Ohio House introduces bill to criminalize AirTag stalking
A bill has been submitted to the Ohio House to try and criminalize using electronic tags for tracking people without permission, the latest legislative attempt to curtail AirTag stalking.Apple's AirTag has courted controversy by being an accessible way for some would-be stalkers to keep track of potential victims, despite the various anti-stalking measures built into the device. On Friday, Ohio took a step towards making it illegal to perform AirTag-based stalking.Introduced to the Ohio House, bill HB672 seeks to amend section 2903.211 of the Revised Code to prohibit anyone from "knowingly installing a tracking device or application on another person's property without the other person's consent." The bill is sponsored by Rep. Emilia Strong Sykes (D) and Rep. Tom Patton (R ). Read more...

Read more »

Compared: Pixel Buds Pro versus AirPods 3 & AirPods Pro
Google is now gunning for the AirPods Pro by adding active noise cancelation to the Pixel Buds Pro. Here's how the search company's audio accessories fare compared to Apple's current-gen AirPods lineup.Google's Pixel Buds Pro flanked by the AirPods and AirPods ProDuring its Google I/O developer event, the search giant introduced an update in its Pixel Buds lineup. The Pixel Buds Pro are Google's attempt to take on Apple's AirPods Pro, complete with active noise cancelation, aimed at a primarily Android-based audience. Read more...

Read more »

Apple May Acquire Canoo EV Startup
The Apple Car project has been floundering lately, but one terrific jumpstart may be available. As EV startup Canoo struggles to stay financially afloat, it may be ripe for the Cupertino-based tech giant to acquire. If that’s to offer much help, though, Apple will need to acquire Canoo sooner rather than later. The Plight of EV-Maker Canoo Founded five years ago, Canoo is struggling. During its earnings call last week, the electric vehicle maker announced it may not have the necessary cash to keep operating. While it has secured a fresh round of funding, Canoo also revealed it doubts it will be able to produce as many vehicles in 2022 as it had planned. In its most recent earnings report, Canoo expressed doubt about how much longer it can maintain its operations. Due to the timing of our announced funding, and the 2014 FASB accounting rule, as of the date of this announcement, we are reporting that there is substantial doubt about the Company’s ability to continue as a going concern. At one point in 2020, Apple was in talks to potentially acquire Canoo. That never happened, and sources with knowledge of the matter doubt Apple would want to acquire the struggling company’s technology at this point. Its hardware and software engineers, though, along with developers, could be a different story. Apple Could Acquire Canoo to Develop Talent Throughout the entirety of the Apple Car project, Cupertino has developed the tech and talent it needs, at least in part, by acquiring other related companies. In 2019, Apple bought Drive.ai to gain the engineers and developers it needed for autonomous driving technology. As Bloomberg’s Mark Gurman points out, Apple is unlikely to acquire Canoo for its technology. However, the engineers and developers from the ailing startup could be vital to a project that has lost some of its top talent. It’s brought in others, including top talent from the likes of Ford, Rivian, Tesla, BMW, Mercedes, Volvo, Waymo and others. Nevertheless, it could always benefit from more. One of its recent hires could even be key to brokering a deal between Apple and Canoo. Ulrich Kranz, one of the Apple Car projects top executives, was a co-founder of Canoo and its former CEO. Apple has brought on several other engineers and other staffers formerly from Canoo. As Gurman points out, though, several of Canoo’s top names have already left. If Cupertino wants to maximize such an acquisition, it may need to act quickly.

Read more »

tvOS 16: Here’s what we know so far about new features, supported devices, and more
Worldwide Developers Conference (WWDC) 2022 will start a few weeks from now. On June 6, Apple will likely announce tvOS 16, which will mark the next major release of Apple’s software platform for the Apple TV and HomePod. Head below as we recap all of the latest rumors and expectations for tvOS 16 this year, including new features, release info, and more. more… The post appeared first on 9to5Mac.

Read more »

Grab the Apple Watch Series 7 with up to a $100 discount
If you are looking to buy the Apple Watch Series 7, you are in luck, as  Amazon has certain variants discounted by as much as $100. You can get the 41mm GPS-only Apple Watch Series 7 for just $329 post the discount, while the 44mm model is available for as low as $359. This post […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Passenger's iPhone racks up the miles trapped in a plane seat
An iPhone took an unexpectedly long journey after it was lost on a flight, with the smartphone reportedly making multiple international trips before being returned to its owner.The iPhone, iPad, and other personal devices have become indispensable entertainment, making them ideal travel companions for long flights. However, a thread on a forum tells the tale of an iPhone going on a far longer journey than its owner.The thread on the Australian Frequent Flyer forum starts from May 6, where a user identified as "Rugby" asks if there was a way to contact Qantas' lounge in Sydney, in a bid to track down their partner's iPhone after a journey, reports One Mile at a Time. It was then discovered via the Find My network that the iPhone wasn't in a lounge, but was still on the plane. Read more...

Read more »

Today in Apple history: Apple reinvents the computer store
May 15, 2001: Steve Jobs flips the script on the dreadful experience of computer shopping, unveiling an ambitious plan to open 25 innovative Apple stores across the United States. The first two Apple stores, located at Tysons Corner in McLean, Virginia, and the Glendale Galleria in Glendale, California, are set to open later that week. […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Kuo: USB-C AirPods and other Apple accessories coming alongside iPhone 15
Reports from both Ming-Chi Kuo and Bloomberg over the last week have claimed that Apple could switch the iPhone from Lightning to USB-C for charging as soon as next year. Now, Kuo is doubling down further on this claim and saying that Apple will also transition its other Lightning products, including AirPods, to USB-C on a similar timeline. more… The post appeared first on 9to5Mac.

Read more »

Apple could go all in on USB-C across its product lineup
Apart from iPhones, Apple is looking to switch to USB-C on all its other products with a Lightning connector like the AirPods, Magic Mouse, Magic Keyboard, and more. Reputed Apple analyst believes that the Cupertino company will make the transition in the “foreseeable future.” Apple’s accessory portfolio could switch to USB-C in the future Last […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iOS 16 will have refreshed Apple apps but look the same
Apple's shift to iOS 16 will introduce many major changes to the mobile operating system, a report claims, but it will still apparently look a lot like iOS 15 in terms of design.Apple is preparing to unveil its next generation of operating systems during the WWDC 2022 keynote on June 6, prompting rumors as to what will be unveiled. In speculation ahead of the developer conference, Apple is thought to be gearing up for big changes, but with a familiar appearance."Major changes across the system" will be introduced, according to Mark Gurman in the "Power On" newsletter for Bloomberg. The changes will include "new ways of interacting and some fresh Apple apps," but Gurman stops short in saying what will actually change. Read more...

Read more »

Organize Your Tech Essentials with the Discounted Cocoon Grid-IT! Pouch
Everyone can benefit from a bit of organization, especially for those who are always on the move. If you want a no-fuss and intuitive ... Read more The post appeared first on iLounge.

Read more »

Teaser video of Apple TV+ animated film ‘Luck’ goes online
3D animated film ‘Luck’ recently had a new trailer video on the official Apple TV+ YouTube channel. ‘Luck’ is an Apple TV+ exclusive and ... Read more The post appeared first on iLounge.

Read more »

New Apple TV may launch this year
Ming Chi Kuo, Apple analyst tweeted that Apple might be releasing a new, lower-priced Apple TV device this year. Kuo mentioned in his tweet ... Read more The post appeared first on iLounge.

Read more »

Apple may eventually be moving from iPhone lighting to type C port
Apple may be eventually shifting from a Lightning port to USB-C port for its iPhones, although it may not happen this year. Mark Gurman ... Read more The post appeared first on iLounge.

Read more »

Speedy Mag Wireless Charger for iPhone (White) is 59% Off
iLounge has a special deal on the Speedy Mag Wireless Charger for iPhone, which allows you to get more out of your iPhone and ... Read more The post appeared first on iLounge.

Read more »

OtterBox’s All-in-One MagSafe Charging Station Drops 43 Percent
Eliminate unnecessary clutter and improve your productivity with a multi-charging hub. Today, OtterBox’s 3-in-1 Wireless Charging Station for MagSafe is down to just $45.28 ... Read more The post appeared first on iLounge.

Read more »

Chosen WWDC participants start getting notifications via email
Some developers who sent in their intent to join the 2022 WWDC event at Apple Park are now receiving emails regarding their invitation. Apple ... Read more The post appeared first on iLounge.

Read more »

Apple’s feature piece highlights three App Store developers
Apple has recently published an article detailing three App Store developers and their apps. The Cupertino-based company interviewed Annie, Dawoon Kang and Larry Liu, ... Read more The post appeared first on iLounge.

Read more »

Apple releases Apple TV+ “Cha Cha Real Smooth’ trailer online
Apple has recently uploaded a new trailer video for its upcoming film ‘Cha Cha Real Smooth’. ‘Cha Cha Real Smooth’ is defined as an ... Read more The post appeared first on iLounge.

Read more »

Lunatask Premium Lifetime Subscription is 72% Off
iLounge has a special deal on the Lunatask Premium Lifetime Subscription, which allows you to put all your personal productivity tasks in one handy ... Read more The post appeared first on iLounge.

Read more »

Logitech’s Slim Folio Keyboard for the 10.2 inch iPad is 20% Off
Can’t get enough of Logitech accessories for your Apple products? This deal is for you. Today, you can get an iPad productivity companion with ... Read more The post appeared first on iLounge.

Read more »

Aura Strap 2 adds Apple Watch water balance, muscle and fat measurements
AURA Devices has announced the launch of Aura Strap 2, an Apple Watch strap that augments the smartwatch’s fitness and health capabilities with several ... Read more The post appeared first on iLounge.

Read more »

Oil firm Aramco regains ‘Most Valuable Company’ title from Apple
Apple has lost the top spot in the ‘world’s most valuable company’ to oil giant Aramco. On Wednesday, Apple stock went down to around ... Read more The post appeared first on iLounge.

Read more »

Apple trade-in credit values get a boost until May 31
Apple has recently increased trade-in values on select Apple products in the UK and US. Several Apple Watch, Mac, iPad and iPhone models’ trade ... Read more The post appeared first on iLounge.

Read more »

When the iPhone goes USB-C, other lightning accessories will too says Kuo
Apple's potential move to USB-C will involve more than just the iPhone, says analyst Ming-Chi Kuo, with other accessories expected to make the switch in short order.On May 11, analyst Ming-Chi Kuo said Apple planned to abandon the Lightning connector for the iPhone from 2023, switching instead to a USB-C port. In a follow-up tweet, the analyst signals that other accessories that rely on Lightning will change ports quite quickly too.Posted on Sunday, Kuo offers a continuation of the thinking from a few days prior, about a supply chain survey indicating a move away from Lightning to USB-C in the second half of 2023. Kuo starts by offering that the alternative of a portless iPhone would be difficult for Apple to achieve, "due to the current limitations of wireless technologies & the immature MagSafe system." Read more...

Read more »

This 2TB external hard drive holds all your data for less than $30
Cloud storage is great, but like any technology, it has a time and place. When you want guaranteed storage that doesn’t require an internet connection to access, what you really need is a good external hard drive. This 2TB portable SSD external hard drive keeps your data close and your devices unclogged. And for a […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Daily deals May 15: $800 iPad Pro, $100 Beats Fit Pro, $800 75-inch Toshiba Smart TV, more
Sunday's best deals include $100 off the 11-inch iPad Pro, 1TB of M.2 storage from XPG for $75, a SanDisk wireless charger down to $12.83, and much more.May 15's deals include the iPad Pro, a 75-inch Toshiba smart TV, and Beats Fit Pro. Every day, AppleInsider searches online stores for deals and offers on Apple products, smartphones, smart TVs, appliances, and many other devices and accessories, compiling the best we find into a daily roundup. If an item is out of stock, you could still be able to order it for delivery at a later time. Amazon discounts are generally available for a limited period of time, so act fast if you want something. Read more...

Read more »

Logos define your brand. BuildMyLogo can create one for just $29.99
There’s no more recognizable piece of brand identity than a company logo, but for small businesses, getting it right isn’t easy. These companies often spend anywhere from $300 to $1,300 or more on their logo, which isn’t cheap. The Complete Logo Kit by BuildMyLogo can take the burden of creating or paying to create a logo right off a business owner’s shoulders. Simply enter a brand name and answer a handful of questions. BuildMyLogo uses those details to draft logo options that fit your project. It creates logos in real-time, and you can customize their styles and colors. Once finished, you receive a vector file with different color variations and file options. You can use your creation anywhere and in virtually any size you want, from a t-shirt or hat up to a billboard. BuildMyLogo can even illustrate how your logo would look on various promotional products. Whether you need one logo for a new business or several logos for multiple initiatives, the Complete Logo Kit by BuildMyLogo makes the process ridiculously simple. You can get lifetime access today for $29.99 or 25% off.  The Complete Logo Kit by BuildMyLogo – $29.99 See Deal Prices subject to change

Read more »

macOS Monterey: How to change the cursor color on your Mac
The Mac’s cursor is designed with a white outline and black fill. It’s a good combination, making it easy to spot no matter what is on screen. But man, is it boring. In past versions of macOS, you can’t change the cursor color without using a third-party utility. That changed in macOS Monterey, though. With Monterey, you can easily change the colors of the cursor to something that is easier to catch with your eyes or just add some flair to reflect your personality. You can find it in the Accessibility pane in System Preferences. You can see how it’s done in the video below, or read on for instructions. How to change the cursor color in macOS Monterey Go to System Preferences and click Accessibility.In the left column, look for the Vision section and select Display.Click on the Pointer tab in the section to the right.You’ll find two settings here, Pointer outline color and Pointer fill color. Click the color swatch button next to each setting and the Colors selection palette will appear. Select the colors you want. If you want to revert back to the default white and black, click the Reset button.Close System Preferences.IDG

Read more »

Netflix could follow Apple TV+ in producing live streaming video
Netflix's next move could be into streaming live programming, a feature that Apple TV+ has offered its users for just over a month.As the behemoth of streaming, Netflix is on the lookout for the next potential hit feature to encourage higher subscriptions. After years of shaking up the broadcast industry with on-demand streams, it seems that the streamer may actually go down the live content route.According to Deadline, Netflix is looking into whether to offer live streaming to its users. Netflix has previously confirmed it was in the early stages of creating a live streaming solution, but had yet to announce a formal introduction of live content. Read more...

Read more »

DEA Investigating Breach of Law Enforcement Data Portal
The U.S. Drug Enforcement Administration (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.

Read more »

Requiem for the iPod – Intego Mac Podcast Episode 239
Apple has discontinued the last iPod, the iPod touch. We discuss some of the history of the iPod, and look at 17 reasons who you should use an iPod touch. We also look at the new FIDO initiative, which allows your phone to replace passwords, and we discuss AirTag false alarms. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, May 2022 Edition
Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This month's patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows.

Read more »

Vulnerability Summary for the Week of May 2, 2022
Original release date: May 9, 2022 | Last revised: May 11, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info N/A -- N/A   On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated 2022-05-05 7.5 CVE-2022-1388 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info livehelperchat -- live_helper_chat Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious JS on Application 🙂 2022-04-29 4.3 CVE-2022-1530 MISC CONFIRM mediawiki -- mediawiki The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. 2022-04-29 4.3 CVE-2022-29907 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no low vulnerabilities recorded this week. Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info tecson_and_gok -- multiple_products   In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules. 2022-05-06 not yet calculated CVE-2019-12254 CONFIRM piwigo -- piwigo   SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. 2022-05-06 not yet calculated CVE-2020-19212 MISC piwigo -- piwigo   SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. 2022-05-06 not yet calculated CVE-2020-19213 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. 2022-05-06 not yet calculated CVE-2020-19215 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. 2022-05-06 not yet calculated CVE-2020-19216 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. 2022-05-06 not yet calculated CVE-2020-19217 MISC totolink -- n200re_andn100re_routers   A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element. 2022-05-02 not yet calculated CVE-2020-23617 MISC MISC xtend -- voice_logger   A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page. 2022-05-02 not yet calculated CVE-2020-23618 MISC MISC orlansoft -- erp   The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23620 MISC MISC MISC squire-technologies -- ms_management_system   The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23621 MISC MISC MISC sonicwall -- global_vpn_client   SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system. 2022-05-04 not yet calculated CVE-2021-20051 CONFIRM fuchsia -- multiple_products   The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond. 2022-05-03 not yet calculated CVE-2021-22556 MISC MISC google -- idtoken   The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above 2022-05-03 not yet calculated CVE-2021-22573 MISC multiple_vendors -- multiple_products   NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-22680 CONFIRM topthink -- framework   The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. 2022-05-06 not yet calculated CVE-2021-23592 CONFIRM CONFIRM CONFIRM twelvemonkeys -- twelvemonkeys   The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered. 2022-05-06 not yet calculated CVE-2021-23792 CONFIRM CONFIRM wordpress -- tipsacarrier_wordpress_plugin   The Tipsacarrier WordPress plugin through 1.4.4.2 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL 2022-05-02 not yet calculated CVE-2021-25002 MISC wordpress -- advanced_page_visit_counter_wordpress_plugin   The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it 2022-05-02 not yet calculated CVE-2021-25086 MISC wordpress -- all_in_one_wp_security_&_firewall_wordpress_plugin   The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk 2022-05-02 not yet calculated CVE-2021-25102 MISC sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25267 CONFIRM sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25268 CONFIRM kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25745 MISC MISC kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25746 MISC MISC splunk -- enterprise   A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service. 2022-05-06 not yet calculated CVE-2021-26253 MISC micriumos -- multiple_products   Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones. 2022-05-03 not yet calculated CVE-2021-27411 CONFIRM CONFIRM ecoscentric -- ecospro_rtos   eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. 2022-05-03 not yet calculated CVE-2021-27417 CONFIRM CONFIRM uclibc-ng -- uclibc-ng   uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27419 CONFIRM CONFIRM nxp -- mcuxpresso   NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc. 2022-05-03 not yet calculated CVE-2021-27421 CONFIRM CONFIRM cesanta_software -- mongoose-os   Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27425 CONFIRM CONFIRM riot -- os   RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27427 CONFIRM CONFIRM arm -- cmsis_rtos2   ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution. 2022-05-03 not yet calculated CVE-2021-27431 CONFIRM arm -- mbed-ualloc   ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27433 CONFIRM CONFIRM arm -- mbed-ualloc   ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27435 CONFIRM CONFIRM tencentos-tiny -- tencentos-tiny TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27439 CONFIRM hcl_software -- commerce   HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. 2022-05-06 not yet calculated CVE-2021-27751 CONFIRM hcl_software -- bigfix_inventory   There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. 2022-05-06 not yet calculated CVE-2021-27758 CONFIRM hcl_software -- bigfix_inventory    This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application. 2022-05-06 not yet calculated CVE-2021-27759 CONFIRM hcl_software -- notes   An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code. 2022-05-06 not yet calculated CVE-2021-27760 CONFIRM hcl_software -- weak_tls   Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks 2022-05-06 not yet calculated CVE-2021-27761 CONFIRM hcl_software -- bigfix_platform   Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses 2022-05-06 not yet calculated CVE-2021-27762 CONFIRM hcl_software -- hcl_software   Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) 2022-05-06 not yet calculated CVE-2021-27764 CONFIRM hcl_software -- installshield   The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27765 CONFIRM hcl_software -- bigfix_client_installer   The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27766 CONFIRM hcl_software -- bigfix_console_installer   The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27767 CONFIRM ibm -- maximo_asset_management   IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 205680. 2022-05-03 not yet calculated CVE-2021-29854 CONFIRM XF ibm -- user_management_system_component   IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081. 2022-05-02 not yet calculated CVE-2021-29859 CONFIRM XF splunk -- enterprise_indexer   A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders. 2022-05-06 not yet calculated CVE-2021-31559 MISC cyclos -- cyclos_4_pro   A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter. 2022-05-02 not yet calculated CVE-2021-31673 MISC MISC cyclos -- cyclos_4_pro   Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant. 2022-05-02 not yet calculated CVE-2021-31674 MISC MISC secomea -- multiple_products   Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to 9.7. 2022-05-04 not yet calculated CVE-2021-32010 MISC splunk -- enterprise   The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. 2022-05-06 not yet calculated CVE-2021-33845 MISC MISC red_hat -- sox   A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. 2022-05-02 not yet calculated CVE-2021-3643 MISC suse -- rancher   A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3. 2022-05-02 not yet calculated CVE-2021-36778 CONFIRM suse -- rancher   A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4. 2022-05-02 not yet calculated CVE-2021-36784 CONFIRM wordpress -- mythemeshop_wp_subscribe_plugin   Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin

Read more »

Your Phone May Soon Replace Many of Your Passwords
Apple, Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.

Read more »

Apple AirTags: One Year On – Intego Mac Podcast Episode 238
Apple has provided some clarification to its plan to remove old and in the way apps from the App Store. Microsoft has been working on a VPN that isn't a VPN it works a little differently from Apple's VPN that isn't a VPN. And it's been a year since Apple released AirTags... It hasn't exactly been smooth sailing, but if third-party accessories are an indication, AirTags are doing pretty well. The post appeared first on The Mac Security Blog.

Read more »

Russia to Rent Tech-Savvy Prisoners to Corporate IT?
Faced with a brain drain of smart people fleeing the country following its invasion of Ukraine, the Russian Federation is floating a new strategy to address a worsening shortage of qualified information technology experts: Forcing tech-savvy people within the nation's prison population to perform low-cost IT work for domestic companies.

Read more »

17 Reasons Why You Should Use an iPod touch in 2022
You may think the iPod touch is an out-of-date technology, but there are lots of reasons why you might want to use one. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of April 25, 2022
Original release date: May 2, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info jfinalcms_project -- jfinalcms JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function. 2022-04-22 7.5 CVE-2022-27341 MISC link-admin_project -- link-admin Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult(). 2022-04-22 7.5 CVE-2022-27342 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 209399. 2022-04-22 6.8 CVE-2021-38886 XF CONFIRM pimcore -- pimcore SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data 2022-04-22 5 CVE-2022-1429 MISC CONFIRM ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow a remote attacker to obtain credentials from a user's browser via incorrect autocomplete settings. IBM X-Force ID: 209693. 2022-04-22 4.3 CVE-2021-38904 XF CONFIRM microweber -- microweber Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction. 2022-04-22 4.3 CVE-2022-1439 CONFIRM MISC crypt-server_project -- crypt-server Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial, computername, and username. 2022-04-22 4.3 CVE-2022-29589 MISC MISC ibm -- cognos_analytics IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813. 2022-04-22 4 CVE-2021-20464 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to priviledge escalation where a lower level user could have read access to to the 'Data Connections' page to which they don't have access. IBM X-Force ID: 204468. 2022-04-22 4 CVE-2021-29824 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 could allow an authenticated user to view report pages that they should not have access to. IBM X-Force ID: 209697. 2022-04-22 4 CVE-2021-38905 XF CONFIRM Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 209691. 2022-04-22 3.5 CVE-2021-38903 CONFIRM XF ibm -- cognos_analytics IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 211240. 2022-04-22 3.5 CVE-2021-38946 CONFIRM XF Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info artifex -- ghostscript   Artifex Ghostscript through 9.26 mishandles .completefont. NOTE: this issue exists because of an incomplete fix for CVE-2019-3839. 2022-04-25 not yet calculated CVE-2019-25059 MISC MLIST wordpress -- dw_question_&_answer_pro_wordpress_plugin   The DW Question & Answer Pro WordPress plugin through 1.3.4 does not check that the comment to edit belongs to the user making the request, allowing any user to edit other comments. 2022-04-25 not yet calculated CVE-2021-24800 MISC wordpress -- dw_question_&_answer_pro_wordpress_plugin   The DW Question & Answer Pro WordPress plugin through 1.3.4 does not properly check for CSRF in some of its functions, allowing attackers to make logged in users perform unwanted actions, such as update a comment or a question status. 2022-04-25 not yet calculated CVE-2021-24805 MISC wordpress -- advanced_page_visit_counter_wordpress_plugin   The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not escape the artID parameter before using it in a SQL statement in the apvc_reset_count_art AJAX action, available to any authenticated user, leading to a SQL injection 2022-04-25 not yet calculated CVE-2021-24957 MISC wordpress -- tatsu_wordpress_plugin   The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker. 2022-04-25 not yet calculated CVE-2021-25094 MISC MISC wordpress-- english_wordpress_admin_wordpress_plugin   The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue 2022-04-25 not yet calculated CVE-2021-25111 MISC sophos -- authenticator_for_android   An insecure data storage vulnerability allows a physical attacker with root privileges to retrieve TOTP secret keys from unlocked phones in Sophos Authenticator for Android version 3.4 and older, and Intercept X for Mobile (Android) before version 9.7.3495. 2022-04-27 not yet calculated CVE-2021-25266 CONFIRM maxboard -- maxboard   Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files. 2022-04-26 not yet calculated CVE-2021-26628 MISC tobesoft -- xplatform A path traversal vulnerability in XPLATFORM's runtime archive function could lead to arbitrary file creation. When the .xzip archive file is decompressed, an arbitrary file can be d in the parent path by using the path traversal pattern ‘..’. 2022-04-26 not yet calculated CVE-2021-26629 MISC ibm -- qradar_siem   IBM QRadar SIEM 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information from another user's dashboard providing the dashboard ID of that user. IBM X-Force ID: 203030. 2022-04-27 not yet calculated CVE-2021-29776 CONFIRM XF nomachine -- nomachine_for_windows   NoMachine for Windows prior to version 6.15.1 and 7.5.2 suffer from local privilege escalation due to the lack of safe DLL loading. This vulnerability allows local non-privileged users to perform DLL Hijacking via any writable directory listed under the system path and ultimately execute code as NT AUTHORITYSYSTEM. 2022-04-28 not yet calculated CVE-2021-33436 MISC MISC MISC MISC bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions a long URL could lead to webserver crash. The URL is used as input of an sprintf to a stack variable. 2022-04-27 not yet calculated CVE-2021-34587 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to unprotected data export. Backup export is protected via a random key. The key is set at user login. It is empty after reboot . 2022-04-27 not yet calculated CVE-2021-34588 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface. 2022-04-27 not yet calculated CVE-2021-34589 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Cross-site Scripting. An authenticated attacker could write HTML Code into configuration values. These values are not properly escaped when displayed. 2022-04-27 not yet calculated CVE-2021-34590 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Local privilege Escalation. An authenticated attacker could get root access via the suid applications socat, ip udhcpc and ifplugd. 2022-04-27 not yet calculated CVE-2021-34591 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields. 2022-04-27 not yet calculated CVE-2021-34592 CONFIRM bender/ebee -- cc612   In Bender/ebee Charge Controllers in multiple versions are prone to Hardcoded Credentials. Bender charge controller CC612 in version 5.20.1 and below is prone to hardcoded ssh credentials. An attacker may use the password to gain administrative access to the web-UI. 2022-04-27 not yet calculated CVE-2021-34601 CONFIRM bender/ebee -- charge_controllers   In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges. 2022-04-27 not yet calculated CVE-2021-34602 CONFIRM 3scale -- apicast   A flaw was found in 3Scale APICast in versions prior to 2.11.0, where it incorrectly identified connections for reuse. This flaw allows an attacker to bypass security restrictions for an API request when hosting multiple APIs on the same IP address. 2022-04-27 not yet calculated CVE-2021-3523 MISC solarwinds -- serv-u   A researcher reported a Directory Transversal Vulnerability in Serv-U 15.3. This may allow access to files relating to the Serv-U installation and server files. This issue has been resolved in Serv-U 15.3 Hotfix 1. 2022-04-25 not yet calculated CVE-2021-35250 MISC MISC metasys -- ads/adx/oas   Under certain circumstances improper privilege management in Metasys ADS/ADX/OAS servers versions 10 and 11 could allow an authenticated user to elevate their privileges to administrator. 2022-04-29 not yet calculated CVE-2021-36207 CERT CONFIRM veryfixpro -- veryfixpro   VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless. 2022-04-25 not yet calculated CVE-2021-36460 MISC MISC MISC wordpress --alexander_ustimenko's_psychological_tests_&_quizzes_plugin   Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin add a new subscription, update subscription, delete Subscription. 2022-04-29 not yet calculated CVE-2022-29414 CONFIRM CONFIRM wordpress -- ravpage_plugin   Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin

Read more »

You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a parent/guardian) to request removal of their images from Google search results.

Read more »

Apple’s AirTags: One Year On
It's been one year since Apple's AirTags were released; it’s time to take stock. How efficient have they been? What problems have they caused? The post appeared first on The Mac Security Blog.

Read more »

Mac Studio with M1 Max CPU in stock and on sale today for $1899, $100 off Apple’s MSRP
Apple reseller Simply Mac has the new Mac Studio with M1 Max CPU (10-Core CPU) in stock and on sale for $1899.99 including free shipping. Their price is $100 off Apple's MSRP, and it's the lowest price available for a Mac Studio this weekend from any Apple reseller. For the latest prices and sales, see our Mac Studio Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

In stock: Open-box 16″ M1 Pro MacBook Pros for $350-$450 off MSRP
Having trouble finding a 16" M1 Pro MacBook Pro to buy? QuickShip Electronics has open-box return 16" M1 Pro MacBook Pros in stock and on sale for $350-$450 off MSRP on their eBay store right now, each with free express delivery. According to QuickShip, "The item in this listing is an Open Box (packaging maybe slightly distressed). The unit powers on with factory settings restored and includes the original accessories." The following standard-configuration models are available... The post first appeared on MacPrices.net.

Read more »

Apple Watch SE models are on sale today for up to $50 off MSRP, starting at $229
Amazon has Apple Watch SE GPS models on sale today for $50 off MSRP including free shipping. Their prices are the lowest currently available for SE Watches: (1) 40mm Apple Watch SE: $229, save $50, (2) 44mm Apple Watch SE: $259, save $50. Note that their sale prices may be restricted to certain band colors, and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Switch to Red Pocket Mobile and get an Apple iPhone SE for $100 off plus free 6 months of Unlimited nationwide service
Switch to Red Pocket Mobile and get an Apple iPhone SE for $100 off MSRP, plus get free 6 months of Unlimited nationwide service with the purchase of any iPhone. Red Pocket Mobile is a nationwide service using all the major wireless carrier networks and offers 50GB plans for $50 per month, no contract required, and cheaper plans starting at $20/month for 3GB of 5G data. They're currently offering the iPhone SE for $100 off MSRP (either all upfront or via 24-months of payments), with prices starting at $329 for 64GB of storage. Keep an eye on our iPhone Price Tracker for the latest prices & deals on iPhones and plans from Apple and its carriers, updated daily. The post first appeared on MacPrices.net.

Read more »

8.3″ WiFi iPad minis are in stock today and on sale for $90-$100 off Apple’s MSRP
Amazon is offering sale prices on Apple's 8.3" WiFi iPad minis ranging up to $100 off MSRP, depending on configuration. Prices start at $409. Most models are in stock today with free shipping. Amazon's prices are the lowest currently available for minis from any Apple reseller we track... The post first appeared on MacPrices.net.

Read more »

Last call: New 32GB iPod touch for $189 at these Apple resellers, $10 off MSRP
Apple discontinued the iPod touch this week, marking the end of the iPod brand at Apple. They are quickly selling out at resellers. Looking to purchase one while you can? The following iPods are in stock today. It's the last call if you want a new iPod from an Apple reseller at a discounted price... The post first appeared on MacPrices.net.

Read more »

Apple Discontinues iPod touch, Promotes Company’s Other Products As Means Of Listening To Music Digitally
NEWS: 05.12.22 – The “gadget of the century” is history. The iPod touch — the only model of the iPod that is still sold — is no more. The device is being discontinued by Apple in favor of listening to music on its other products via Apple Music, the company’s subscription-based music streaming service. Along with access to more than 90 million songs and over […] The post first appeared on MacPrices.net.

Read more »

New low price: Apple AirPods Max headphones for $448, $101 off MSRP
B&H Photo has Space Gray Apple AirPods Max headphones on sale for $448.88 including free 1-2 day shipping to most US addresses. Their price is $100.12 off Apple's MSRP, and it's the lowest price we've ever seen for AirPods Max headphones. See our Apple AirPod Price Tracker for the latest prices and deals from Apple and its resellers. The post first appeared on MacPrices.net.

Read more »

Apple is offering increased trade-in values on devices through May 31st
Get up to $2010 on the purchase of new or refurbished products at Apple using their official Trade In program. Trade in your old iPhone, iPad, Mac, Apple Watch, or Android phone, and Apple will apply its appraised value toward the purchase of a new product. According to Apple, "Answer a few questions to find out your device’s trade-in value. Then give us your device and we’ll put the value on an Apple gift card (or e-credit) you can use anytime. If it’s ready to recycle, we’ll do it for free. Trading in your device is as easy as buying a new one. We’ll give you a prepaid trade-in kit or shipping label to send it off. Or you can bring it to an Apple Store. We’ll either give you instant credit toward the purchase of a new product or send your device on to our recyclers." From now through May 31, customers can earn extra trade-in credit towards a new Apple device when trading in an eligible iPhone, iPad, Mac or Apple Watch. Current trade in values, at the time of this post, are as follows... The post first appeared on MacPrices.net.

Read more »

New Sale at Expercom: $75 off 13″ M1 MacBook Airs plus $30 off AppleCare+ through May 16th
Apple reseller Expercom has 2020 13" M1 MacBook Airs with 256GB of SSD storage on sale for $75 off Apple's MSRP with prices starting at $924. In addition to their MacBook Air sale prices, take $30 off AppleCare+ when purchased along with the MacBook Air ($169, regularly $199): 2020 13" MacBook Air (all colors) M1 8-Core CPU/7-Core GPU/256GB SSD: $924 $75 off MSRP + optional $169 AppleCare+ ($30 off). Offers are valid until May 16th. Discounts are also available on various build-to-order options. Most configurations are in stock today with free shipping. For the latest prices & sales, keep an eye on our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

New Sale at Expercom: $75 off 13″ M1 MacBook Airs plus $30 off AppleCare+ through May 16th
Apple reseller Expercom has 2020 13" M1 MacBook Airs with 256GB of SSD storage on sale for $75 off Apple's MSRP with prices starting at $924. In addition to their MacBook Air sale prices, take $30 off AppleCare+ when purchased along with the MacBook Air ($169, regularly $199): 2020 13" MacBook Air (all colors) M1 8-Core CPU/7-Core GPU/256GB SSD: $924 $75 off MSRP + optional $169 AppleCare+ ($30 off). Offers are valid until May 16th. Discounts are also available on various build-to-order options. Most configurations are in stock today with free shipping. For the latest prices & sales, keep an eye on our 13" MacBook Air Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Week’s Best Deals: $849 13″ MacBook Airs are back in stock at Apple
Apple has restocked 13" M1 MacBook Airs, Certified Refurbished, starting at only $849 for 8-Core CPU/7-Core GPU/256GB models and $1059 for 8-Core CPU/8-Core GPU/512GB models. These are the cheapest M1-powered MacBooks for sale today at Apple and also the best deal on MacBooks available anywhere. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell... The post first appeared on MacPrices.net.

Read more »