Apple TV+ 'Central Park' cast and producers appear in Comic-Con panel
Producers and stars of the Apple TV animated series "Central Park" have spoken at the virtual edition of the annual Comic-Con event, to talk about how the show was created.Streamed and uploaded to YouTube as part of the Comic-Con@Home 2021 initiative, the virtual panel consisted of six people, including both producers and voices behind the hit show."Central Park" co-creator and executive producer Loren Bouchard was joined by fellow co-creator, executive producer, and voice of "Birdie" Josh Gad. They were accompanied on the digital stage by Leslie Odom Jr, who plays "Owen Tillerman," Tituss Burgess who voices "Cole Tillerman," and producers Kelvin Yu and Steven Davis. Read more...

Read more »

WhatsApp CEO takes issues with NSO's denials on iPhone Pegasus hacks
WhatsApp chief Will Cathcart has problems with the NSO Group taking no responsibility for surveillance and hacking of journalist and activist iPhones and other devices.Following the discovery that the Pegasus spyware by NSO Group was being used to surveil high-level journalists, campaigners, and world leaders, NSO took steps to quieten the story. On July 23, NSO CEO Shalev Hulio claimed it couldn't control what governments ultimately did with its tools, which were allegedly intended to catch serious criminals and terrorists.However, speaking to the Guardian, WhatsApp head Will Cathcart suggested the leaked list of more than 50,000 phone numbers believed to be people of interest of NSO clients may be genuine. Cathcart also believes it matches up to WhatsApp's own investigation in 2019, seemingly proving it has been going on for a number of years. Read more...

Read more »

WhatsApp for iOS adds multi-device compatibility for some beta users
Two weeks after WABetaInfo discovered that multi-device compatibility for WhatsApp was coming, the platform is now releasing version 2.21.150.11 with this feature enabled for some beta testers of the app. more… The post appeared first on 9to5Mac.

Read more »

How to run Shortcuts on macOS Monterey
Shortcuts are the fastest way to get a lot done on macOS Monterey, but at first there's little to tell you how to actually run them. Here are all the ways to launch a Shortcut fast.Shortcuts on macOS MontereyEven if you've never used a Shortcut on iOS, you've heard of them, and you're quite possibly weary of people saying how great they'll be on the Mac. When you have macOS Monterey, then, it's likely that you're at least going to give them a go. Read more...

Read more »

Poll: What feature of the rumored new iPad mini are you most excited about?
The rumored new iPad mini is expected to be unveiled by Apple in the second half of 2021. Of all the features rumored to be coming with this overhaul, what’s the one are you most excited about? more… The post appeared first on 9to5Mac.

Read more »

Ted Lasso is back! [Cult of Mac Magazine 411]
Ted Lasso’s second season brings more of the aw-shucks charm and positivity that made the show the biggest hit on Apple TV+. I didn’t find the show’s concept — a cornball U.S. football coach gets hired to lead a U.K. soccer squad — all that intriguing when the show debuted last year. But Ted Lasso’s […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Best deals for July 24 – Nanoleaf Shapes starter kits, standing desk, TP-Link Router
Saturday's best deals include money off two starter sets for the HomeKit-compatible Nanoleaf Shapes, and $170 off a standing desk for your Mac.Best deals for Saturday July 24Shopping online for the best discounts and deals can be a difficult and annoying task. Rather than sifting through miles of advertisements, check out this list of sales we've hand-picked just for the AppleInsider audience. Read more...

Read more »

Today in Apple history: Mighty Mouse goes wireless — with lasers!
July 24, 2006: The world gets it first glimpse of Apple’s new wireless Mighty Mouse, a multibutton Bluetooth device with super-accurate laser tracking. Photos of the accessory come to light through an Apple filing with the Federal Communications Commission. Apple launches the device the very next day. The wireless Mighty Mouse came a year after […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Deutsche Telekom's incubator seeks iOS AR app developers
Deutsche Telekom's tech incubator Hubraum is opening itself up to iOS developers working on augmented reality applications, a program that includes development support from Apple.Promoted by Oscar Falmer, previously an AR evangelist for Apple, the Hubraum iOS Innovation Program calls out for iOS developers to pitch their AR apps that can be "boosted by Deutsche Telekom's technologies including 5G and Low Latency Edge Computing," as well as early access to consumers.Hubraum is looking for experienced iOS developers who feel they may benefit from access to the incubator and "development support directly from Apple." The project is also especially interested in iOS apps for mass-market consumers. Read more...

Read more »

Apple MagSafe Battery Pack Review: Great, but controversial
Apple's MagSafe Battery Pack for iPhone 12 is mired in controversy over its capacity and price. After using it for a while, it has become one of our go-to accessories.Unintended as a way to extend your battery for days, Apple's MagSafe Battery Pack is the ideal solution when you need those crucial extra few hours or have to get through that long weekend. Assuming you have your expectations in line with Apple's design, the MagSafe Battery Pack is the best you can do.Design and build Read more...

Read more »

T-Mobile Test Drive
Have You Heard Of T-Mobile's Test Drive? Through the Network Test Drive app on iOS, you can test the T-Mobile network for free for up to 30 days or 30GB of LTE data, whichever comes first. You won’t leave your current carrier and you won’t lose your existing phone number. Listen to the video below and learn more here

Read more »

Learn how you can become a professional photographer
Anyone can snap a picture on their phone, but learning to become a photographer requires dedication and practice. It’s not just learning how to take a good picture, but what a good picture is for different purposes. Taking photos for a wedding is different from capturing a landscape, which is different from travel photography, and […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple @ Work: iPadOS 15 gives the iPad a brighter future in the workplace
Apple @ Work is brought to you by Mosyle, the leader in modern mobile device management (MDM) and security for Apple enterprise and education customers. Over 22,000 organizations leverage Mosyle solutions to automate the management and security of millions of Apple devices daily. Request a FREE account today and discover how you can put your Apple fleet on auto-pilot at a price point that is hard to believe. I’ve been using iPads in the workplace since the release of the very first one. I managed iPads when the iPhone Configuration Utility was the only way to set them up for schools and businesses. I’ve used every major version of Apple Configurator to deploy iPads. I am very aware of where the iPad falls apart as a daily driver and where it falls apart. After spending a long weekend with just an iPad running iPadOS 15, my hopes are renewed for the device and multitasking. more… The post appeared first on 9to5Mac.

Read more »

DuckDuckGO takes on Apple’s Mail Privacy Protection with its own feature
DuckDuckGo announced earlier this week that the app is launching its new Email Protection feature into beta. This function will protect email privacy without switching email services. more… The post appeared first on 9to5Mac.

Read more »

T-Mobile launching Apple AR Innovation program with Hubraum
While Apple’s AR Glasses are still at least one year away from being unveiled, the company is still looking for other Augmented Reality applications. Cupertino Company is teaming up with T-Mobile for an AR Innovation program with hubraum, a Deutsch tech incubator from the US carrier. more… The post appeared first on 9to5Mac.

Read more »

Did Apple leak the M1 16-inch MacBook Pro? — This Week in Apple
For the latest "This Week in Apple," we examine Apple's supposed mistaken leak of the M1 16-inch MacBook Pro, the release of iOS 14.7, rumors around the iPhone 13, and more.Stay up to date on the last seven days of AppleEach week, AppleInsider posts tons of stories about Apple, its products, rumors, and information about related vendors and other firms. Our weekend video series "This Week in Apple" condenses down the week's stories into an easy-to-digest video recap. Read more...

Read more »

AirTag helps in finding NY User’s wallet
Apple’s AirTags has played a large role in finding a lost wallet in the busy NYC subway. Brooklyn resident William Liu reported a lost ... Read more The post appeared first on iLounge.

Read more »

Slidepad Mac App is 30% Off
iLounge has a special deal on the Slidepad Mac App, which allows you to get the Slide-In/Out feature to your Mac. If you’ve been ... Read more The post appeared first on iLounge.

Read more »

Get Apple’s latest streaming box Apple TV 4K at $19 Off
The Apple TV 4K is an essential companion for TV owners. Today, you can get the 2021 Apple TV 4K 64GB model for just ... Read more The post appeared first on iLounge.

Read more »

Apple releases new beta firmware for AirPods Pro
The Apple Developer Program platform has recently gained a new addition in the form of a beta firmware update for the AirPods Pro. Developers ... Read more The post appeared first on iLounge.

Read more »

Aqara HomeKit accessories launch on Apple online Europe
Apple has recently announced that select Aqara products are now available to buy on several Apple Store online regions, including the UK, Spain, Italy, ... Read more The post appeared first on iLounge.

Read more »

Ucam Private Home Security Camera is 21% Off
iLounge has a special deal on the Ucam Private Home Security Camera, which allows you to have a digital eye trained on your home ... Read more The post appeared first on iLounge.

Read more »

The M1 powered iPad Pro is $100 off today
The latest iPad Pro is a marvel in engineering and made for everyday use. Today, you can buy the 128GB Wi-Fi for just $999, ... Read more The post appeared first on iLounge.

Read more »

LG Stores in South Korea to accommodate iPhones in August
Rumors are circulating that LG in South Korea is planning to display iPhones in its physical stores come August this year. Apple and LG ... Read more The post appeared first on iLounge.

Read more »

Mir payment cards in Russia get Apple Pay
The Apple Pay service is slowly rolling out to the whole of Russia, with the latest being Mir card support. Five years after Apple ... Read more The post appeared first on iLounge.

Read more »

I tried to love the Touch Bar but now I’m ready for it to go away
Five years ago this fall, Apple introduced a new MacBook Pro. But this wasn’t your ordinary spec-bump, this MacBook Pro featured a love-it or hate-it feature: the Touch Bar, Apple’s answer to touchscreen interfaces that became popular in Windows laptops. The OLED strip replaced the top row of keys on the MacBook Pro keyboard, and the […]

Read more »

Apple Watch ECG arrives in 30 regions
Apple’s promise to bring its ECG feature for the Apple Watch to the world is slowly coming to fruition, with watchOS 7.6 being released ... Read more The post appeared first on iLounge.

Read more »

Radacat C2 Messenger is 20% off
iLounge has a special deal on the Radacat C2 Messenger, which allows you to SOS and send and receive SMS to other Radacat users ... Read more The post appeared first on iLounge.

Read more »

The iPad Air 256GB Wi-Fi enjoys a $110 discount
Need a laptop replacement that’s light and portable? You’ve got to try the latest iPad Air. Today, the 256GB Wi-Fi model is down to ... Read more The post appeared first on iLounge.

Read more »

macOS Mojave and Catalina get Safari update
Apple today has released an update for its Safari browser on the macOS Mojave and macOS Catalina. The new Safari web browser update does ... Read more The post appeared first on iLounge.

Read more »

Pegasus Spyware Hacks iPhones of Prominent Individuals
Tens of thousands of phones are known to have been infected by Pegasus, spyware that can take control of a phone and its data. The post appeared first on The Mac Security Blog.

Read more »

Prepare for the End of 3G Networks – Intego Mac Podcast Episode 197
Apple has released security updates for all its operating systems. We discuss the new disclosures about Pegasus spyware, and Apple's response. And we look at what will happen when mobile phone carriers shut down their 3G networks; you may have 3G devices that you don't think about. And Josh has a new laptop; finally. The post appeared first on The Mac Security Blog.

Read more »

Apple releases iOS 14.7, watchOS 7.6, macOS 11.5, and more
Apple has released security updates for all of its operating systems this week. Here's what's new. The post appeared first on The Mac Security Blog.

Read more »

Serial Swatter Who Caused Death Gets Five Years in Prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that lead to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.

Read more »

Red Hat Security Advisory 2021-2813-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Issues addressed include a buffer overflow vulnerability.

Read more »

Spam Kingpin Peter Levashov Gets Time Served
A federal judge in Connecticut today handed down a sentence of time served to spam kingpin Peter “Severa” Levashov, a prolific purveyor of malicious and junk email, and the creator of malware strains that infected millions of Microsoft computers globally. Levashov has been in federal custody since his extradition to the United States and guilty plea in 2018, and was facing up to 12 more years in prison. Instead, he will go free under three years of supervised release and a possible fine.

Read more »

Don’t Wanna Pay Ransom Gangs? Test Your Backups.
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they'd had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even when they have done nearly everything right from a data backup perspective. 

Read more »

Vulnerability Summary for the Week of July 12, 2021
Original release date: July 19, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info echobh -- sharecare Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data. 2021-07-13 7.5 CVE-2021-33578 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection. 2021-07-13 7.5 CVE-2021-36124 MISC espruino -- espruino Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22884 MISC fortinet -- forticlient An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase. 2021-07-12 7.2 CVE-2021-26089 CONFIRM fortinet -- fortimail A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification. 2021-07-09 7.5 CVE-2021-24020 CONFIRM fortinet -- fortimail Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. 2021-07-09 7.5 CVE-2021-24007 CONFIRM golang -- go golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script. 2021-07-09 7.5 CVE-2012-2666 MISC MISC MISC MISC google -- android In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181346550 2021-07-14 7.8 CVE-2021-0596 MISC google -- android In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.1 Android-9Android ID: A-154319182 2021-07-14 7.2 CVE-2020-0417 MISC google -- android In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187161771 2021-07-14 7.2 CVE-2021-0577 MISC google -- android In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-167389063 2021-07-14 10 CVE-2021-0515 MISC google -- android In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-184963385 2021-07-14 7.2 CVE-2021-0585 MISC google -- android In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176445224 2021-07-14 7.9 CVE-2021-0594 MISC google -- android In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-185259758 2021-07-14 7.2 CVE-2021-0587 MISC google -- android In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180939982 2021-07-14 7.2 CVE-2021-0589 MISC google -- android In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-188061006 2021-07-14 9.3 CVE-2021-0592 MISC google -- android In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9 Android-11 Android-8.1Android ID: A-162604069 2021-07-14 9.3 CVE-2021-0514 MISC google -- android In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-177573895 2021-07-14 7.2 CVE-2021-0602 MISC halo -- halo Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. 2021-07-12 7.5 CVE-2020-18980 MISC jsish -- jsish Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22875 MISC MISC jsish -- jsish Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22874 MISC MISC jsish -- jsish Buffer overflow vulnerability in function NumberToPrecisionCmd in jsish before 3.0.7, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22873 MISC kaseya -- vsa Kaseya VSA before 9.5.5 allows remote code execution. 2021-07-09 7.5 CVE-2021-30118 MISC kramerav -- viaware KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg. 2021-07-12 7.5 CVE-2021-35064 MISC linux -- linux_kernel An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 2021-07-09 7.2 CVE-2021-3612 MISC MISC linuxptp_project -- linuxptp A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1. 2021-07-09 8 CVE-2021-3570 MISC DEBIAN FEDORA FEDORA metinfo -- metinfo SQL Injection vulnerability in Metinfo 7.0.0beta in index.php. 2021-07-12 7.5 CVE-2020-21132 MISC MISC metinfo -- metinfo SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid. 2021-07-12 7.5 CVE-2020-21133 MISC MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-34473. 2021-07-14 7.5 CVE-2021-31206 MISC microsoft -- windows_10 Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-34514. 2021-07-14 7.2 CVE-2021-33771 MISC microsoft -- windows_10 Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability 2021-07-14 7.5 CVE-2021-33757 MISC microsoft -- windows_10 Windows Secure Kernel Mode Security Feature Bypass Vulnerability 2021-07-14 7.2 CVE-2021-33744 MISC microsoft -- windows_10 Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33771, CVE-2021-34514. 2021-07-14 7.2 CVE-2021-31979 MISC microsoft -- windows_10 Windows Media Remote Code Execution Vulnerability 2021-07-14 9.3 CVE-2021-33740 MISC nextcloud -- nextcloud_server Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading. 2021-07-12 7.5 CVE-2021-32688 MISC CONFIRM MISC nextcloud -- nextcloud_server Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. 2021-07-12 7.5 CVE-2021-32726 MISC MISC CONFIRM ninjateam -- filebird The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user. 2021-07-12 7.5 CVE-2021-24385 CONFIRM MISC putil-merge_project -- putil-merge Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution. 2021-07-14 7.5 CVE-2021-25953 MISC python -- pillow Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. 2021-07-13 7.5 CVE-2021-34552 MISC MISC qualcomm -- apq8009w_firmware Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables 2021-07-13 10 CVE-2020-11307 CONFIRM qualcomm -- apq8017_firmware Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1890 CONFIRM qualcomm -- apq8017_firmware Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1886 CONFIRM qualcomm -- apq8017_firmware Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1889 CONFIRM qualcomm -- apq8017_firmware Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1888 CONFIRM qualcomm -- aqt1000_firmware Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music 2021-07-13 7.2 CVE-2021-1931 CONFIRM qualcomm -- aqt1000_firmware Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1940 CONFIRM qualcomm -- aqt1000_firmware Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking 2021-07-13 10 CVE-2021-1965 CONFIRM sap -- netweaver_as_abap A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable. 2021-07-14 7.5 CVE-2021-33678 MISC MISC solarwinds -- dameware_mini_remote_control In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. 2021-07-13 9.4 CVE-2021-31217 MISC MISC totaljs -- total.js The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. 2021-07-12 7.5 CVE-2021-23389 MISC MISC MISC totaljs -- total4 The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. 2021-07-12 7.5 CVE-2021-23390 MISC MISC MISC wms_project -- wms SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php". 2021-07-12 7.5 CVE-2020-18544 MISC wpdevart -- poll,_survey,_questionnaire_and_voting_system The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks 2021-07-12 7.5 CVE-2021-24442 CONFIRM MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- ant When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. 2021-07-14 4.3 CVE-2021-36373 MISC MISC MLIST MLIST MLIST apache -- ant When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. 2021-07-14 4.3 CVE-2021-36374 MISC MISC MLIST MLIST MLIST apache -- tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding. 2021-07-12 5 CVE-2021-33037 MISC apache -- tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64. 2021-07-12 5 CVE-2021-30639 MISC MLIST MLIST artifex -- mujs Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of service. 2021-07-13 5 CVE-2020-22886 MISC artifex -- mujs Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service. 2021-07-13 5 CVE-2020-22885 MISC autodesk -- design_review A maliciously crafted PDF, PICT or TIFF file can be used to write beyond the allocated buffer while parsing PDF, PICT or TIFF files in Autodesk 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27036 MISC autodesk -- design_review A maliciously crafted TIFF file in Autodesk 2018, 2017, 2013, 2012, 2011 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27039 MISC autodesk -- design_review A Type Confusion vulnerability in Autodesk 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. An attacker can leverage this to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27038 MISC autodesk -- design_review A maliciously crafted PNG, PDF or DWF file in Autodesk 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability can be exploited by remote attackers to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27037 MISC autodesk -- design_review A heap-based buffer overflow could occur while parsing PICT or TIFF files in Autodesk 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27034 MISC autodesk -- design_review A maliciously crafted TIFF, PDF, PICT or DWF files in Autodesk 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PDF, PICT or DWF files. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27035 MISC axiosys -- bento4 A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19719 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19722 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19720 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19718 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19717 MISC axiosys -- bento4 A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac, leading to system crashes and a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19721 MISC baidu -- umeditor Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. 2021-07-14 4.3 CVE-2020-18145 MISC bookingcore -- booking_core The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed. 2021-07-14 6.8 CVE-2020-25445 MISC bookingcore -- booking_core Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID. 2021-07-14 4.3 CVE-2020-27379 MISC brave -- brave In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure. 2021-07-12 4.3 CVE-2021-22916 MISC brave -- browser Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled. 2021-07-12 4.3 CVE-2021-22917 MISC codeblab -- glass The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. 2021-07-12 4.3 CVE-2021-24434 CONFIRM dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user. 2021-07-12 4.6 CVE-2021-21590 MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed Initialization. A local authenticated Service user could potentially exploit this vulnerability to escalate privileges. 2021-07-12 4.6 CVE-2021-21589 MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user. 2021-07-12 4.6 CVE-2021-21591 MISC dell -- powerflex_presentation_server Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead to configuration changes. 2021-07-12 4.3 CVE-2021-21588 MISC delta_project -- delta dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory. 2021-07-13 4.4 CVE-2021-36376 CONFIRM MISC MISC devolutions -- devolutions_server Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext). 2021-07-12 4.3 CVE-2021-36382 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on the server filesystems as well any files accessible via Universal Naming Convention (UNC) paths. 2021-07-13 4 CVE-2021-36123 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject arbitrary arguments to 7z.exe. 2021-07-13 6.5 CVE-2021-36122 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files to be written to arbitrary filesystem locations via ../ Directory Traversal on the Z: drive (a hard-coded drive letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITYSYSTEM). 2021-07-13 6.5 CVE-2021-36121 MISC edgexfoundry -- edgex_foundry EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users. 2021-07-09 5.8 CVE-2021-32753 MISC CONFIRM edifecs -- transaction_management In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application. 2021-07-12 5 CVE-2021-36381 MISC MISC element-it -- http_commander A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives. 2021-07-14 4 CVE-2021-33211 MISC MISC element-it -- http_commander An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address. 2021-07-14 4 CVE-2021-33213 MISC MISC esri -- arcgis_server A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. 2021-07-10 4.3 CVE-2021-29107 CONFIRM esri -- arcgis_server A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-07-10 4.3 CVE-2021-29106 CONFIRM esri -- arcgis_server A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. 2021-07-11 6.4 CVE-2021-29102 CONFIRM esri -- arcgis_server A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. 2021-07-11 4.3 CVE-2021-29104 CONFIRM esri -- arcgis_server A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-07-11 4.3 CVE-2021-29103 CONFIRM eventespresso -- event_espresso A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. 2021-07-13 4.3 CVE-2020-26153 MISC MISC exiv2 -- exiv2 A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19716 MISC exiv2 -- exiv2 An integer overflow vulnerability in the getUShort function of Exiv2 0.27.1 results in segmentation faults within the application, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19715 MISC fetchdesigns -- sign-up_sheets The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue 2021-07-12 6 CVE-2021-24441 CONFIRM fortinet -- fortiap An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments. 2021-07-09 4.6 CVE-2021-26106 CONFIRM fortinet -- fortimail A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests. 2021-07-12 5 CVE-2021-26090 CONFIRM fortinet -- fortimail An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. 2021-07-12 6.5 CVE-2021-24015 CONFIRM fortinet -- fortimail A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible. 2021-07-09 5 CVE-2021-26100 CONFIRM fortinet -- fortimail Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. 2021-07-12 4 CVE-2021-24013 CONFIRM fortinet -- fortimail Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext. 2021-07-12 4 CVE-2021-26099 CONFIRM fortinet -- fortimail Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests. 2021-07-09 6.5 CVE-2021-22129 CONFIRM fortinet -- fortisandbox A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands. 2021-07-09 6.3 CVE-2020-29014 CONFIRM foxitsoftware -- foxit_reader Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled. 2021-07-09 4.3 CVE-2021-33795 MISC foxitsoftware -- foxit_reader Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary. 2021-07-09 6.8 CVE-2021-33792 MISC getambassador -- emissary-ingress Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.) 2021-07-09 4.3 CVE-2021-36371 MISC MISC google -- android In handleSendStatusChangeBroadcast of WifiDisplayAdapter.java, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-176541017 2021-07-14 4.9 CVE-2021-0518 MISC google -- android In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-182584940 2021-07-14 6.9 CVE-2021-0586 MISC google -- android In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-177238342 2021-07-14 4.9 CVE-2021-0588 MISC google -- android In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174495520 2021-07-14 4.4 CVE-2021-0441 MISC google -- android In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-179042963 2021-07-14 6.9 CVE-2021-0600 MISC google -- android In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-180643802 2021-07-14 4.9 CVE-2021-0601 MISC google -- android In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-182809425 2021-07-14 4.4 CVE-2021-0603 MISC google -- android In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-175213041 2021-07-14 4.9 CVE-2021-0590 MISC google -- android In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-171430330 2021-07-14 4.6 CVE-2021-0486 MISC google -- android In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175614289 2021-07-14 4.9 CVE-2021-0599 MISC google -- android In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496502 2021-07-14 4.9 CVE-2021-0597 MISC halo -- halo File Deletion vulnerability in Halo 0.4.3 via delBackup. 2021-07-12 6.4 CVE-2020-19038 MISC halo -- halo Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. 2021-07-12 5 CVE-2020-19037 MISC halo -- halo Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. 2021-07-12 4.3 CVE-2020-18979 MISC halo -- halo SSRF vulnerability in Halo show log messages | match "Failed to complete DFE tuning" fpc4 smic_phy_dfe_tuning_state: et-4/1/6 - Failed to complete DFE tuning (count 3) and interface will be in a permanently down state: user@host > show interfaces et-4/1/6 terse Interface Admin Link Proto Local Remote et-4/1/6 up down et-4/1/6.0 up down aenet -- > ae101.0 This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S7 on MX Series; 17.1R1 and later versions prior to 17.2R3-S3 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S11, 17.4R3-S1 on MX Series, SRX4600; 18.1 versions prior to 18.1R3-S10 on MX Series, EX9200 Series, SRX4600; 18.2 versions prior to 18.2R3-S3 on MX Series, EX9200 Series, SRX4600; 18.3 versions prior to 18.3R3-S1 on MX Series, EX9200 Series, SRX4600; 18.4 versions prior to 18.4R2-S3, 18.4R3 on MX Series, EX9200 Series, SRX4600; 19.1 versions prior to 19.1R2-S1, 19.1R3 on MX Series, EX9200 Series, SRX4600; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series, EX9200 Series, SRX4600; 19.3 versions prior to 19.3R2 on MX Series, EX9200 Series, SRX4600. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1. 2021-07-15 not yet calculated CVE-2021-0290 CONFIRM juniper_networks -- junos_os When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces < > extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ = V2.7), SIMATIC NET CP1626 (All versions), SIMATIC NET DK-16xx PN IO (All Versions >= V2.7), SIMATIC PROFINET Driver (All versions), SIMATIC Power Line Booster PLB, Base Module (MLFB: 6ES7972-5AA10-0AB0) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All Versions < V4.5), SIMOCODE proV Ethernet/IP (All versions < V1.1.3), SIMOCODE proV PROFINET (All versions < V2.1.3), SOFTNET-IE PNIO (All versions). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device. 2021-07-13 not yet calculated CVE-2020-28400 CONFIRM siemens -- sinumerik   A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario. 2021-07-13 not yet calculated CVE-2021-31892 CONFIRM siemens --  simatic_pcs A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. 2021-07-13 not yet calculated CVE-2021-31894 CONFIRM siemens --  simatic_pcs   A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution. 2021-07-13 not yet calculated CVE-2021-31893 CONFIRM siemens -- multiple_ruggedcomros_products   A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V4.3.7), RUGGEDCOM ROS M2200 (All versions < V4.3.7), RUGGEDCOM ROS M969 (All versions < V4.3.7), RUGGEDCOM ROS RMC (All versions < V4.3.7), RUGGEDCOM ROS RMC20 (All versions < V4.3.7), RUGGEDCOM ROS RMC30 (All versions < V4.3.7), RUGGEDCOM ROS RMC40 (All versions < V4.3.7), RUGGEDCOM ROS RMC41 (All versions < V4.3.7), RUGGEDCOM ROS RMC8388 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RMC8388 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RP110 (All versions < V4.3.7), RUGGEDCOM ROS RS400 (All versions < V4.3.7), RUGGEDCOM ROS RS401 (All versions < V4.3.7), RUGGEDCOM ROS RS416 (All versions < V4.3.7), RUGGEDCOM ROS RS416v2 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS416v2 V5.X (All versions < 5.5.4), RUGGEDCOM ROS RS8000 (All versions < V4.3.7), RUGGEDCOM ROS RS8000A (All versions < V4.3.7), RUGGEDCOM ROS RS8000H (All versions < V4.3.7), RUGGEDCOM ROS RS8000T (All versions < V4.3.7), RUGGEDCOM ROS RS900 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS900 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RS900G (All versions < V4.3.7), RUGGEDCOM ROS RS900G (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS900G (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RS900GP (All versions < V4.3.7), RUGGEDCOM ROS RS900L (All versions < V4.3.7), RUGGEDCOM ROS RS900W (All versions < V4.3.7), RUGGEDCOM ROS RS910 (All versions < V4.3.7), RUGGEDCOM ROS RS910L (All versions < V4.3.7), RUGGEDCOM ROS RS910W (All versions < V4.3.7), RUGGEDCOM ROS RS920L (All versions < V4.3.7), RUGGEDCOM ROS RS920W (All versions < V4.3.7), RUGGEDCOM ROS RS930L (All versions < V4.3.7), RUGGEDCOM ROS RS930W (All versions < V4.3.7), RUGGEDCOM ROS RS940G (All versions < V4.3.7), RUGGEDCOM ROS RS969 (All versions < V4.3.7), RUGGEDCOM ROS RSG2100 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2100 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2200 (All versions < V4.3.7), RUGGEDCOM ROS RSG2288 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2288 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2300 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2300 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2300P V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2300P V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2488 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2488 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG900 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900C (All versions < V5.5.4), RUGGEDCOM ROS RSG900G V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG900G V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900R (All versions < V5.5.4), RUGGEDCOM ROS RSG920P V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG920P V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSL910 (All versions < V5.5.4), RUGGEDCOM ROS RST2228 (All versions < V5.5.4), RUGGEDCOM ROS RST916C (All versions < V5.5.4), RUGGEDCOM ROS RST916P (All versions < V5.5.4), RUGGEDCOM ROS i800 (All versions < V4.3.7), RUGGEDCOM ROS i801 (All versions < V4.3.7), RUGGEDCOM ROS i802 (All versions < V4.3.7), RUGGEDCOM ROS i803 (All versions < V4.3.7). The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution. 2021-07-13 not yet calculated CVE-2021-31895 CONFIRM solarwinds -- serv-u   Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. 2021-07-14 not yet calculated CVE-2021-35211 MISC MISC teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system. 2021-07-13 not yet calculated CVE-2021-33709 CONFIRM teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link. 2021-07-13 not yet calculated CVE-2021-33710 CONFIRM teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths. 2021-07-13 not yet calculated CVE-2021-33711 CONFIRM telegram -- telegram   A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. 2021-07-17 not yet calculated CVE-2021-36769 MISC thinkcmf -- thinkcmf   Cross Site Request Forgerly (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. 2021-07-14 not yet calculated CVE-2020-18151 MISC trusted_firmware_mbed -- tls   In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. 2021-07-14 not yet calculated CVE-2021-24119 MISC MISC unisys -- stealth   Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run. 2021-07-15 not yet calculated CVE-2021-35056 MISC CONFIRM uri.js -- uri.js   URI.js is vulnerable to URL Redirection to Untrusted Site 2021-07-16 not yet calculated CVE-2021-3647 MISC CONFIRM varnish -- cache   Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8. 2021-07-14 not yet calculated CVE-2021-36740 MISC MISC MISC MISC wolfssl -- wolfssl   In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. 2021-07-14 not yet calculated CVE-2021-24116 MISC CONFIRM wuwire -- wuwire   MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages. 2021-07-15 not yet calculated CVE-2021-32750 CONFIRM ysoft -- safeq   Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream. 2021-07-14 not yet calculated CVE-2021-31859 MISC MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. 2021-07-17 not yet calculated CVE-2021-33911 MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. 2021-07-17 not yet calculated CVE-2021-36771 MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. 2021-07-17 not yet calculated CVE-2021-36772 MISC zscaler -- client_connector   The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges. 2021-07-15 not yet calculated CVE-2020-11633 MISC zscaler -- client_connector   The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges. 2021-07-15 not yet calculated CVE-2020-11632 MISC zscaler -- client_connector   The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context. 2021-07-15 not yet calculated CVE-2020-11634 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

3G Networks Are Shutting Down; What Will Happen to Your Older Devices?
Carriers are shutting down 3G networks. While this may not affect your smartphone, you may still have devices that depend on this technology to communicate. The post appeared first on The Mac Security Blog.

Read more »

Screenshots and Shortcuts – Intego Mac Podcast Episode 196
Apple is fixing a bug that could disable network access on devices connecting to wi-fi networks containing weird characters, and Ring rolls out end-to-end encryption for doorbells. We take a close look at how to shoot screenshots on the Mac, and we discuss the new Shortcuts coming to macOS Monterey The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, July 2021 Edition
Microsoft today released updates to patch at least 116 security holes in its Windows operating systems and related software. A half of dozen of the vulnerabilities addressed today are under active attack, according to Microsoft.

Read more »

Get a new 13″ M1 MacBook Pro for $100 off Apple’s MSRP, plus pay no sales tax in 42 US states
Apple reseller DataVision has Apple’s new 2020 13″ MacBook Pros with Apple Silicon M1 processors in stock and on sale today for up to $100 off MSRP including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 2020 13″ MacBook Pro M1 CPU/256GB SSD Space Gray: $1259 $40 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD Space Gray: $1399 $100 off MSRP – 2020 13″ MacBook Pro M1 CPU/256GB SSD Silver: $1199 $100 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD Silver: $1399 $100 off MSRP DataVision will include a free 45 day no-hassle return period in addition to Apple’s standard one-year warranty. Three custom configurations with 16GB of RAM are also available: – 2020 13″ MacBook Pro M1 CPU/16GB RAM/256GB SSD Space Gray: $1498 – 2020 13″ MacBook Pro M1 CPU/16GB RAM/512GB SSD Space Gray: $1729 – 2020 13″ MacBook Pro M1 CPU/16GB RAM/512GB SSD Silver: $1699 For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Deal Alert! 16″ MacBook Pros on sale for lowest prices ever, up to $500 off Apple’s MSRP, starting at $1999
Amazon has 16″ MacBook Pros on sale for $400-$500 off Apple’s MSRP this weekend, with prices starting at $1999. Shipping is free. These are the same MacBook Pros sold by Apple in their retail and online stores: – 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2299.99 $500 off MSRP – 16″ 2.6GHz 6-Core MacBook Pro Silver: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Silver: $2299.99 $500 off MSRP Amazon’s prices are the lowest 16″ MacBook Pro prices we’ve seen so far from any Apple reseller. Note that Amazon’s stock status may change at any time–see their site for the latest availability. Also, be sure to make your purchase from Amazon rather than a third-party seller. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Xfinity Mobile brings back ‘Buy One Apple iPhone SE, Get a Second One For Free’ promotion
Buy one 64GB iPhone SE at Xfinity Mobile through August 4, 2021, and get a second one for free. 24 month contract required, and cost for the free phone will be credited to your account over a 24 month period. One or more new lines required. The fine print: “iPhone SE 64GB On Us: Offer ends 08/04/21. Requires purchase of new, eligible iPhone SE 64GB, while supplies last, 24 month Xfinity Mobile Device Payment Plan Agreement (“Device Agreement”), activation of new Xfinity Mobile line and transfer of phone number from another carrier within 30 days of phone purchase date. Device credits applied monthly to your account over 24 months so long as Device Agreement is in effect. If line is canceled, voluntarily or involuntarily or device payments are accelerated, balance of credits associated with device payment are forfeited. May not be combined with other offers. Not valid with prior purchases, returns or exchanges.” Xfinity Mobile’s deal is live on their → Read More...

Read more »

4 days only: $10 off HomePod minis on Sams Club’s online store
Sams Club has Apple HomePod minis on sale for $89.98 for 4 days only, ending on Saturday, July 24th. Their price is $10 off Apple’s MSRP, and both Space Gray and White colors are available. Sale price is for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup, if available. Sams Club membership required. For the latest prices & sales, see our HomePod Price Tracker, → Read More...

Read more »

4 days only: $10 off HomePod minis on Sams Club’s online store
Sams Club has Apple HomePod minis on sale for $89.98 for 4 days only, ending on Saturday, July 24th. Their price is $10 off Apple’s MSRP, and both Space Gray and White colors are available. Sale price is for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup, if available. Sams Club membership required. For the latest prices & sales, see our HomePod Price Tracker, → Read More...

Read more »

4 days only: $10 off HomePod minis on Sams Club’s online store
Sams Club has Apple HomePod minis on sale for $89.98 for 4 days only, ending on Saturday, July 24th. Their price is $10 off Apple’s MSRP, and both Space Gray and White colors are available. Sale price is for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup, if available. Sams Club membership required. For the latest prices & sales, see our HomePod Price Tracker, → Read More...

Read more »

Week’s Best Apple iMac Deals: Up to $100 off MSRP, free AirPods, discounted AppleCare+ and more!
Apple resellers are offering a range of promotions and discounted sale prices this week when you purchase a new 24″ iMac with Apple’s M1 processor. Here are the best deals from our iMac Price Tracker: (1): Expercom has the new 24″ M1 iMac on sale for $66-$86 off Apple’s MSRP, with prices starting at $1233. Shipping is free. Expercom is estimating delivery in 7-10 days: – 24″ M1 iMac 8-Core CPU/7-Core GPU/256GB SSD: $1233, $66 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU/256GB SSD: $1423, $76 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU/512GB SSD: $1613, $86 off MSRP Purchase an AppleCare+ plan for $139 alongside your new M1 iMac, regularly $169. That’s a $30 savings. Expercom’s prices are currently the lowest available for an M1 24″ iMac. (2): Apple EDU has the 24″ iMac on sale for up to $100 off MSRP when you use your .edu email address when ordering at Apple Education. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount, including parents of students. Education discounts are available on most build-to-order options, such as extra RAM and more storage. As part of their Back to School promotion for 2021, Apple will include one free pair AirPods (with charging case) with the purchase of an iMac. You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Lastly, Apple will take 20% off AppleCare+ plans with your purchase. Promotion runs through September 27, 2021.: – 24″ M1 iMac/8-Core CPU, 7-Core GPU/256GB: $1249 $50 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/256GB: $1399 $100 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/512GB: $1599 $100 off Not in the US? Click for the Canada or the UK stores. (3): Amazon has Apple’s new 24″ M1 iMacs on sale for up to $50 off MSRP with prices starting at $1249 shipped. At the moment, the $50 discount is restricted to certain colors → Read More...

Read more »

Week’s Best Apple iMac Deals: Up to $100 off MSRP, free AirPods, discounted AppleCare+ and more!
Apple resellers are offering a range of promotions and discounted sale prices this week when you purchase a new 24″ iMac with Apple’s M1 processor. Here are the best deals from our iMac Price Tracker: (1): Expercom has the new 24″ M1 iMac on sale for $66-$86 off Apple’s MSRP, with prices starting at $1233. Shipping is free. Expercom is estimating delivery in 7-10 days: – 24″ M1 iMac 8-Core CPU/7-Core GPU/256GB SSD: $1233, $66 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU/256GB SSD: $1423, $76 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU/512GB SSD: $1613, $86 off MSRP Purchase an AppleCare+ plan for $139 alongside your new M1 iMac, regularly $169. That’s a $30 savings. Expercom’s prices are currently the lowest available for an M1 24″ iMac. (2): Apple EDU has the 24″ iMac on sale for up to $100 off MSRP when you use your .edu email address when ordering at Apple Education. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount, including parents of students. Education discounts are available on most build-to-order options, such as extra RAM and more storage. As part of their Back to School promotion for 2021, Apple will include one free pair AirPods (with charging case) with the purchase of an iMac. You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Lastly, Apple will take 20% off AppleCare+ plans with your purchase. Promotion runs through September 27, 2021.: – 24″ M1 iMac/8-Core CPU, 7-Core GPU/256GB: $1249 $50 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/256GB: $1399 $100 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/512GB: $1599 $100 off Not in the US? Click for the Canada or the UK stores. (3): Amazon has Apple’s new 24″ M1 iMacs on sale for up to $50 off MSRP with prices starting at $1249 shipped. At the moment, the $50 discount is restricted to certain colors → Read More...

Read more »

Clearance sale: Get the 21″ 4K 3.0GHz 6-Core iMac for only $999, $500 off MSRP
Amazon has clearance, leftover, 2020 21″ 4K 3.0GHz 6-Core i5 iMacs in stock and on sale for $999.99 shipped. Their price is $500 off Apple’s original MSRP for this model, and it’s the lowest price we’ve seen for this high-end 21″ iMac. For more information, see our iMac Price Tracker, → Read More...

Read more »

Apple has the 21″ 2.3GHz base iMac available for only $889, Certified Refurbished
Apple has the base 21″ dual-core 2.3GHz iMac (i5 CPU, 8GB RAM, 1TB HD) in stock today for only $889, Certified Refurbished. Their price is $210 off original MSRP, and it’s the cheapest iMac for sale today at Apple. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. – 21″ 2-Core 2.3GHz iMac: $889 $210 off MSRP For more information, see our iMac Price Tracker, → Read More...

Read more »

Save up to $350 on a 27-inch 5K multi-core iMac with these Certified Refurbished models at Apple
Apple has a full line of Certified Refurbished 2020 27″ 5K iMacs available starting at $1529 and up to $350 off original MSRP. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are available: – 27″ 5K 8-Core 3.8GHz iMac: $1949 $350 off MSRP – 27″ 5K 6-Core 3.3GHz iMac: $1699 $300 off MSRP – 27″ 5K 6-Core 3.1GHz iMac: $1529 $270 off MSRP Their prices are the cheapest available for 2020 27″ iMacs anywhere. For more information, see our iMac Price Tracker, → Read More...

Read more »

Week’s Best iPad Deals: Get one of Apple’s popular 10.9″ iPad Airs for up to $110 off MSRP
Amazon has Apple 10.9″ iPad Airs on sale for up to $110 off MSRP, each including free shipping. Sale price varies by color, as indicated below. Amazon’s prices are the lowest available for iPad Airs from any of Apple’s resellers. Be sure to purchase from Amazon rather than a third-party seller: – 10.9″ 64GB WiFi iPad Air Space Gray: $499.99 $100 off MSRP – 10.9″ 64GB WiFi iPad Air Green: $499.99 $100 off MSRP – 10.9″ 64GB WiFi iPad Air Rose Gold: $499.99 $100 off MSRP – 10.9″ 64GB WiFi iPad Air Blue: $499.99 $100 off MSRP – 10.9″ 64GB WiFi iPad Air Silver: $539 $60 off MSRP – 10.9″ 256GB WiFi iPad Air Space Gray: $649.99 $100 off MSRP – 10.9″ 256GB WiFi iPad Air Green: $649.99 $100 off MSRP – 10.9″ 256GB WiFi iPad Air Rose Gold: $639 $110 off MSRP – 10.9″ 256GB WiFi iPad Air Blue: $699 $50 off MSRP – 10.9″ 256GB WiFi iPad Air Silver: $649.99 $100 off MSRP – 10.9″ 64GB WiFi + Cellular iPad Airs (most colors): $629.99 $100 off MSRP – 10.9″ 256GB WiFi + Cellular iPad Airs (most colors): $779.99 $100 off MSRP For the latest prices and sales, keep an eye on our iPad Air Price Tracker, → Read More...

Read more »