ScreenFlow 9.0
Major upgrade of screencast recording and video editing app with added support for recording multiple screens simultaneously and a new Timeline Tools Palette. ($129 new, upgrade pricing available, 54.8 MB)

Read more »

White House confirms President Trump’s Apple factory v...
The White House has confirmed President Donald Trump will be paying a visit to a facility in Texas used to produce Apple's new modular Mac Pro on Wednesday, though finer details of the visit's purpose has yet to be revealed.

Read more »

A6: How Apple’s custom silicon and iOS optimized each ...
After delivering just its first two generations of its ARM processors, Apple was already recognized as a leading mobile silicon designer. Its next moves surprised the industry and began to reveal a strategy of tight vertical integration from silicon to OS that other device makers couldn't match-- and didn't even seem to see as important until it was too late.

Read more »

Enjoy Wireless Hi-Fi Home Theater Audio with a Discounted Ya...
Still using that clunky, 2-dimensional wired speaker for your home theater, TV or computer? Yamaha is giving you a chance to upgrade to one of its best Bluetooth speakers with… The post Enjoy Wireless Hi-Fi Home Theater Audio with a Discounted Yamaha Bluetooth Soundbar appeared first on iLounge.

Read more »

Trump and Cook’s Apple Texas Facility Tour to Proceed as P...
Tim Cook, Apple CEO will give a tour of the Texas plant facility on Wednesday for President Donald Trump, where the newest Mac Pro are assembled. Reuters says that the… The post Trump and Cook’s Apple Texas Facility Tour to Proceed as Planned appeared first on iLounge.

Read more »

Ex-Apple Bigwigs Form a Datacenter Processor Company
Three former Apple executives have launched a startup company that designs processors for use in data centers. The trio, who have worked on the iPhone’s mobile chips during their stay… The post appeared first on iLounge.

Read more »

Cortana on iOS Leaving Canada, UK and Australia January 31
The Cortana iOS app will be leaving the App Store on iPad and iPhone beginning January 31, 2020 in Canada, UK and Australia due to Microsoft’s changing strategy for the… The post appeared first on iLounge.

Read more »

10 relaxing games on Apple Arcade that will help you chill o...
I love "chill out" games and I agree "Patterned" is a great example. But I disagree about "Word Laces." That's just a stupid game, IMO.∞ Read this on The Loop

Read more »

13-inch vs 16-inch MacBook Pro: How specs, price, keyboards,...
On Wednesday, Apple officially released the new 16-inch MacBook Pro. We’ve already compared it in detail to the 15-inch MacBook Pro it replaces, but what about the 13-inch MacBook? Read on as we compare the specs, price, and more of the 13-inch vs 16-inch MacBook Pro. more… The post 13-inch vs 16-inch MacBook Pro: How specs, price, keyboards, and more compare appeared first on 9to5Mac.

Read more »

The best radio, shortcuts, research, and horror apps this we...
This week we get healthy with Apple Research, build powerful shortcuts with Toolbox Pro, listen to internet radio with Triode, and scare ourselves silly with Layers of Fear. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

16-inch MacBook Pro shows the advantages of a post-Jony Ive ...
The new 16-inch MacBook Pro is a sign of a fundamental shift at Apple: it includes a keyboard that makes this laptop slightly less stylish but more useful. It’s hard too believe this would have happened in the days when chief designer Jony Ive’s habit of putting form ahead of function still reigned supreme over […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple Watch styles drop to $169 (record low prices); AirPods...
Fresh early Black Friday markdowns have been issued at Amazon, with Apple Watch devices dropping to new record low prices thanks to discounts of up to $350 off. Meanwhile, Apple AirPods have received another price cut, knocking the earphones down to $139 while supplies last.

Read more »

Apple Watch styles drop to $169 (record low prices); AirPods...
Fresh early Black Friday markdowns have been issued at Amazon, with Apple Watch devices dropping to new record low prices thanks to discounts of up to $350 off. Meanwhile, Apple AirPods have received another price cut, knocking the earphones down to $139 while supplies last.

Read more »

Apple Watch styles drop to $169 (record low prices); AirPods...
Fresh early Black Friday markdowns have been issued at Amazon, with Apple Watch devices dropping to new record low prices thanks to discounts of up to $350 off. Meanwhile, Apple AirPods have received another price cut, knocking the earphones down to $139 while supplies last.

Read more »

Tapplock One+ biometric padlock easily secures your valuable...
The combination lock you used in school is a dinosaur now. It’s been replaced with much smarter versions like Tapplock One+. This has a fingerprint scanner, and a Bluetooth connection to your iPhone. It’s a padlock with no key to lose or combination to memorize. Unlock the details in our in-depth review. Tapplock One+ review […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Crime blotter: Festival thefts and drugs weighed on iPhones
Hundreds of iPhones are stolen from a festival, a credit card forgery ring is spotted in an Apple Store, and police warn of a drug-dealing scam using iPhones as weighing scales.

Read more »

This week’s top stories: 16-inch MacBook Pro is here, Disn...
In this week’s top stories: Apple officially unveils the 16-inch MacBook Pro, Disney+ debuts, Apple Watch Black Friday pricing, and more. Read on for all of this week’s biggest news.more… The post This week’s top stories: 16-inch MacBook Pro is here, Disney+ debuts, Apple Research app, more appeared first on 9to5Mac.

Read more »

Today in Apple history: Apple’s ‘unreleased’ Mac OS sh...
November 17, 1995: Apple releases the first beta version of its new Mac OS Copland operating system to around 50 Mac developers. Not so much a Mac OS update as a totally new operating system, it offers next-gen features designed to help Apple take on the then-mighty Windows 95. Sadly, it will never reach the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Review: Mophie Juice Pack Access gives your iPhone extra lif...
The Mophie Juice Pack Access is designed to keep your phone going on days when you can't make it back to the charging pad.

Read more »

Comment: Apple should add a secure iCloud Drive folder with ...
I love iCloud Drive. I love how integrated it is into macOS and iOS, and I long ago moved most of my documents away from Dropbox (except for Shared Folders). I am always looking for new ways to back up my photos, though. Since I keep an active Microsoft Office subscription, I thought I would use the 1TB of storage as another place to upload my photos. When I was using the OneDrive app, I noticed it had a Personal Vault section that I thought would be a great addition to iCloud Drive for storing sensitive files. Microsoft announced it back in June, and it rolled out worldwide in October. As I started using the OneDrive iPhone app, I quickly began to wonder why Apple hasn’t created a secure iCloud Drive folder with Touch ID and Face ID support. more… The post Comment: Apple should add a secure iCloud Drive folder with Face ID and Touch ID support appeared first on 9to5Mac.

Read more »

Cortana iOS app to go dark in Australia, UK, Canada on Janua...
Microsoft is changing plans for its digital assistant, with the software giant withdrawing availability for Cortana's iOS app for iPhone and iPad in a number of major territories starting from January 31, with users forced to use other apps to access content previously synchronized with Windows desktops from their mobile devices.

Read more »

Insights Into Apple’s 16-inch MacBook Pro Design
Apple listens to its pro Mac customers without getting overwhelmed. Just how does the company do that?

Read more »

Hands-on with the world’s smallest 100W GaN USB-C charger ...
Launching this week from our friends at Hyper, the latest HyperJuice product is the world’s first and smallest 100W GaN USB-C charger on the market. Below we go hands-on with the new charger to give you an early look as the company this week begins taking preorders. more… The post Hands-on with the world’s smallest 100W GaN USB-C charger from Hyper [Video] appeared first on 9to5Mac.

Read more »

The New MacBook Pro is $100 Less on Amazon than Apple
Just a few days after the release of the new 16-inch MacBook Pro, Amazon has dropped the price of the Apple product $100 less than what it’s going for on… The post appeared first on iLounge.

Read more »

Ex-Apple executives take aim at datacenter processor market
A trio of former Apple executives who worked on the iPhone maker's mobile chips have launched their own startup to design processors destined for use in data centers, with the company Nuvia recently raising $53 million in funding.

Read more »

The New MacBook Pro keyboard is a throwback in the best way
It's also an admission, tacit or otherwise, that Apple made a mistake with the butterfly keyboard. Rest assured, this "new" design will be in all future Apple laptops.∞ Read this on The Loop

Read more »

This researcher created an algorithm that removes the water ...
If you've ever taken underwater photos, you'll know the results are generally pretty disappointing. This technology could change that.∞ Read this on The Loop

Read more »

Apple Orders Up ‘Slow Horses’ For Apple TV+
Apple will be making a new Apple TV+ show called ‘Slow Horses’, with Gary Oldman being cast as the main actor. The show comes from a book with the same… The post appeared first on iLounge.

Read more »

16-inch MacBook Pro beats predecessors by overcoming thermal...
The just-released 16-inch MacBook Pro handles heat better, giving it faster performance than the 15-inch models introduced earlier this year, even though both laptops use exactly the same processor. Earlier benchmarks found that these two devices scored the same on Geekbench 5. But Max Bench did comparison tests after first forcing each processor to heat […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple To Remove Vaping-Related Apps Due to Public Health Con...
Due to public health concerns, Apple will be removing all apps that are related to vaping at the App Store. The Cupertino-based company released a statement, saying that they agree… The post Apple To Remove Vaping-Related Apps Due to Public Health Concerns appeared first on iLounge.

Read more »

Orcus RAT Author Charged in Malware Scheme
In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with orchestrating an international malware scheme.

Read more »

Patch Tuesday, November 2019 Edition
Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and in software that runs on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploited in the wild, as well as a sneaky bug in certain versions of Office for Mac that bypasses security protections and was detailed publicly prior to today's patches.

Read more »

Retailer Orvis.com Leaked Hundreds of Internal Passwords on ...
Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

Read more »

Vulnerability Summary for the Week of November 4, 2019
Original release date: November 11, 2019 | Last revised: November 12, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2019-11-01 7.5 CVE-2011-3923MISCEXPLOIT-DBBIDMISCMISCXFMISC aruba_networks -- clearpass_policy_manager Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. 2019-11-06 10 CVE-2016-4401CONFIRM clamav -- clamav There is a possible heap overflow in libclamav/fsg.c before 0.100.0. 2019-11-06 7.5 CVE-2007-0899MISC computing_for_good -- basic_laboratory_information_system Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. 2019-11-06 7.5 CVE-2019-5617MISC computing_for_good -- basic_laboratory_information_system   Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator. 2019-11-06 7.5 CVE-2019-5644MISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview 2019-11-04 7.5 CVE-2013-2259MISCMISCMISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input 2019-11-04 7.5 CVE-2013-4103MISCMISCMISCMISCMISC gri -- gri gri before 2.12.18 generates temporary files in an insecure way. 2019-11-08 7.5 CVE-2008-7291MISC isl_internet_sicherheitslösungen -- arp_guard A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. 2019-11-04 7.5 CVE-2019-18663MISC linux -- linux_kernel A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. 2019-11-07 7.8 CVE-2019-18812MISC linux -- linux_kernel A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.33 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. 2019-11-07 7.8 CVE-2010-2243MISCCONFIRMMISCMLIST linux -- linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. 2019-11-07 7.5 CVE-2019-18814MISC linux -- linux_kernel A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. 2019-11-07 7.8 CVE-2019-18813MISC linux -- linux_kernel An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. 2019-11-04 7.8 CVE-2019-18680MISCMISCMISCMISC linux -- linux_kernel An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. 2019-11-07 7.5 CVE-2019-18805MISCMISC linux -- linux_kernel A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. 2019-11-07 7.8 CVE-2019-18810MISCMISC linux -- linux_kernel A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. 2019-11-07 7.8 CVE-2019-18809MISC linux -- linux_kernel A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. 2019-11-07 7.8 CVE-2019-18811MISC linux-vserver -- linux-vserver linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. 2019-11-06 10 CVE-2006-4243MISC magento -- magento A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods. 2019-11-06 7.5 CVE-2019-8144MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection. 2019-11-06 9 CVE-2019-8159MISC magento -- magento An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities. 2019-11-05 7.5 CVE-2019-8121MISC magento -- magento An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component. 2019-11-06 7.5 CVE-2019-8136MISC magento -- magento An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. 2019-11-06 7.5 CVE-2019-8158MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. 2019-11-06 7.5 CVE-2019-8135MISC minidlna -- minidlna MiniDLNA has heap-based buffer overflow 2019-11-01 7.5 CVE-2013-2739MISCMISC minidlna -- minidlna minidlna has SQL Injection that may allow retrieval of arbitrary files 2019-11-01 7.5 CVE-2013-2738MISCMISCMISCMISC nvu -- nvu Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues. 2019-11-05 7.5 CVE-2005-2354MISCMISCMISC php-gettext -- php-gettext The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. 2019-11-04 7.5 CVE-2015-8980SUSEMLISTMLISTBIDCONFIRMCONFIRMCONFIRM portainer -- portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). 2019-11-07 9 CVE-2019-16872MISC python_sofware_foundation_and_beanbag -- djblets_and_review_board An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. 2019-11-04 7.5 CVE-2013-4409MISCMISCMISCMISCMISCMISCMISCMISCMISCMISC qualcomm -- multiple_products Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10528CONFIRM qualcomm -- multiple_products Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10533CONFIRM qualcomm -- multiple_products Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10505CONFIRM qualcomm -- multiple_products While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 7.5 CVE-2019-10522CONFIRM qualcomm -- multiple_products While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8976, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM8150 2019-11-06 7.5 CVE-2019-2302CONFIRM qualcomm -- multiple_products Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20 2019-11-06 7.5 CVE-2019-10542CONFIRM qualcomm -- multiple_products Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130 2019-11-06 7.5 CVE-2019-10565CONFIRM qualcomm -- multiple_products Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10541CONFIRM qualcomm -- multiple_products Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10534CONFIRM qualcomm -- multiple_products Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439 2019-11-06 10 CVE-2019-10531CONFIRM qualcomm -- multiple_products Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 9.3 CVE-2019-10529CONFIRM qualcomm -- multiple_products Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9205, MDM9650, QCA8081, QCS605, SD 427, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2249CONFIRM qualcomm -- multiple_products Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2283CONFIRM qualcomm -- multiple_products Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2258CONFIRM qualcomm -- multiple_products Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 2019-11-06 7.2 CVE-2019-2246CONFIRM qualcomm -- multiple_products When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24 2019-11-06 10 CVE-2019-2324CONFIRM qualcomm -- multiple_products Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2325CONFIRM qualcomm -- multiple_products Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2285CONFIRM qualcomm -- multiple_products Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2332CONFIRM qualcomm -- multiple_products Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2323CONFIRM qualcomm -- multiple_products Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2331CONFIRM quest -- kace_systems_management_appliance_server_center Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. 2019-11-06 7.5 CVE-2019-12918MISCMISC rbot -- rbot Rbot Reaction plugin allows command execution 2019-11-06 7.5 CVE-2010-2446MISCMISC red_hat -- openshift cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. 2019-11-01 7.5 CVE-2013-0165MISC s9y -- serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. 2019-11-05 7.5 CVE-2011-1134CONFIRMDEBIANSECTRACKMISC salesagility -- suitecrm SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. 2019-11-06 7.5 CVE-2019-18784MISCMISC shadow_and_sudo -- shadow_and_sudo There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process. 2019-11-04 7.2 CVE-2005-4890MISCMISCMISCMISCMISCMISCMISCMISCMISCMISCMISC sonatype  -- nexus_repository_manager There is an OS Command Injection in Nexus Repository Manager 2019-11-07 not yet calculated CVE-2019-12331CONFIRMMISC python_packaging_authority -- python_package_installer The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. 2019-11-05 not yet calculated CVE-2013-5123MISCMISCMISCMISCMISCMISCMISCMISC rapid7 -- metasploit_pro Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. 2019-11-06 not yet calculated CVE-2019-5642CONFIRM red_hat -- 389_directory_server A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 2019-11-08 not yet calculated CVE-2019-14824CONFIRM red_hat -- enterprise_linux_5 frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user. 2019-11-07 not yet calculated CVE-2008-3278MISCMISCMISC red_hat -- jboss_operations_network In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. 2019-11-08 not yet calculated CVE-2008-5083MISCMISC red_hat -- tuned tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. 2019-11-08 not yet calculated CVE-2013-1820MISCMISCMISC red_hat -- virtualization_manager In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform. 2019-11-09 not yet calculated CVE-2009-3552MISCMISCBUGTRAQ samba -- samba A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. 2019-11-06 not yet calculated CVE-2019-14833SUSECONFIRMMISC samba -- samba A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. 2019-11-06 not yet calculated CVE-2019-10218SUSECONFIRMMISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status. 2019-11-06 not yet calculated CVE-2019-16401MISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. 2019-11-06 not yet calculated CVE-2019-16400MISC shibboleth -- shibboleth_service_provider The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default. 2019-11-07 not yet calculated CVE-2010-2450MISCMISCCONFIRM simplesamlphp -- simplesamlphp Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. 2019-11-07 not yet calculated CVE-2019-3465MISCMLISTBUGTRAQMISCDEBIAN simplesamlphp -- simplesamlphp simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. 2019-11-06 not yet calculated CVE-2011-4625MISCMISC strapi -- strapi strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. 2019-11-07 not yet calculated CVE-2019-18818MISCMISCMISC syscp -- syscp syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot. 2019-11-07 not yet calculated CVE-2010-2476MISCMISCMLIST tahoe-lafs -- tahoe-lafs Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. 2019-11-07 not yet calculated CVE-2012-0051MISCMISCMISCMISCMISCCONFIRM termpkg -- termpkg termpkg 3.3 suffers from buffer overflow. 2019-11-06 not yet calculated CVE-2006-3100MISCMISC tmaxsoft -- jeus JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file. 2019-11-08 not yet calculated CVE-2019-17327MISC veritas -- multiple_products An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. 2019-11-05 not yet calculated CVE-2019-18780MISCMISCMISCMISC viber -- viber Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 16 bytes of udid in a binary format, which is located at approximately offset 0x40 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS. 2019-11-06 not yet calculated CVE-2019-18800MISC wolfssl -- wolfssl In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free. 2019-11-09 not yet calculated CVE-2019-18840MISC wordpress -- wordpress A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. 2019-11-08 not yet calculated CVE-2019-17661MISC zte -- mf910s_router Security researcher Shen Ying from the Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. 2019-11-07 not yet calculated CVE-2019-3422CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations. 2019-11-08 not yet calculated CVE-2019-3426CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts. 2019-11-08 not yet calculated CVE-2019-3425CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Study: Ransomware, Data Breaches at Hospitals tied to Uptick...
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security -- or the lack thereof -- may be impacting patient outcomes.

Read more »

Researchers use lasers to hack Siri, Alexa, Google assistant...
Researchers have used programmable low-powered lasers to remotely control voice-activated personal assistants like Apple's Siri, Amazon's Alexa, and Google Assistant from up to 360 feet away. These attacks exploit a vulnerability in microphones using micro-electro-mechanical systems (MEMS), which the researchers have discovered will respond to lasers the same way they will respond to sound. The […]

Read more »

Apple updates its privacy page with sleek new look
A company’s privacy page usually reads like it was written by lawyers—because it usually is. Information is rarely presented in a way that laypeople can understand, and as for making it both easy to consume and easy on the eyes? Forget it. Apple’s new privacy page thinks different. It presents the company’s privacy info in plain […]

Read more »

iPad vs. MacBook: is iPadOS a game changer?
It took Apple more than nine years to recognize that the iPhone and iPad were different enough to warrant separate operating systems: iOS 13 and iPadOS 13. Now, with the changes in the new iPadOS, an iPad could replace a laptop for many people. iPadOS may really be a game changer for mobile computing. But just how effectively can an iPad replace a MacBook?

Read more »

Red Hat Security Advisory 2019-3513-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Read more »

Vulnerability Summary for the Week of October 28, 2019
Original release date: November 4, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- experience_manager   Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. 2019-10-25 7.5 CVE-2019-8088CONFIRM apache -- thrift In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings. 2019-10-29 7.8 CVE-2019-0205MISC bitlbee -- bitlbee   Bitlbee does not drop extra group privileges correctly in unix.c 2019-10-29 7.5 CVE-2012-1187MISCMISCMISCMISC cisco -- video_communications_server   Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands. 2019-10-29 9 CVE-2011-2538CONFIRM codesys -- eni_server   CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. 2019-10-25 7.5 CVE-2019-16265CONFIRMMISC d-link -- dir-865   D-Link DIR-865L has PHP File Inclusion in the router xml file. 2019-10-25 7.5 CVE-2013-4857MISCMISC d-link -- dir-865l_devices   D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 7.9 CVE-2013-4855MISCMISCMISC debian_project -- qtparted   qtparted has insecure library loading which may allow arbitrary code execution 2019-10-29 7.5 CVE-2010-3375DEBIANMISCMISC google -- chrome   browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. 2019-10-25 7.5 CVE-2016-5202MISCMISCMISCMISCMISC hot-world -- repetier-server A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-28 10 CVE-2019-14450CONFIRMMISC hot-world -- repetier-server   RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-25 10 CVE-2019-14451CONFIRMMISC intrasrv -- intrasrv   A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system. 2019-10-28 10 CVE-2019-17181MISCMISC jetbrains -- teamcity In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. 2019-10-31 7.5 CVE-2019-18364CONFIRM k7_computing -- antivirus_premium_and_total_security_and_ultimate_security   In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll module to facilitate escalation of privileges via inter-process communication with a service process. 2019-10-28 7.5 CVE-2019-16897MISC labf -- nfsaxe_ftp_client   Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. 2019-10-25 7.5 CVE-2017-14742EXPLOIT-DB linksys -- ea6500_router   Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 10 CVE-2013-4658MISCMISCMISC medoo -- medoo   columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. 2019-10-30 7.5 CVE-2019-10762MISCMISC mikrotik -- routeros   RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords. 2019-10-29 8.5 CVE-2019-3977MISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. 2019-10-25 7.5 CVE-2016-2356MISCMISCMISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource. 2019-10-25 7.5 CVE-2016-2359MISCMISCMISC mitsubishi_electric_and_inea -- me-rtu_devices An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.) 2019-10-28 10 CVE-2019-14930MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. 2019-10-28 10 CVE-2019-14931MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites. 2019-10-28 7.5 CVE-2019-14926MISCMISC philips -- intellispace_perinatal   In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host application user to break-out from the containment of the application and access unauthorized resources from the Windows operating system as the limited-access Windows user. Due to potential Windows vulnerabilities, it may be possible for additional attack methods to be used to escalate privileges on the operating system. 2019-10-25 7.2 CVE-2019-13546MISC php -- php   In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. 2019-10-28 7.5 CVE-2019-11043REDHATREDHATREDHATREDHATCONFIRMMISCFEDORAFEDORAFEDORACONFIRMCONFIRMUBUNTUUBUNTUDEBIANDEBIAN pixelpost -- pixelpost   pixelpost 1.7.1 has SQL injection 2019-10-28 7.5 CVE-2009-4899MISCDEBIANMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 9 CVE-2019-16663MISCMISCMISCMISCMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 10 CVE-2019-16662MISCMISCMISCMISCMISCMISC rittal -- rittal_chiller_sk_3232_series   Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 ? B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point. 2019-10-25 10 CVE-2019-13553FULLDISCMISC sequelize -- sequelize   Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. 2019-10-29 7.5 CVE-2019-10748MISCMISCMISC sequelize -- sequelize   sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. 2019-10-29 7.5 CVE-2019-10749MISCMISC snoopy -- snoopy e Snoopy before 2.0.0 has a security hole in exec cURL 2019-10-28 7.5 CVE-2002-2444MISCDEBIANMISC sugarcrm -- sugarcrm   SugarCRM CE

Read more »

NCR Barred Mint, QuickBooks from Banking Platform During Acc...
Banking industry giant NCR Corp. [NYSE: NCR] late last month took the unusual step of temporarily blocking third-party financial data aggregators Mint and QuicBooks Online from accessing Digital Insight, an online banking platform used by hundreds of financial institutions. That ban, which came in response to a series of bank account takeovers in which cybercriminals used aggregation sites to surveil and drain consumer accounts, has since been rescinded. But the incident raises fresh questions about the proper role of digital banking platforms in fighting password abuse.

Read more »

Sunday Sale: Amazon drops AirPod prices to a new low of $139...
Amazon is offering discounts on new 2019 Apple AirPods ranging up to $35 off MSRP. Overnight they dropped their price for the AirPods with Charging Case to a new low of only $139. That’s the lowest price we’ve seen, so far, for 2019 AirPods. Shipping is free: – AirPods Pro: $234.98 $15 off MSRP – AirPods with Wireless Charging Case: $164.99 $35 off MSRP – AirPods with Charging Case: $139 $20 off MSRP – Wireless Charging Case: $69 $10 off MSRP See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Weekend Sale: Apple AirPods Pro for $234.98 at Abt Electroni...
Abt Electronics has Apple’s new AirPods Pro in stock and on sale today for $234.98 including free shipping and free returns. Their price is $15 off Apple’s MSRP for these AirPods and tie Amazon & Sams Club as the lowest price available. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

New 2019 16″ MacBook Pros on sale for $100 off Apple’s M...
Apple Authorized Reseller Adorama has new 2019 16″ MacBook Pros on sale today for $100 off Apple’s MSRP, each including free shipping. In addition, Adorama charges sales tax for NY & NJ residents only: – 2019 16″ 2.6GHz 6-Core MacBook Pro (Space Gray or Silver): $2299 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro (Space Gray or Silver): $2699 $100 off MSRP Preorder today, and Adorama will delivery when they receive stock from Apple. These are the same 16″ MacBook Pros sold by Apple in their retail and online stores. Keep an eye on our 16″ MacBook Pro Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Apple Watch Series 3 GPS models on sale for lowest prices ev...
Amazon has Apple Watch Series 3 GPS models on sale starting at only $179. There prices are the lowest we’ve ever seen for these models from any Apple reseller. Choose Amazon as the seller rather than a third-party, and note that Amazon stock fluctuates, so be sure to check their site for the latest availability. Shipping is free: – 38mm Apple Watch Series 3 GPS: $179 $20 off MSRP – 42mm Apple Watch Series 3 GPS: $209 $20 off MSRP A limited supply remains available at these prices. Note that optional Apple Watch bands may be extra. For the latest prices from Apple and its resellers, see our Apple Watch → Read More...

Read more »

iOS Bug In Facebook News Feed Lets Device Camera Be Used Wi...
NEWS: 11.15.19- Users of the Facebook social media platform’s mobile app running on iOS devices won’t, like, this piece of news one bit in where a bug in the News Feed gave access to the camera while the unsuspecting individual simply scrolled through their daily posts unaware of the issue. The Facebook “like” icon shown here inverted to illustrate an opposite thumbs down reaction. (Photo: Facebook) Discovered by Joshua Maddux, CEO of 95Visual, a web design and development firm based out of Santa Clarita, California (a city located just north of Los Angeles which itself was placed inadvertently in the spotlight yesterday morning due to a tragedy), the chief executive officer posted a tweet on Twitter last Saturday that said he, according to Maddux himself, found a Facebook security and privacy issue where when the app is open it actively uses the camera. The rest of his post, which also included an embedded video, said the following: … I found a bug in the app that lets you see the camera open behind your feed. Note that I had the camera pointed at the carpet. The news of the discovery was one of the top tech stories running the gamut Wednesday through various media outlets such as CNN which alerted Facebook users — specifically on devices with the iOS mobile operating system installled (Android software appeared to be immune) — to restrict, temporarily, access to the camera until a fix for the bug was issued by the social media company. It was not immediately clear, nor was it specified, in the CNN report as to whether the problem was evident solely in the Facebook app for iOS or also when the social media platform is accessed on the web (e.g., Safari) while in the iOS environment. It also is unknown if the Facebook app running on iPadOS, the recently released spinoff of iOS for the iPad (naturally), is included. Furthermore, there was no word on what version(s) of → Read More...

Read more »

16″ MacBook Pros on sale! Preorder at Amazon today for $10...
Apple’s new 16″ MacBook Pros were only introduced yesterday, but Amazon is already offering a $100 discount on preorders. Prices for the base 6-Core 16″ MacBook Pros start at $2299: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2299.99 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2699.99 $100 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2299.99 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2699.99 $100 off MSRP These MacBook Pros will ship for free once stock is received. Amazon is the first Apple reseller we track to offer discounts on 16″ MacBook Pros. See our 16″ and 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Use our exclusive MacBook Price Trackers to find today’s b...
Our Apple award-winning MacBook price trackers are the best place to look for the best sales & lowest prices on new and clearance MacBook Airs and MacBook Pros–including Apple’s new 16″ MacBook Pro. Scan our price trackers for the latest information on sales, bundles, and availability on systems from Apple’s authorized internet/catalog resellers. We update the trackers continuously: – 16″ & 15″ MacBook Pros – 13″ MacBook Pros – 13″ MacBook Airs – 12″ MacBooks (recently discontinued by Apple) We track new as well as Apple Certified Refurbished models. A full list of the available Apple price trackers is in the menu at the top of → Read More...

Read more »

New November Verizon iPhone deal: Get an iPhone Xr for 50% o...
Verizon has the 64GB iPhone Xr on sale for 50% off for a limited time, plus they will include a free $200 prepaid MasterCard and a free Amazon Echo Dot. That reduces their price for the 64GB iPhone Xr to $12.49 per month for 24 months and reduces the total cost of the phone by $300 over that period.. New line of service required. Here are the details: – Add iPhone XR to your cart as a new line with monthly device or full retail price payments – Get your $300 credited to your account over 24 months. – Plus, you’ll get a $200 Prepaid Mastercard when you switch to Verizon on Unlimited. – Get a free Echo Dot and Amazon Smart Plug when you switch to Verizon on Unlimited. The fine print: “Up to $749.99 device payment purchase per phone w/1 new smartphone line + Unlimited required. 2nd phone must be of equal or lesser value. Less up to $599.99 promo credit applied to account over 24 mos; promo credit ends if eligibility requirements are no longer met; 0% APR. Less $200 prepaid card (mailed w/in 8 wks) when you port-in your number from any wireless carrier and activate a new select iPhone (minimum retail price of $550) on device payment to a postpaid Verizon consumer account and activate on an eligible Verizon Unlimited postpaid plan. Echo Dot (3rd gen) and Smart Plug devices provided by Verizon and redeemed on amazon.com. Must be redeemed no later than 1.31.2020. Amazon, Echo, Alexa and all related logos are trademarks of amazon.com, Inc.” This deal is live on Verizon’s → Read More...

Read more »

Apple cuts prices on clearance, refurbished 2018 15″ 6-Cor...
Apple has clearance 2018 15″ 6-Core Touch Bar MacBook Pros, Certified Refurbished, now available starting at only $1829. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 15″ MacBook Pros currently available for sale at Apple: – 15″ 2.2GHz Touch Bar MacBook Pro (Space Gray): $1829 original MSRP $2399 – 15″ 2.2GHz Touch Bar MacBook Pro (Silver): $1829 original MSRP $2399 – 15″ 2.6GHz Touch Bar MacBook Pro (Space Gray): $2119 original MSRP $2799 – 15″ 2.6GHz Touch Bar MacBook Pro (Silver): $2119 original MSRP $2799 See our 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, updated daily, as well as specifications and review of these → Read More...

Read more »

Up to $450 price drop on clearance 15″ MacBook Pros at B&a...
B&H Photo has dropped prices Apple’s 2019 15″ 6-Core and 8-Core MacBook Pros by $400-$450 off original MSRP, starting at $1999, with free overnight shipping available to many addresses in the US: – 2019 15″ 2.6GHz 6-Core MacBook Pro Space Gray: $1999 $400 off original MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Space Gray: $2349 $450 off original MSRP – 2019 15″ 2.6GHz 6-Core MacBook Pro Silver: $1999 $400 off original MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Silver: $2349 $450 off original MSRP See our 16″ and 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Here’s how to save $200 on Apple’s new 16″ MacBook Pro...
Apple has released details of their Education discount associated with the new 2019 16″ 6-Core and 8-Core MacBook Pros. Take $200 off the price of the new 8-Core model (now $2599) and $200 off the 16″ 6-Core MacBook Pro (now $2199). All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. – 2019 16″ 2.3GHz 8-Core Touch Bar MacBook Pro: $2599 $200 off – 2019 16″ 2.6GHz 6-Core Touch Bar MacBook Pro: $2199 $200 off Not in the US? Click for the Canada or the → Read More...

Read more »

Price drop! 2019 15″ 2.6GHz 6-Core MacBook Pro for $1999, ...
Focus Camera has dropped their price for clearance 2019 15″ 2.6GHz 6-Core Space Gray MacBook Pros by $400 to $1999 shipped. Apple’s original MSRP for this model was $2399. Focus charges sales tax for NY & NJ → Read More...

Read more »