How to change playback quality and save data when streaming ...
Apple TV+ offers its original television shows and movies at a very high quality, with higher streaming bandwidth than any other service. However, this also means Apple TV+ uses a lot of data. Here’s how to change the playback quality settings to save on data usage, especially useful if you are streaming on cellular with data caps. more… The post How to change playback quality and save data when streaming Apple TV+ appeared first on 9to5Mac.

Read more »

Nvidia Shield TV (2019) review: This great media streamer is...
The Nvidia Shield TV is still the best Android TV box, and it's not just for techies anymore.

Read more »

Apple AirPods Pro are back on sale – and in stock R...
Amazon's popular $15 price drop is back on Apple AirPods Pro, with the hot new accessory in stock for $234.95 while supplies last. After selling out at the reduced price several times, this special offer might not last long.

Read more »

VideoProc Review: A Trusted Video Editing & Converting ...
These days having a video editing and converting software is a must-have, especially for those who constantly upload to the web or consume a lot of content on all their… The post VideoProc Review: A Trusted Video Editing & Converting Software with Full GPU Acceleration appeared first on iLounge.

Read more »

Instagram ramps up TikTok competition as it tests new ‘Ree...
Instagram is upping its efforts to compete with TikTok. A new report from TechCrunch today details that the company has debuted Instagram Reels, which makes it easy to create 15-second video clips set to music. more… The post Instagram ramps up TikTok competition as it tests new ‘Reels’ in-app editing features appeared first on 9to5Mac.

Read more »

Walk, run or wheel 5 kilometers with Apple Watch to earn 201...
Apple's next Apple Watch activity challenge will fall on Thanksgiving, with owners eligible to receive a turkey-themed badge when they complete a 5-kilometer walk, run or wheelchair workout.

Read more »

Apple Watch Thanksgiving Activity Challenge returning this y...
Following yesterday’s challenge in honor of Veterans Day, Apple has already set its next Apple Watch Activity Challenge. As first spotted by Kyle Seth Gray on Twitter, Apple is holding an Activity Challenge for Thanksgiving later this month. more… The post Apple Watch Thanksgiving Activity Challenge returning this year, encourages a 5K workout appeared first on 9to5Mac.

Read more »

Walmart adds integration with Siri as it expands Voice Order...
Walmart has announced that it is integrating with Siri on iOS to allow shoppers to easily add items to their cart. The new Voice Order feature allows you interact with Walmart by simply telling Siri to “Add to Walmart.” more… The post Walmart adds integration with Siri as it expands Voice Ordering feature appeared first on 9to5Mac.

Read more »

Walmart Grocery customers can use Siri to place online order...
Walmart this week announced a new partnership with Apple that integrates the retailer's Voice Order technology with Apple's Siri virtual assistant, granting customers the option of shopping via voice command.

Read more »

Win this sweet accessory pack from the Cult of Mac Store [Gi...
Elago Treat your favorite Apple devices to some of the sweetest accessories money can buy. Our latest giveaway offers up an awesome Elago bundle for iPhone, AirPods, and Apple Watch. Three lucky winners will receive a 3-in-1 Charging Hub, an AirPods Wrist Fit, a Premium Silicone case for iPhone 11 and the wonderful W3 stand […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

News round-up: ‘Truth Be Told’ coming to Apple TV+ on De...
Apple celebrated “Truth Be Told” — which will debut on Apple TV+ Dec. 6 — with the global premiere of the original series at The Samuel Goldwyn Theater in Los Angeles, California. The limited drama series follows podcaster Poppy Parnell (Octavia Spencer) as she is compelled to reopen the murder case that made her a national sensation and comes face-to-face with Warren Cave (Aaron Paul), the man she may have mistakenly helped to put behind bars. 

Read more »

Tim Cook and President Trump to tour Apple facilities in Tex...
Apple CEO Tim Cook and President Donald Trump are expected to make a trip to Texas together, Reuters reports today. The trip has yet to be officially announced, but the two would reportedly tour facilities in Texas where Apple products are made. more… The post Tim Cook and President Trump to tour Apple facilities in Texas together, report says appeared first on 9to5Mac.

Read more »

President Trump, Tim Cook expected to tour Apple’s Texas f...
President Donald Trump and Apple CEO Tim Cook are expected to tour facilities in Texas where Apple products are made as soon as next week to showcase companies that keep jobs in America, according to Reuters, quoting two unnamed “people familiar with the matter.”

Read more »

Before the MacBook’s fall: The greatest laptops Apple ever...
The current MacBook Pro is the worst thing since unsliced bread — at least if you believe my colleague Charlie “glass is half empty” Sorrel. But while people might be happy to dump on Cupertino’s current laptop selection, Apple brought us some amazing laptops in its 40-plus year history. Here are the inarguable top five […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Bloomberg: 16-inch MacBook Pro coming as soon as tomorrow, s...
A new report from Bloomberg this evening says that Apple will debut the new 16-inch MacBook Pro as soon as tomorrow. This follows 9to5Mac‘s reporting from yesterday, which indicated that Apple is currently holding private briefings with members of the press to showcase the new MacBook Pro. more… The post Bloomberg: 16-inch MacBook Pro coming as soon as tomorrow, starting at $2,400 appeared first on 9to5Mac.

Read more »

Tim Cook, President Trump to tour Apple’s Texas manufa...
Apple CEO Tim Cook and President Donald Trump are expected to take a tour of Apple's Texas facilities, with the visit designed to shine a light on companies that create and keep jobs in the U.S.

Read more »

Goldman Sachs Responds to Allegations of Apple Card Gender B...
Developer and entrepreneur David Heinemeier’s tweet about his wife’s paltry Apple Card credit limit has sparked a government investigation and a fierce debate about sexism in the financial industry.Read original article

Read more »

How to quickly select, move, and delete notes on iPhone and ...
Want to boost your Notes app management efficiency on iPhone or iPad? Read along for how to quickly select, move, and delete multiple notes with a two-finger tap and drag on iPhone and iPad. more… The post How to quickly select, move, and delete notes on iPhone and iPad with two-finger tap appeared first on 9to5Mac.

Read more »

Apple highlights at JNUC 2019 that all Fortune 500 members a...
At JNUC 2019, Jeremy Butcher from Apple Product Marketing came on stage to give the Apple community an update on the state of Apple’s enterprise focus. He highlighted that all Fortune 500 companies are using Apple products. more… The post Apple highlights at JNUC 2019 that all Fortune 500 members are using Apple products appeared first on 9to5Mac.

Read more »

Ex head of HBO might bring the next Game of Thrones to Apple...
Richard Plepler, who led HBO for almost three decades, is reportedly teaming up with Apple. He’s not joining the iPhone maker, but his production company will create content for Apple TV+. If a deal goes through, the man who greenlit Game of Thrones would be developing shows for Apple. A major boon for Apple TV+ […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

HBO ex-CEO Richard Plepler negotiating Apple TV+ content dea...
Apple appears to be on the cusp of signing an Apple TV+ content deal with RLP & Company, helmed by former HBO chief executive Richard Plepler.

Read more »

Minecraft Earth now available in the US, ‘Mobs in the Park...
Minecraft Earth is the latest title in the highly popular franchise that allows players to leverage augmented reality to collaborate with others in real-time and cover “the entire planet in Minecraft.” While the game has been available in some countries starting last month, it’s now available on iOS and Android in the US. more… The post Minecraft Earth now available in the US, ‘Mobs in the Park’ in-person events set for NYC, more appeared first on 9to5Mac.

Read more »

Dongle-tangling: Use dark chaotic forces and never lose your...
Got a late-model iPhone or iPad and wired headphones? Never lose your headphone adapter again with this one weird dongle-tangling trick. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Former HBO CEO in talks to produce content for Apple TV+
Former HBO CEO and chairman Richard Plepler is talking with Apple about an exclusive Apple TV+ production deal, reports Deadline, quoting unnamed sources.

Read more »

IBM Finds Its Mac Users to Be More Productive Than PC Users
In an ironic historical twist, IBM has one of the largest Mac installations in the world, and the company has now released research showing that its Mac users score higher on performance reviews, close larger sales, and are less likely to leave the company than its Windows users. But be careful what you conclusions you draw from those results.

Read more »

On its own, AirPods could be a $175 billion enterprise
If a private company was performing the way Apple's AirPods are in terms of rapid sales growth in units and revenues with strong margins, it could be valued at $175 billion next year, making it the 32nd largest company in the U.S.

Read more »

Ghostwriter featurette shines spotlight on Apple TV+ spooky ...
Grownup shows drew most of the attention during the launch of Apple TV+, but children’s programming debuted as well, including Ghostwriter. Not to be overlooked, an extended trailer out today puts attention on this educational thriller. Watch it now: Apple’s description for “Ghost Writer — First Look Featurette“ says: “When a ghost haunts a neighborhood […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Former HBO CEO in ‘advanced talks’ with Apple TV+ for an...
The Wall Street Journal reports today that former HBO CEO Richard Plepler is in talks to sign an exclusive production deal with Apple TV+. According to the report, a deal could be finalized within the next “few weeks.” more… The post Former HBO CEO in ‘advanced talks’ with Apple TV+ for an exclusive production deal appeared first on 9to5Mac.

Read more »

‘Minecraft Earth’ early access now available in ...
Microsoft's augmented reality 'Minecraft Earth' is now available to play in early access in the United States, letting you build with your friends on your iPhone or iPad in the real world.

Read more »

IBM’s 200,000 Macs have made a happier, more productive wo...
This is interesting but not "news." Even back when I worked at Apple in the late 90s, Apple knew enterprise Return on Investment (ROI) was significantly higher than Windows in "mixed-use" environments.∞ Read this on The Loop

Read more »

Patch Tuesday, November 2019 Edition
Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and in software that runs on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploited in the wild, as well as a sneaky bug in certain versions of Office for Mac that bypasses security protections and was detailed publicly prior to today's patches.

Read more »

Retailer Orvis.com Leaked Hundreds of Internal Passwords on ...
Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

Read more »

Vulnerability Summary for the Week of November 4, 2019
Original release date: November 11, 2019 | Last revised: November 12, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2019-11-01 7.5 CVE-2011-3923MISCEXPLOIT-DBBIDMISCMISCXFMISC aruba_networks -- clearpass_policy_manager Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. 2019-11-06 10 CVE-2016-4401CONFIRM clamav -- clamav There is a possible heap overflow in libclamav/fsg.c before 0.100.0. 2019-11-06 7.5 CVE-2007-0899MISC computing_for_good -- basic_laboratory_information_system Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. 2019-11-06 7.5 CVE-2019-5617MISC computing_for_good -- basic_laboratory_information_system   Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator. 2019-11-06 7.5 CVE-2019-5644MISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview 2019-11-04 7.5 CVE-2013-2259MISCMISCMISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input 2019-11-04 7.5 CVE-2013-4103MISCMISCMISCMISCMISC gri -- gri gri before 2.12.18 generates temporary files in an insecure way. 2019-11-08 7.5 CVE-2008-7291MISC isl_internet_sicherheitslösungen -- arp_guard A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. 2019-11-04 7.5 CVE-2019-18663MISC linux -- linux_kernel A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. 2019-11-07 7.8 CVE-2019-18812MISC linux -- linux_kernel A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.33 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. 2019-11-07 7.8 CVE-2010-2243MISCCONFIRMMISCMLIST linux -- linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. 2019-11-07 7.5 CVE-2019-18814MISC linux -- linux_kernel A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. 2019-11-07 7.8 CVE-2019-18813MISC linux -- linux_kernel An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. 2019-11-04 7.8 CVE-2019-18680MISCMISCMISCMISC linux -- linux_kernel An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. 2019-11-07 7.5 CVE-2019-18805MISCMISC linux -- linux_kernel A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. 2019-11-07 7.8 CVE-2019-18810MISCMISC linux -- linux_kernel A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. 2019-11-07 7.8 CVE-2019-18809MISC linux -- linux_kernel A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. 2019-11-07 7.8 CVE-2019-18811MISC linux-vserver -- linux-vserver linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. 2019-11-06 10 CVE-2006-4243MISC magento -- magento A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods. 2019-11-06 7.5 CVE-2019-8144MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection. 2019-11-06 9 CVE-2019-8159MISC magento -- magento An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities. 2019-11-05 7.5 CVE-2019-8121MISC magento -- magento An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component. 2019-11-06 7.5 CVE-2019-8136MISC magento -- magento An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. 2019-11-06 7.5 CVE-2019-8158MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. 2019-11-06 7.5 CVE-2019-8135MISC minidlna -- minidlna MiniDLNA has heap-based buffer overflow 2019-11-01 7.5 CVE-2013-2739MISCMISC minidlna -- minidlna minidlna has SQL Injection that may allow retrieval of arbitrary files 2019-11-01 7.5 CVE-2013-2738MISCMISCMISCMISC nvu -- nvu Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues. 2019-11-05 7.5 CVE-2005-2354MISCMISCMISC php-gettext -- php-gettext The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. 2019-11-04 7.5 CVE-2015-8980SUSEMLISTMLISTBIDCONFIRMCONFIRMCONFIRM portainer -- portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). 2019-11-07 9 CVE-2019-16872MISC python_sofware_foundation_and_beanbag -- djblets_and_review_board An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. 2019-11-04 7.5 CVE-2013-4409MISCMISCMISCMISCMISCMISCMISCMISCMISCMISC qualcomm -- multiple_products Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10528CONFIRM qualcomm -- multiple_products Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10533CONFIRM qualcomm -- multiple_products Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10505CONFIRM qualcomm -- multiple_products While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 7.5 CVE-2019-10522CONFIRM qualcomm -- multiple_products While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8976, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM8150 2019-11-06 7.5 CVE-2019-2302CONFIRM qualcomm -- multiple_products Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20 2019-11-06 7.5 CVE-2019-10542CONFIRM qualcomm -- multiple_products Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130 2019-11-06 7.5 CVE-2019-10565CONFIRM qualcomm -- multiple_products Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10541CONFIRM qualcomm -- multiple_products Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10534CONFIRM qualcomm -- multiple_products Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439 2019-11-06 10 CVE-2019-10531CONFIRM qualcomm -- multiple_products Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 9.3 CVE-2019-10529CONFIRM qualcomm -- multiple_products Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9205, MDM9650, QCA8081, QCS605, SD 427, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2249CONFIRM qualcomm -- multiple_products Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2283CONFIRM qualcomm -- multiple_products Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2258CONFIRM qualcomm -- multiple_products Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 2019-11-06 7.2 CVE-2019-2246CONFIRM qualcomm -- multiple_products When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24 2019-11-06 10 CVE-2019-2324CONFIRM qualcomm -- multiple_products Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2325CONFIRM qualcomm -- multiple_products Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2285CONFIRM qualcomm -- multiple_products Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2332CONFIRM qualcomm -- multiple_products Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2323CONFIRM qualcomm -- multiple_products Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2331CONFIRM quest -- kace_systems_management_appliance_server_center Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. 2019-11-06 7.5 CVE-2019-12918MISCMISC rbot -- rbot Rbot Reaction plugin allows command execution 2019-11-06 7.5 CVE-2010-2446MISCMISC red_hat -- openshift cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. 2019-11-01 7.5 CVE-2013-0165MISC s9y -- serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. 2019-11-05 7.5 CVE-2011-1134CONFIRMDEBIANSECTRACKMISC salesagility -- suitecrm SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. 2019-11-06 7.5 CVE-2019-18784MISCMISC shadow_and_sudo -- shadow_and_sudo There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process. 2019-11-04 7.2 CVE-2005-4890MISCMISCMISCMISCMISCMISCMISCMISCMISCMISCMISC sonatype  -- nexus_repository_manager There is an OS Command Injection in Nexus Repository Manager 2019-11-07 not yet calculated CVE-2019-12331CONFIRMMISC python_packaging_authority -- python_package_installer The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. 2019-11-05 not yet calculated CVE-2013-5123MISCMISCMISCMISCMISCMISCMISCMISC rapid7 -- metasploit_pro Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. 2019-11-06 not yet calculated CVE-2019-5642CONFIRM red_hat -- 389_directory_server A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 2019-11-08 not yet calculated CVE-2019-14824CONFIRM red_hat -- enterprise_linux_5 frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user. 2019-11-07 not yet calculated CVE-2008-3278MISCMISCMISC red_hat -- jboss_operations_network In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. 2019-11-08 not yet calculated CVE-2008-5083MISCMISC red_hat -- tuned tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. 2019-11-08 not yet calculated CVE-2013-1820MISCMISCMISC red_hat -- virtualization_manager In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform. 2019-11-09 not yet calculated CVE-2009-3552MISCMISCBUGTRAQ samba -- samba A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. 2019-11-06 not yet calculated CVE-2019-14833SUSECONFIRMMISC samba -- samba A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. 2019-11-06 not yet calculated CVE-2019-10218SUSECONFIRMMISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status. 2019-11-06 not yet calculated CVE-2019-16401MISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. 2019-11-06 not yet calculated CVE-2019-16400MISC shibboleth -- shibboleth_service_provider The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default. 2019-11-07 not yet calculated CVE-2010-2450MISCMISCCONFIRM simplesamlphp -- simplesamlphp Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. 2019-11-07 not yet calculated CVE-2019-3465MISCMLISTBUGTRAQMISCDEBIAN simplesamlphp -- simplesamlphp simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. 2019-11-06 not yet calculated CVE-2011-4625MISCMISC strapi -- strapi strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. 2019-11-07 not yet calculated CVE-2019-18818MISCMISCMISC syscp -- syscp syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot. 2019-11-07 not yet calculated CVE-2010-2476MISCMISCMLIST tahoe-lafs -- tahoe-lafs Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. 2019-11-07 not yet calculated CVE-2012-0051MISCMISCMISCMISCMISCCONFIRM termpkg -- termpkg termpkg 3.3 suffers from buffer overflow. 2019-11-06 not yet calculated CVE-2006-3100MISCMISC tmaxsoft -- jeus JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file. 2019-11-08 not yet calculated CVE-2019-17327MISC veritas -- multiple_products An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. 2019-11-05 not yet calculated CVE-2019-18780MISCMISCMISCMISC viber -- viber Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 16 bytes of udid in a binary format, which is located at approximately offset 0x40 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS. 2019-11-06 not yet calculated CVE-2019-18800MISC wolfssl -- wolfssl In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free. 2019-11-09 not yet calculated CVE-2019-18840MISC wordpress -- wordpress A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. 2019-11-08 not yet calculated CVE-2019-17661MISC zte -- mf910s_router Security researcher Shen Ying from the Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. 2019-11-07 not yet calculated CVE-2019-3422CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations. 2019-11-08 not yet calculated CVE-2019-3426CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts. 2019-11-08 not yet calculated CVE-2019-3425CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Study: Ransomware, Data Breaches at Hospitals tied to Uptick...
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security -- or the lack thereof -- may be impacting patient outcomes.

Read more »

Researchers use lasers to hack Siri, Alexa, Google assistant...
Researchers have used programmable low-powered lasers to remotely control voice-activated personal assistants like Apple's Siri, Amazon's Alexa, and Google Assistant from up to 360 feet away. These attacks exploit a vulnerability in microphones using micro-electro-mechanical systems (MEMS), which the researchers have discovered will respond to lasers the same way they will respond to sound. The […]

Read more »

Apple updates its privacy page with sleek new look
A company’s privacy page usually reads like it was written by lawyers—because it usually is. Information is rarely presented in a way that laypeople can understand, and as for making it both easy to consume and easy on the eyes? Forget it. Apple’s new privacy page thinks different. It presents the company’s privacy info in plain […]

Read more »

iPad vs. MacBook: is iPadOS a game changer?
It took Apple more than nine years to recognize that the iPhone and iPad were different enough to warrant separate operating systems: iOS 13 and iPadOS 13. Now, with the changes in the new iPadOS, an iPad could replace a laptop for many people. iPadOS may really be a game changer for mobile computing. But just how effectively can an iPad replace a MacBook?

Read more »

Red Hat Security Advisory 2019-3513-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Read more »

Vulnerability Summary for the Week of October 28, 2019
Original release date: November 4, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- experience_manager   Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. 2019-10-25 7.5 CVE-2019-8088CONFIRM apache -- thrift In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings. 2019-10-29 7.8 CVE-2019-0205MISC bitlbee -- bitlbee   Bitlbee does not drop extra group privileges correctly in unix.c 2019-10-29 7.5 CVE-2012-1187MISCMISCMISCMISC cisco -- video_communications_server   Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands. 2019-10-29 9 CVE-2011-2538CONFIRM codesys -- eni_server   CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. 2019-10-25 7.5 CVE-2019-16265CONFIRMMISC d-link -- dir-865   D-Link DIR-865L has PHP File Inclusion in the router xml file. 2019-10-25 7.5 CVE-2013-4857MISCMISC d-link -- dir-865l_devices   D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 7.9 CVE-2013-4855MISCMISCMISC debian_project -- qtparted   qtparted has insecure library loading which may allow arbitrary code execution 2019-10-29 7.5 CVE-2010-3375DEBIANMISCMISC google -- chrome   browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. 2019-10-25 7.5 CVE-2016-5202MISCMISCMISCMISCMISC hot-world -- repetier-server A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-28 10 CVE-2019-14450CONFIRMMISC hot-world -- repetier-server   RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-25 10 CVE-2019-14451CONFIRMMISC intrasrv -- intrasrv   A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system. 2019-10-28 10 CVE-2019-17181MISCMISC jetbrains -- teamcity In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. 2019-10-31 7.5 CVE-2019-18364CONFIRM k7_computing -- antivirus_premium_and_total_security_and_ultimate_security   In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll module to facilitate escalation of privileges via inter-process communication with a service process. 2019-10-28 7.5 CVE-2019-16897MISC labf -- nfsaxe_ftp_client   Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. 2019-10-25 7.5 CVE-2017-14742EXPLOIT-DB linksys -- ea6500_router   Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 10 CVE-2013-4658MISCMISCMISC medoo -- medoo   columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. 2019-10-30 7.5 CVE-2019-10762MISCMISC mikrotik -- routeros   RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords. 2019-10-29 8.5 CVE-2019-3977MISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. 2019-10-25 7.5 CVE-2016-2356MISCMISCMISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource. 2019-10-25 7.5 CVE-2016-2359MISCMISCMISC mitsubishi_electric_and_inea -- me-rtu_devices An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.) 2019-10-28 10 CVE-2019-14930MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. 2019-10-28 10 CVE-2019-14931MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites. 2019-10-28 7.5 CVE-2019-14926MISCMISC philips -- intellispace_perinatal   In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host application user to break-out from the containment of the application and access unauthorized resources from the Windows operating system as the limited-access Windows user. Due to potential Windows vulnerabilities, it may be possible for additional attack methods to be used to escalate privileges on the operating system. 2019-10-25 7.2 CVE-2019-13546MISC php -- php   In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. 2019-10-28 7.5 CVE-2019-11043REDHATREDHATREDHATREDHATCONFIRMMISCFEDORAFEDORAFEDORACONFIRMCONFIRMUBUNTUUBUNTUDEBIANDEBIAN pixelpost -- pixelpost   pixelpost 1.7.1 has SQL injection 2019-10-28 7.5 CVE-2009-4899MISCDEBIANMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 9 CVE-2019-16663MISCMISCMISCMISCMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 10 CVE-2019-16662MISCMISCMISCMISCMISCMISC rittal -- rittal_chiller_sk_3232_series   Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 ? B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point. 2019-10-25 10 CVE-2019-13553FULLDISCMISC sequelize -- sequelize   Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. 2019-10-29 7.5 CVE-2019-10748MISCMISCMISC sequelize -- sequelize   sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. 2019-10-29 7.5 CVE-2019-10749MISCMISC snoopy -- snoopy e Snoopy before 2.0.0 has a security hole in exec cURL 2019-10-28 7.5 CVE-2002-2444MISCDEBIANMISC sugarcrm -- sugarcrm   SugarCRM CE

Read more »

NCR Barred Mint, QuickBooks from Banking Platform During Acc...
Banking industry giant NCR Corp. [NYSE: NCR] late last month took the unusual step of temporarily blocking third-party financial data aggregators Mint and QuicBooks Online from accessing Digital Insight, an online banking platform used by hundreds of financial institutions. That ban, which came in response to a series of bank account takeovers in which cybercriminals used aggregation sites to surveil and drain consumer accounts, has since been rescinded. But the incident raises fresh questions about the proper role of digital banking platforms in fighting password abuse.

Read more »

Increase your privacy with CyberGhost VPN
If you've followed Intego's blog and podcast for a while, you may recall that we've mentioned the privacy and security benefits of VPNs—virtual private networks—several times. As a quick recap, here are just a handful of the advantages that a good personal VPN can provide: hide your personal IP address from sites you visit, apps […]

Read more »

Back on sale! Apple’s new AirPods Pro $234 at Amazon, $15 ...
Amazon has Apple’s new AirPods Pro on sale and in stock today for $234.99 shipped. Their price is about $15 (6%) off Apple’s MSRP and the cheapest price available for these new models from any Apple reseller. Shipping is free. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Back on sale! Amazon’s Early Holiday sale drops prices on ...
Amazon has new Apple 11″ and 12″ iPad Pros in stock today and on sale again for up to $250 off Apple’s MSRP. These are the same iPad Pros sold by Apple in its retail and online stores, and Amazon is matching their iPad Pro sale from this past weekend. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free: – 11″ 64GB WiFi iPad Pro: $649.99 $150 off – 11″ 256GB WiFi iPad Pro: $799.99 $150 off – 11″ 512GB WiFi iPad Pro: $999.99 $150 off – 11″ 1TB WiFi iPad Pro: $1099.97 $250 off – 11″ 64GB WiFi + Cellular iPad Pro: $799.99 $150 off – 11″ 256GB WiFi + Cellular iPad Pro: $949.99 $150 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $150 off – 11″ 1TB WiFi + Cellular iPad Pro: $1349.99 $150 off – 12.9″ 64GB WiFi iPad Pro: $849.99 $150 off – 12.9″ 256GB WiFi iPad Pro: $949.99 $200 off – 12.9″ 512GB WiFi iPad Pro: $1149.99 $200 off – 12.9″ 1TB WiFi iPad Pro: $1349.99 $200 off – 12.9″ 64GB WiFi + Cellular iPad Pro: $949.99 $200 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1099.99 $200 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1299.99 $200 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1499.99 $200 off Keep an eye on our 11″ iPad Pro Price Tracker and 12.9″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Switch to US Cellular and lease an iPhone Xr for $9.98 per m...
US Cellular is offering the base 64GB iPhone Xr for $9.98/month for new customers. Discounts are applied via monthly bill credit over 30 months and require one new line of service. Total price for the iPhone, after 30 months, is $299. That’s $300 off Apple’s $599 MSRP for the 64GB Xr. US Cellular’s deal is live on their → Read More...

Read more »

13″ 128GB MacBook Airs on sale for $100-$120 off Apple’s...
Focus Camera has new 2019 13″ 128GB MacBook Airs in stock and on sale today for up to $120 off Apple’s MSRP, with prices starting at $979. Shipping is free. Focus charges sales tax for NY & NJ residents only. These are the same MacBook Airs sold by Apple in their retail and online stores: – 13″ 128GB Space Gray MacBook Air: $999 $100 off MSRP – 13″ 128GB Silver MacBook Air: $979.99 $120 off MSRP For the latest prices and deals, see our 13″ MacBook Air → Read More...

Read more »

B&H offers $200 discount on 2019 13″ 2.4GHz 4-Core Ma...
B&H Photo has new 2019 13″ 2.4GHz 4-Core Touch Bar MacBook Pros on sale today for $200 off Apple’s MSRP. B&H is offering free overnight shipping to many addresses in the US. These are the same MacBook Pros sold by Apple in its retail and online stores: – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Space Gray: $1599 $200 off MSRP – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Silver: $1599 $200 off MSRP – 2019 13″ 2.4GHz/512GB 4-Core MacBook Pro Space Gray: $1799 $200 off MSRP – 2019 13″ 2.4GHz/512GB 4-Core MacBook Pro Silver: $1799.99 $200 off MSRP Their prices are currently the lowest available for these models, new, from any Apple reseller. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple has 13″ 2.4GHz MacBook Pros available for $270-$300 ...
Apple has a full line of Certified Refurbished 2019 13″ 2.4GHz 4-Core Touch Bar MacBook Pros available starting at $1529 and up to $300 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 2.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1699 $300 off MSRP – 13″ 2.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1699 $300 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Score a 37% discount on Apple Smart Keyboards for 10″ iPad...
Amazon has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $99.99 shipped. That’s a 37% discount over Apple’s regular MSRP of $159 and the cheapest price for a 10″ Smart Keyboard anywhere. Best Buy also has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $99.99 on their online store. Order online and choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price may vary. Keep an eye on our Apple Smart Keyboard Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Apple has refurbished 2019 13″ 1.4GHz MacBook Pros availab...
Apple has a full line of Certified Refurbished 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros available starting at $1099 and up to $230 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/128GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1269 $230 off MSRP – 13″ 1.4GHz/128GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1269 $230 off MSRP Their prices are the cheapest available for 2019 13″ MacBook Pros anywhere. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

2019 13″ 1.4GHz 4-Core MacBook Pros on sale for $150-$200 ...
Amazon has new 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros on sale for $150-$200 off Apple’s MSRP. These are the same MacBook Pros sold by Apple in its retail and online stores: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1149 $150 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1299.99 $200 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1299.99 $200 off MSRP B&H Photo has new 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros on sale for up to $200 off Apple’s MSRP as well. Overnight shipping is free to many addresses in the US: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1149 $150 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1299.99 $200 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1299.99 $200 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

11″ 64GB Gray WiFi iPad Pro on sale for $674, save $125
Amazon has the 11″ 64GB Gray WiFi iPad Pro on sale today for $674 shipped. Their price is $125 off MSRP for this iPad, and it’s the lowest price available for the 64GB model from any → Read More...

Read more »

2019 15″ MacBook Pros available for up to $420 off MSRP, s...
Apple has a full line of 2019 15″ 6-Core and 8-Core Touch Bar MacBook Pros, Certified Refurbished, available for up to $420 off the cost of new models. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. Apple’s refurbished prices are currently the cheapest available for 2019 15″ MacBook Pros anywhere: – 15″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 $360 off MSRP – 15″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 $360 off MSRP – 15″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 $420 off MSRP – 15″ 2.6GHz 8-Core MacBook Pro (Silver): $2379 $420 off MSRP See our 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

2019 15″ MacBook Pros on sale this week for $200-$300 off ...
Apple resellers B&H Photo and Amazon are offering the new 2019 15″ MacBook Pros for up to $300 off Apple’s MSRP including free shipping. These are the same MacBook Pros sold by Apple in its retail and online stores: B&H Photo: – 2019 15″ 2.6GHz 6-Core MacBook Pro Space Gray: $2099.99 $300 off MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Space Gray: $2499.99 $300 off MSRP – 2019 15″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Silver: $2499.99 $300 off MSRP B&H Photo will include free overnight delivery to many locations in the US. Amazon: – 2019 15″ 2.6GHz 6-Core MacBook Pro Space Gray: $2099.99 $300 off MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Space Gray: $2499.99 $300 off MSRP – 2019 15″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Silver: $2499.99 $300 off MSRP Be sure to select Amazon as the seller rather than a third-party. See our 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »