Keyboards, and Apple Pencils. A full list of the available Apple price trackers is in the menu at the top of → Read More...

Read more »