AAPL down 4.75%, other tech giants too, as coronavirus nears...
AAPL lost 4.75% of its value yesterday as fears grow that the coronavirus outbreak may be spreading to other countries too quickly to be contained. The World Health Organisation (WHO) has warned that the spread is now nearing the point at which it may be declared a pandemic. The definition of a pandemic is a relatively loose one, but is generally taken to mean a rapidly-spreading disease which affects a large number of people across international borders … more… The post AAPL down 4.75%, other tech giants too, as coronavirus nears pandemic status appeared first on 9to5Mac.

Read more »

Apple will sell ‘customer-installable’ wheel kit for lat...
Apple plans to sell a do-it-yourself wheel kit for its latest Mac Pro. Only Apple or an Authorized Service Provider can add the wheels right now, which means you must take the machine in for service if you opted for feet when you first purchased it. A “customer-installable” kit is coming, though. Adding wheels to […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Redesigned Apple Fairview opens February 29 in Toronto
Canada’s second Apple Store with the latest retail design is coming to Toronto. Apple Fairview, located in the CF Fairview Mall, reopens in a larger and redesigned space February 29 at 9:30 A.M. EST. more… The post appeared first on 9to5Mac.

Read more »

iPhone manufacturer offers perks to try and woo people back ...
Apple manufacturer Foxconn is trying to woo people back to the iPhone production lines by offering new perks at its major assembly plants in Shenzhen and Chengzhou. The company has been hit hard by the coronavirus outbreak, which resulted in some factories being temporarily closed and only a fraction of employees returning to work when […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Netatmo Smart Indoor Camera officially adds support for Home...
The Netatmo Smart Indoor Camera now officially supports HomeKit Secure Video as of today, as announced in a Netatmo blog post. The firmware update is being made ‘gradually available’ over the upcoming days. This means that new and existing Netatmo Smart Indoor Camera owners can now take advantage of HomeKit Secure Video features, where detected motion events are recorded as clips to the user’s iCloud account to be able to be watched back later. more… The post Netatmo Smart Indoor Camera officially adds support for HomeKit Secure Video with iCloud recordings appeared first on 9to5Mac.

Read more »

Get 68% off on the Mac Utility Audio Software Bundle
iLounge has a special deal on the Mac Utility Audio Software Bundle, which brings three highly-rated apps (ringtone creation, conversion, and media transfer) to your Mac. Mac Utility Audio Software Bundle How much would you pay for an iTunes alternative, a ringtone creator and a YouTube offline converter? The Mac Utility Audio Software Bundle gives you iRingg Ringtone Creator, Softorino The post appeared first on iLounge.

Read more »

Apple won’t testify at congressional hearing on tech indus...
Apple won’t attend a March congressional hearing about the tech industry’s relationships in China, the Washington Post reports. Republican Senator Josh Hawley called the March 4 hearing. Hawley has raised concerns about tech companies’ reliance on and possible cozy relations with China. TikTok also declined to testify at the upcoming March congressional hearing. However, TikTok said […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple reopens more than half of retail stores in China
Apple has reopened more than half of its retail stores in China after closing all outlets due to the COVID-19 coronavirus outbreak… The post appeared first on MacDailyNews.

Read more »

Despite virus fears, over half of Apple retail stores reopen...
Many Apple Stores across China are open again, despite the coronavirus that’s shut down so much of that country. The iPhone maker depends on China for a significant precentage of its sales, and company being able to reopen so many stores in the midst of this crisis is a positive sign. Apple tries to bounce […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Supreme Court Rejects Apple Appeal In Patent Fight With Virn...
New submitter John Trumpian shares a report from Reuters: The U.S. Supreme Court on Monday refused to hear Apple's bid to avoid paying about $440 million in damages for using patent licensing firm VirnetX's internet security technology without permission in features such as FaceTime video calling. The justices rejected Apple's appeal in the long-running case in which a federal jury in 2016 found that Apple had infringed VirnetX's patents and awarded $302 million. A judge later increased that amount to $439.7 million including interest and other costs. The case dates back to 2010 when Nevada-based VirnetX filed suit in federal court in the Eastern District of Texas accusing Cupertino, California-based Apple of infringing four patents for secure networks, known as virtual private networks, and secure communications links. VirnetX said Apple infringed with its FaceTime and VPN on Demand features in products such as the iPhone and iPad. The U.S. Court of Appeals for the Federal Circuit in Washington, which specializes in patent disputes, upheld the judgment against Apple last year. Read more of this story at Slashdot.

Read more »

Apple says Mac Pro wheels will eventually be available as a ...
Earlier today, Apple published a new white paper offering detailed information about the newest Mac Pro. Hidden in this document is the news that the Mac Pro wheels will, at some point, be available as a standalone purchase. more… The post Apple says Mac Pro wheels will eventually be available as a standalone customer-installable kit appeared first on 9to5Mac.

Read more »

Take a crazy deep dive into Mac Pro with Apple’s 46-page t...
Apple goes into extreme detail about its new Mac Pro in a white paper released today. Anyone seeking an answer to an obscure question about this workstation can look through this 46-page Technology Overview. Go in depth with the Mac Pro Technology Overview Apple’s website covers the high points of the 2019 Mac Pro, which […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple once again declines to attend congressional hearing on...
Apple has again declined a request to testify at a congressional hearing scheduled for March focused the technology industry’s relationship with China. This is the second such hearing that Apple has declined to attend since November. more… The post Apple once again declines to attend congressional hearing on China and the tech industry appeared first on 9to5Mac.

Read more »

Why did Apple drop support for the Magic Mouse 2 on the iPad...
Once upon a time, and not very long ago at that, you could use a Magic Mouse 2 with an iPad so long as you were running iPadOS 13. It worked well enough—for a while, anyway. But lately Macworld readers have been telling me that their Magic Mouse 2 no longer works on Apple’s tablet, and some of them have singled out January’s iPadOS 13.3 as the culprit. The most frustrated users are those who never had a chance to see the mouse work at all, so they’re convinced they’re doing it wrong. Surely, they think, Apple wouldn’t pull support for one of its own products—and who could blame them?Apparently, it did. I’ve confirmed this with my own iPad Pro that’s running iPadOS 13.3.1, and nada—nothing works. (That’s true of my iPhone, too.) I’ve tried the backdoor route described in my how-to. I’ve tried multiple methods of hooking up devices through Bluetooth. If I hook up the Magic Mouse 2 with a wired connection, I can at least get the AssistiveTouch feature that powers the iPad’s mouse control to recognize that a mouse is attached, but I can’t actually move the pointer. Of course, it’s not like I could actually use the Magic Mouse 2 with a wired connection anyway, thanks to this infamous design flaw:To read this article in full, please click here

Read more »

TMO Editor-in-Chief Bryan Chaffin (#2) – TMO Background Mo...
Bryan Chaffin is the co-founder and Executive Vice President of The Mac Observer. He is also our Editor-in-Chief. He’s been working lately as co-author of a new edition of iPad For Dummies, and so I enlisted him to discuss the future of the iPad. We chatted about how the iPad has made enormous gains in CPU and graphics power over the last 10 years. But iOS and then iPadOS not so much. In the early days Apple wasn’t quite sure where the iPad would go, and that’s perhaps a factor in its development. We examined how multi-tasking has been implemented, the prospects for larger displays, home screen operations, consumption vs. productivity, the stagnation of sales, and whether there needs to be a new product between the iPad and Mac. Bryan resurrects the notorious concept of the ::gasp:: toaster-fridge. There’s much more.

Read more »

News round-up: remembering Steve Jobs, Safari security, more
Since Steve and I can’t cover everything, we’ll frequently offer a wrap-up news items you should check out. Today would have been the 65th birthday of Apple co-founder Steve Jobs. CEO Tim Cook took to Twitter to remember his friend and mentor. Last week, at the 49th CA/Browser Forum, a voluntary consortium of certification authorities, Apple announced that it’ll stop allowing HTTPS certificates on Safari with more than 13 months of validity, later this year, according to TNW.Failure to reach a global deal on where and how much to tax digital giants such as Apple, Google, Amazon, Facebook, etc. would result in many digital tax regimes emerging all over the world, France’s Finance Minister says.Apple has signed a lease for 220,000 square feet of office space at 11 Penn Plaza near Madison Square Garden, The New York Post reports. The building sits on entire eastern blockfront along Seventh Avenue between West 31st and 32nd streets, cater-corner to Madison Square Garden.Apple retail stores will promote International Women's Day all month long with the “She Creates” series, according to 9to5Mac.As of Monday, 29 of 42 Apple retail stores have re-opened in China, after being closed to due the Coronavirus, reports Bloomberg.Apple has published two "white papers" detailing the tech in its Mac Pro (PDF link) and Pro Display XDR (PDF link).

Read more »

Apple Maps expands its Street View competitor to Boston, DC,...
This follows a US-wide expansion of more detailed maps.

Read more »

New Huawei tablet adds features iPad owners can only dream a...
Huawei added cutting-edge features to its iPad Pro rival. A MatePad Pro update includes 5G built-in cellular-wireless networking. And it offers two-way wireless charging, so the tablet can send power to another device. These features were added to a device clearly made to resemble Apple’s top-tier iPad. Huawei MatePad Pro 5G knocks off iPad Pro […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Analyst: iPhone sales fall in China due to coronavirus, but ...
As Apple itself implied was the case in an investor note last week, iPhone sales are taking a hit in China due to the ongoing coronavirus situation. In a new investor note today, UBS analysts estimate that iPhone sales fell 28% during January. more… The post Analyst: iPhone sales fall in China due to coronavirus, but Apple less affected than others appeared first on 9to5Mac.

Read more »

Apple stock, other techs fall as coronavirus spreads beyond ...
In Monday trading, Apple and other tech stocks fell amid reports that the China coronavirus outbreak threatens to turn into a pandemic. Apple stock fell … The post Apple stock, other techs fall as coronavirus spreads beyond China appeared first on MacDailyNews.

Read more »

The Mac Utility Audio Software Bundle: $24.99
We have a deal on the Mac Utility Audio Software Bundle, which includes WALTR 2, Softorino Youtube Converter 2, and iRingg Ringtone Creator for Mac. You get all three utilities for $24.99 through this bundle.

Read more »

Apple plans move to gigantic new Manhattan office
A certain phone maker is taking the phase “Big Apple” as a suggestion. Apple reportedly signed a lease for 220,000 square feet in a historic building in New York City. That’s far larger than the company’s current NYC office. But this won’t become an enormous Apple Store. This is office space. Apple growing in New York […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

New IEEE 802.11ay Wi-Fi Standard Could be Heading to iPhones
The next generation of iPhones could support a Wi-Fi standard known as IEEE 802.11ay, which could help facilitate communication between nearby devices.

Read more »

Netflix Top 10 Lists Appear Today to Show Popular Content
Starting today Netflix is rolling out a Top 10 lists feature that will update every day. It will feature the platform’s most popular content. “Starting today you’ll notice something new when you go on Netflix: The Top 10 row,” the company said in a tweet. “The lists update daily to show what’s popular in your country and are broken into three categories: Netflix overall, shows & films.” The most popular Netflix offerings in your country should show up in their own row once you log in to your Netflix account, the company said. “The list is rolling out globally now and should be on your homepage by the end of the day at the latest.”

Read more »

Apple’s next-gen ‘iPhone 12’ may support 802.11ay Wi-F...
Apple's next-generation "iPhone 12" series may support a new Wi-Fi standard known as IEEE 802.11ay, the follow-up of IEEE 802.11ad, quadrupling… The post Apple’s next-gen ‘iPhone 12’ may support 802.11ay Wi-Fi appeared first on MacDailyNews.

Read more »

Today at Apple Sessions Celebrate International Women’s Da...
Apple retail stores will celebrate International Women’s Day on March 8 with a series of Today at Apple sessions called “She Creates”.

Read more »

Apple publishes Mac Pro and Pro Display XDR technology deep ...
Apple has made two incredibly thorough white papers available today covering the Mac Pro and Pro Display XDR. These “Technology Overview” documents highlight the inner workings of both of Apple’s newest pro-grade pieces of hardware. more… The post Apple publishes Mac Pro and Pro Display XDR technology deep dives appeared first on 9to5Mac.

Read more »

App Store Confidential author ‘surprised’ by Apple’s a...
The author of App Store Confidential says he is “surprised” by Apple’s attempt to halt sales of the book, and by the company’s allegations that the German-language memoir reveals trade secrets. Tom Sadowski, a former App Store manager who worked at Apple from 2009 through 2019, told Cult of Mac he’s not sure which parts […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Results of Public iOS Developer Community Survey Out
A public developer community survey for iOS has recently concluded, and results have gone live. The 2,000-strong survey reveals important factoids such as the state of Swift, the most popular revenue streams and more. Dave Verwer, an indie iOS developer has put together the developer community survey in hopes that it offers insights on what the iOS developer community is The post appeared first on iLounge.

Read more »

Zyxel Fixes 0day in Network Storage Devices
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a "ZyXEL") is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

Read more »

Switch default apps on iPhone or iPad for better security an...
Modern operating systems, both on the desktop and on mobile devices, include plenty of “stock apps”—apps provided by default so you can use your device without needing a lot of third-party software. You get an email app, a calendar, a web browser, a messaging app, and more. This wasn’t always the case; I remember when […]

Read more »

Red Hat Security Advisory 2020-0559-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Hackers Were Inside Citrix for Five Months
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.

Read more »

Encoding Stolen Credit Card Data on Barcodes
Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the U.S. Secret Service, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code.

Read more »

Red Hat Security Advisory 2020-0515-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability has been addressed.

Read more »

Pay Up, Or We’ll Make Google Ban Your Ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google's AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher's ads with so much bot and junk traffic that Google's automated anti-fraud systems suspend the user's AdSense account for suspicious traffic.

Read more »

Vulnerability Summary for the Week of February 10, 2020
Original release date: February 17, 2020The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- framemaker   Adobe Framemaker versions 2019.0.4 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-02-13 10 CVE-2020-3740CONFIRM ajaxeplorer -- ajaxeplorer   Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php). 2020-02-11 10 CVE-2013-4267MISCMISCMISC artica -- pandora_fms   functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. 2020-02-12 9 CVE-2020-8947MISCMISCMISC atutor -- atutor   confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. 2020-02-11 7.5 CVE-2014-9753MISCMISCMISCMISCMISC belkin -- n300_router   An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." 2020-02-07 10 CVE-2013-3091MISCMISCMISC biscom -- secure_file_transfer   Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. 2020-02-07 7.5 CVE-2020-8796MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/175922 bosch -- bvms_mobile_video_service   Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = V3.0), SCALANCE S612 (All versions >= V3.0), SCALANCE S623 (All versions >= V3.0), SCALANCE S627-2M (All versions >= V3.0). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. 2020-02-11 5 CVE-2019-13925MISC siemens -- multiple_scalance_switches   A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (all versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (all versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known. 2020-02-11 4.3 CVE-2019-13924MISC siemens -- multiple_simatic_devices   A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 PN/DP CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions). Affected devices contain a vulnerability that could cause a Denial-of-Service condition of the web server by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device’s web server. Beyond the web service, no other functions or interfaces are affected by the Denial-of-Service condition. 2020-02-11 5 CVE-2019-13940MISCMISC siemens -- ozw672_and_772_web_servers   A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system. 2020-02-11 5 CVE-2019-13941MISC simple_machines -- simple_machines_forum   File Disclosure in SMF (SimpleMachines Forum) character exists. This causes a denial of service in which the recipient cannot read all of their messages. 2020-02-12 not yet calculated CVE-2020-7957CONFIRMCONFIRMMISC dovecot -- dovecot   lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. 2020-02-12 not yet calculated CVE-2020-7046CONFIRMCONFIRMMISC drupal -- drupal   The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field. 2020-02-11 not yet calculated CVE-2013-4225MISCMISCMISCMISC easyxdm -- easyxdm   Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file. 2020-02-14 not yet calculated CVE-2013-5212MISCXF etherpad -- etherpad   Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297. 2020-02-13 not yet calculated CVE-2015-3309MISCMISCMISC extrun -- ilbo   ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors. 2020-02-14 not yet calculated CVE-2020-5532MISCMISCMISC fasterxml -- jackson-databind   FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 2020-02-10 not yet calculated CVE-2020-8840MISC foxit -- phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400. 2020-02-14 not yet calculated CVE-2020-8846MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560. 2020-02-14 not yet calculated CVE-2020-8855MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9358. 2020-02-14 not yet calculated CVE-2020-8845MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9591. 2020-02-14 not yet calculated CVE-2020-8853MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of JPEG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9606. 2020-02-14 not yet calculated CVE-2020-8854MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9640. 2020-02-14 not yet calculated CVE-2020-8856MISCMISC foxit -- reader This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9416. 2020-02-14 not yet calculated CVE-2020-8852MISCMISC foxit -- reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862. 2020-02-14 not yet calculated CVE-2020-8857MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9414. 2020-02-14 not yet calculated CVE-2020-8847MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9406. 2020-02-14 not yet calculated CVE-2020-8851MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9407. 2020-02-14 not yet calculated CVE-2020-8848MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9415. 2020-02-14 not yet calculated CVE-2020-8850MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413. 2020-02-14 not yet calculated CVE-2020-8849MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102. 2020-02-14 not yet calculated CVE-2020-8844CONFIRMMISC free_reprintables -- articlefr   A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information. 2020-02-13 not yet calculated CVE-2014-4170MISCMISCMISCMISC freebsd -- bsd_libc   regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. 2020-02-12 not yet calculated CVE-2011-3336FULLDISCBIDMISCBUGTRAQ fujitsu -- multiple_products   The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V11 and other versions, Interstage Job Workload Server V8, Interstage List Works V10 and other versions, Interstage Studio V12 and other versions, Interstage Web Server Express V11, Linkexpress V5, Safeauthor V3, ServerView Resource Orchestrator V3, Systemwalker Cloud Business Service Management V1, Systemwalker Desktop Keeper V15, Systemwalker Desktop Patrol V15, Systemwalker IT Change Manager V14, Systemwalker Operation Manager V16 and other versions, Systemwalker Runbook Automation V15 and other versions, Systemwalker Security Control V1, and Systemwalker Software Configuration Manager V15. 2020-02-07 not yet calculated CVE-2019-13163CONFIRM git -- git   Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. 2020-02-12 not yet calculated CVE-2014-9390MISCMISCMISCMISCMISCMISCMISC gitlab -- gitlab   GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. 2020-02-14 not yet calculated CVE-2019-15592MISCMISC gitlab -- gitlab   GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. 2020-02-14 not yet calculated CVE-2019-15594MISCMISC global_payments -- php-sdk   Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. 2020-02-14 not yet calculated CVE-2019-20455MISCMISC gocloud -- mutliple_devices   Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring. 2020-02-12 not yet calculated CVE-2020-8949MISC google -- android In notifyNetworkTested and related functions of NetworkMonitor.java, there is a possible bypass of private DNS settings. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-122652057 2020-02-13 not yet calculated CVE-2020-0028MISC google -- android   In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-141552859 2020-02-13 not yet calculated CVE-2020-0005MISC google -- android   It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520 2020-02-13 not yet calculated CVE-2020-0014MISC google -- android   In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel 2020-02-13 not yet calculated CVE-2020-0030MISC google -- android   The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. 2020-02-12 not yet calculated CVE-2011-2343CONFIRMMISC google -- android   In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-67319274 2020-02-13 not yet calculated CVE-2019-2200MISC google -- android   In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139017101 2020-02-13 not yet calculated CVE-2020-0015MISC google -- android   In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140419401 2020-02-13 not yet calculated CVE-2020-0026MISC google -- android   In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892 2020-02-13 not yet calculated CVE-2020-0017MISC google -- android   In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049 2020-02-13 not yet calculated CVE-2020-0018MISC google -- android   In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144040966 2020-02-13 not yet calculated CVE-2020-0027MISC google -- android   In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731 2020-02-13 not yet calculated CVE-2020-0020MISC google -- android   In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could lead to remote denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141413692 2020-02-13 not yet calculated CVE-2020-0021MISC google -- android   In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715 2020-02-13 not yet calculated CVE-2020-0022FULLDISCMISC google -- android   In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871 2020-02-13 not yet calculated CVE-2020-0023MISC hashicorp -- sentinel HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. 2020-02-14 not yet calculated CVE-2019-19879MISC hcl -- appscan_standard_edition   HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. 2020-02-14 not yet calculated CVE-2019-4392MISC hitachi -- command_suite_and_automation_director   A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21032MISCCONFIRM hitachi -- multiple_products   A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21033MISCCONFIRM hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7208MISC hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7209MISC ibm -- tivoli_monitoring_service   IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647. 2020-02-13 not yet calculated CVE-2019-4592XFCONFIRM ibm -- urbancode_deploy_and_urbancode_build IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248. 2020-02-13 not yet calculated CVE-2019-4666XFCONFIRMCONFIRM intel -- converged_security_and_management_engine   Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access. 2020-02-13 not yet calculated CVE-2019-14598MISC intel -- e1000e/82574l_network_controller_devices   A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex, 33 hex, or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image. 2020-02-13 not yet calculated CVE-2013-1634MISCMISCMLISTMLISTSECTRACKXF intel -- manycore_platform_software_stack   Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0563MISC intel -- renesas_electronics_usb   Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0560MISC intel -- sgx_software_development_kit Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0561MISC intel --  raid_web_console_2 Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0562MISC intel --  raid_web_console_3_for_windows Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0564MISC invision_power_services -- invision_power_board   Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. 2020-02-12 not yet calculated CVE-2013-3725MISC istio -- istio   An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4. 2020-02-14 not yet calculated CVE-2020-8843MISCMISCCONFIRM joomla! -- joomla!   Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. 2020-02-12 not yet calculated CVE-2011-4906CONFIRMEXPLOIT-DBMISC joomla! -- joomla!   TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. 2020-02-12 not yet calculated CVE-2011-4908MISCEXPLOIT-DBMLIST jsreport -- jsreport   An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8128MISC jsreport -- script-manager   An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8129MISC juniper -- junos_os   Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. 2020-02-11 not yet calculated CVE-2014-6447CONFIRMMISC kaseya -- virtual_system_administrator   Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. 2020-02-13 not yet calculated CVE-2015-6589MISCMISCMISCMISC kde -- paste_applet   The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack. 2020-02-11 not yet calculated CVE-2013-2120MISCMISCMISCMISCMISC kde -- paste_applet   The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output. 2020-02-11 not yet calculated CVE-2013-2213MISCMISCMISC kinetica -- kinetica   The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command. 2020-02-11 not yet calculated CVE-2020-8429MISCMISC lenovo -- ez_media_&_backup_center A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page. 2020-02-14 not yet calculated CVE-2019-19758CONFIRM lenovo -- multiple_devices   Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled. 2020-02-14 not yet calculated CVE-2019-6190CONFIRM lenovo -- xclarity_administrator   An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. 2020-02-14 not yet calculated CVE-2019-19757CONFIRM lenovo -- xclarity_administrator   An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. 2020-02-14 not yet calculated CVE-2019-6194CONFIRM lenovo -- xclarity_administrator   An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes. 2020-02-14 not yet calculated CVE-2019-6193CONFIRM lenovo -- xclarity_controller   An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. 2020-02-14 not yet calculated CVE-2019-6195CONFIRM lexmark -- multiple_devices   Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. 2020-02-13 not yet calculated CVE-2019-18791MISCCONFIRM libuv -- libuv   The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition. 2020-02-11 not yet calculated CVE-2014-9748MISCMISCMISCMISCMISC linux -- linux_kernel   ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. 2020-02-14 not yet calculated CVE-2020-8992MISC lvm2 -- lvm2   vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. 2020-02-14 not yet calculated CVE-2020-8991MISC magento -- magento Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. 2020-02-13 not yet calculated CVE-2012-6091MLISTBIDXF mailu -- mailu   In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354 2020-02-13 not yet calculated CVE-2020-5239MISCCONFIRM mambo -- mambo_cms Mambo CMS through 4.6.5 has multiple XSS. 2020-02-12 not yet calculated CVE-2011-2499MLIST mantisbt -- mantisbt   A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. 2020-02-13 not yet calculated CVE-2020-8981MISCMISC matestack-ui-core_gem_for_ruby_on_rails -- matestack-ui-core_gem_for_ruby_on_rails matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. 2020-02-13 not yet calculated CVE-2020-5241CONFIRM maxum_development_corporation -- rumpus_ftp   A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html. 2020-02-10 not yet calculated CVE-2019-19664MISCMISC maxum_development_corporation -- rumpus_ftp_server   A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html. 2020-02-10 not yet calculated CVE-2019-19662MISCMISC mcafee -- endpoint_security   Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. 2020-02-14 not yet calculated CVE-2020-7251CONFIRM microsoft -- multiple_windows_products An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0728MISCBUGTRAQ microsoft -- multiple_windows_products An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0714MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0745, CVE-2020-0792. 2020-02-11 not yet calculated CVE-2020-0715MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0727MISC microsoft -- multiple_windows_products   A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0708MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0719, CVE-2020-0720, CVE-2020-0721, CVE-2020-0722, CVE-2020-0723, CVE-2020-0724, CVE-2020-0725, CVE-2020-0726, CVE-2020-0731. 2020-02-11 not yet calculated CVE-2020-0691MISC microsoft -- office_online_server   A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0695MISC microsys -- promotic   Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service. 2020-02-13 not yet calculated CVE-2014-1617MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. 2020-02-13 not yet calculated CVE-2013-7287MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm 2020-02-12 not yet calculated CVE-2013-7286MISCMISC moxa -- mgate_5105-mb-eip_devices   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. 2020-02-14 not yet calculated CVE-2020-8858MISCMISC netgear -- cg3100_devices   A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information. 2020-02-13 not yet calculated CVE-2014-3919MISC netis -- wf2471_devices   Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter. 2020-02-12 not yet calculated CVE-2020-8946MISC nvidia -- graphics_drivers   A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. 2020-02-12 not yet calculated CVE-2012-0951MISCMISC nxp -- kw41z_devices   The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet. 2020-02-12 not yet calculated CVE-2019-17519MISC openconnect_project -- openconnect_vpn_client OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection. 2020-02-13 not yet calculated CVE-2013-7098CONFIRM openvpn -- access_server OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). 2020-02-13 not yet calculated CVE-2020-8953CONFIRM openx -- openx_ad_server   A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code 2020-02-14 not yet calculated CVE-2013-4211MISCMISCMISCMISCMISC otrs -- itsm_and_faq   A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code. 2020-02-12 not yet calculated CVE-2013-2637MISCMISCMISCMISC palo_alto_networks -- expedition_migration_tool   Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions. 2020-02-12 not yet calculated CVE-2020-1977CONFIRM palo_alto_networks -- globalprotect   A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS. 2020-02-12 not yet calculated CVE-2020-1976CONFIRM palo_alto_networks -- pan-os   Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. 2020-02-12 not yet calculated CVE-2020-1975CONFIRM pcre -- pearl_compatible_regular_expressions   An out-of-bounds read was discovered in PCRE before 10.34 when the pattern X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. 2020-02-14 not yet calculated CVE-2019-20454MISCMISCMISCMISC podman -- podman   A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. 2020-02-11 not yet calculated CVE-2020-1726CONFIRM prestashop -- prestashop   PrestaShop before 1.4.11 allows logout CSRF. 2020-02-14 not yet calculated CVE-2013-4792MISC prestashop -- prestashop   PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. 2020-02-14 not yet calculated CVE-2013-4791MISC prismview -- prismview_system_and_prismview_player   The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.) 2020-02-10 not yet calculated CVE-2019-20451MISC proglottis -- gpgme   The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. 2020-02-12 not yet calculated CVE-2020-8945MISCMISCMISCMISC progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. 2020-02-14 not yet calculated CVE-2020-8611MISCCONFIRMCONFIRMCONFIRM progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS. 2020-02-14 not yet calculated CVE-2020-8612MISCCONFIRMCONFIRMCONFIRM python-mode -- python-mode A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. 2020-02-12 not yet calculated CVE-2013-5106MISC qemu -- qemu   An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. 2020-02-11 not yet calculated CVE-2020-1711CONFIRMMISCMISC qnap -- viocard-300_devices   QNAP VioCard 300 has hardcoded RSA private keys. 2020-02-13 not yet calculated CVE-2013-6277MISCMISC realtek -- ndis_driver_rt64x64.sys   Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0. 2020-02-12 not yet calculated CVE-2019-11867MISCMISC red_hat -- openshift_enterprise   The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. 2020-02-12 not yet calculated CVE-2014-0234MISCMISCMISCMISCMISC runc -- runc   runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) 2020-02-12 not yet calculated CVE-2019-19921SUSEMISCMISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. 2020-02-13 not yet calculated CVE-2020-8804MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. 2020-02-13 not yet calculated CVE-2020-8803MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. 2020-02-13 not yet calculated CVE-2020-8802MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows PHAR Deserialization. 2020-02-13 not yet calculated CVE-2020-8801MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. 2020-02-13 not yet calculated CVE-2020-8800MISCMISCMISC samsung -- s6_edge_smartphone   Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter. 2020-02-12 not yet calculated CVE-2015-7890MISCMISCMISC sap -- business_objects_intelligence_platform Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6189MISCMISC sap -- enterprise_resource_planning_and_s/4hana   VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check. 2020-02-12 not yet calculated CVE-2020-6188MISCMISC sap -- host_agent SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability. 2020-02-12 not yet calculated CVE-2020-6183MISCMISC sap -- host_agent   SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6186MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management. 2020-02-12 not yet calculated CVE-2020-6192MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation. 2020-02-12 not yet calculated CVE-2020-6191MISCMISC sap -- mobile_platform   SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server. 2020-02-12 not yet calculated CVE-2020-6177MISCMISC sap -- netweaver   SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6187MISCMISC sap -- netweaver   SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6193MISCMISC sap -- netweaver_and_abap_platform   Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability. 2020-02-12 not yet calculated CVE-2020-6181MISCMISC sap -- netweaver_and_s/4hana Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6184MISCMISC sap -- netweaver_and_s/4hana   Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability. 2020-02-12 not yet calculated CVE-2020-6185MISCMISC sap -- netweaver_as_java   Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6190MISCMISC shaman -- shaman   Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password. 2020-02-12 not yet calculated CVE-2011-4338MISCMISC siemens -- multiple_devices   A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All Versions < V4.5), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All Versions < V4.6), PROFINET Driver for Controller (All Versions < V2.1), RUGGEDCOM RM1224 (All versions < V4.3), SCALANCE M-800 / S615 (All versions < V4.3), SCALANCE W700 IEEE 802.11n (All versions

Read more »

Cryptocurrency 101 – Part 1: Blockchain and basic concepts
This is the first in a series of articles exploring Bitcoin, cryptocurrencies and their fundamental technologies, and how you might find these technologies useful and use them safely. You’ve likely heard about Bitcoin, which is a type of cryptocurrency or digital currency, and perhaps you’ve wondered what all the fuss is about. What exactly are […]

Read more »

A Light at the End of Liberty Reserve’s Demise?
In May 2013, the U.S. Justice Department seized Liberty Reserve, alleging the virtual currency service acted as a $6 billion financial hub for the cybercrime world. Prompted by assurances that the government would one day afford Liberty Reserve users a chance to reclaim any funds seized as part of the takedown, KrebsOnSecurity filed a claim shortly thereafter to see if and when this process might take place. This week, an investigator with the U.S. Internal Revenue service finally got in touch to discuss my claim.

Read more »

Microsoft Patch Tuesday, February 2020 Edition
Microsoft today released updates to plug nearly 100 security holes in various versions of its Windows operating system and related software, including a zero-day vulnerability in Internet Explorer (IE) that is actively being exploited. Also, Adobe has issued a bevy of security updates for its various products, including Flash Player and Adobe Reader/Acrobat.

Read more »

B&H offers $100 discount on base 13″ 1.4GHz Apple MacB...
B&H Photo has new 2019 13″ 1.4GHz MacBook Pros on sale for $100 off Apple’s MSRP today with prices starting at $1199. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros sold by Apple in their retail and online stores. B&H’s prices are the lowest available for new 13″ MacBook Pros: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1199 $100 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1199.99 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1399 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1399.99 $100 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple continues to offer Certified Refurbished iPhone XS mod...
Apple has Certified Refurbished iPhone XS models available for up to $350 off MSRP, with prices starting at $699. Each iPhone is unlocked and comes with Apple’s standard one-year warranty and a new outer case. Multiple colors are available: – 64GB iPhone XS: $699 save $200 – 256GB iPhone XS: $829 save $230 – 512GB iPhone XS: $999 save $350 – 64GB iPhone XS Max: $799 save $200 – 256GB iPhone XS Max: $929 save $230 – 512GB iPhone XS Max: $1099 → Read More...

Read more »

Apple AirPods are on sale for $30 off today
Amazon has new 2019 Apple AirPods (non-Pro models) on sale today for $30 off MSRP, starting at $129. Shipping is free: – AirPods with Wireless Charging Case: $169 $30 off MSRP – AirPods with Charging Case: $129.98 $30 off MSRP See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

27″ 3.7GHz 6-Core 5K iMac on sale for $2099, $200 off Appl...
B&H Photo has the 2019 27″ 3.7GHz 6-Core 5K iMac in stock today and on sale for $200 off Apple’s MSRP. Overnight shipping is free to many locations in the US: – 27″ 3.7GHz 6-Core 5K iMac: $2099 $200 off MSRP See our iMac Price Tracker for the latest sales and prices from Apple and → Read More...

Read more »

Save up to $250 on a 12.9″ iPad Pros with these Certified ...
Apple has Certified Refurbished 12.9″ iPad Pros available on their online store for up to $250 off the cost of new models. Prices start at $849. Each iPad comes with a standard Apple one-year warranty, outer cases are new, and shipping is free. The following configurations are available: – 12.9″ 64GB WiFi iPad Pro: $849 $150 off – 12.9″ 256GB WiFi iPad Pro: $979 $170 off – 12.9″ 512GB WiFi iPad Pro: $1149 $180 off – 12.9″ 1TB WiFi iPad Pro: $1319 $230 off – 12.9″ 64GB WiFi + Cellular iPad Pro: $979 $170 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1109 $190 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1279 $220 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1449 $250 off Keep an eye on our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Save up to $220 on 11″ iPad Pros with these refurbished mo...
Apple has Certified Refurbished 11″ iPad Pros available on their online store for up to $220 off the cost of new models. Prices start at $679. Each iPad comes with a standard Apple one-year warranty, outer cases are new, and shipping is free. The following configurations are available: – 11″ 64GB WiFi iPad Pro: $679 $120 off – 11″ 256GB WiFi iPad Pro: $809 $140 off – 11″ 512GB WiFi iPad Pro: $979 $170 off – 11″ 1TB WiFi iPad Pro: $1149 $200 off – 11″ 256GB WiFi + Cellular iPad Pro: $939 $160 off – 11″ 512GB WiFi + Cellular iPad Pro: $1109 $190 off – 11″ 1TB WiFi + Cellular iPad Pro: $1279 $220 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

8-Core 27″ iMac Pro available for $4249, Certified Refurbi...
Apple has Certified Refurbished 27″ 3.2GHz 8-Core iMac Pros available for $4249 including free shipping. Their price is $750 off the cost of new models. A standard Apple one-year warranty is included. Apple’s refurbished price is the cheapest currently available for an iMac Pro from → Read More...

Read more »

$749 MacBook Airs continue to be available on Amazon
Amazon has the 2017 13″ 1.8GHz/128GB MacBook Air on sale today for only $749 shipped. That’s $250 off Apple’s original MSRP for this model and the cheapest new MacBook available from any Apple reseller. These are new, unopened clearance MacBook Airs. Keep an eye on our MacBook Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

HomePods on sale for $204 at Other World Computing, $95 off ...
Other World Computing has discounted, new, Apple HomePods on sale for up to $95 off Apple’s MSRP: – HomePod Space Gray: $207.99 $92 off MSRP – HomePod White: $204.99 $95 off MSRP These are the same HomePods sold by Apple in their retail and online stores. Keep an eye on our HomePod Price Tracker for the latest deals and sales from Apple and → Read More...

Read more »

Get a Certified Refurbished iMac at Apple for as little as $...
Apple has Certified Refurbished 2019 21″ & 27″ iMacs available starting at $929 and up to $350 off the cost of new models. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are available: – 27″ 6-Core 3.7GHz iMac (MRR12LL/A): $1949 $350 off MSRP – 27″ 6-Core 3.6GHz iMac (MRR02LL/A): $1699 $300 off MSRP – 27″ 6-Core 3.0GHz iMac (MRQY2LL/A): $1529 $270 off MSRP – 21″ 6-Core 3.0GHz iMac (MRT42LL/A): $1269 $230 off MSRP – 21″ 4-Core 3.6GHz iMac (MNDY2LL/A): $1099 $200 off MSRP – 21″ 2-Core 2.3GHz iMac (MMQA2LL/A): $929 $170 off MSRP Multiple configurations of custom iMacs are also available. Their prices are the cheapest available for 2019 iMacs anywhere. For more information, see our iMac Price Tracker, → Read More...

Read more »

A Look Back At The Top 5 Most Read Stories Of 2019 In The �...
FEATURE: 02.21.20 The best of the best are now history and we’re not talking about Super Bowl LIV from earlier this month but rather, coverage from the past year (its second and first full one at that) of the “Mac Potpourri” column where today we share and take a look back at the most read stories of this writer from 2019 here on MacPrices (returning, I might add, after another short writing hiatus). When you click on the link to any one of my articles, you are just a single individual of many out there in the worldwide web who are reading that story. While some websites show how many page views an article has received, the “Mac Potpourri” column currently does not have that feature — although it does have a Facebook plugin that shows how many likes from readers (which is not an accurate representation of the total number of actual hits) — but behind the scenes, however, we receive those statistics from WordPress, the system that our site is built upon. And that leads us to a short list of data which includes the articles and the number of page views or total hits it has received. From January to December of last year, the following are the top five most read stories of 2019 here in the “Mac Potpourri” column. No. 1: 24,336 Total Hits “With The New iPadOS, Apple Is Paving The Way For A Merger Of iOS & MacOS” EDITORIAL: 07.26.19- The advent of the new iPadOS, — a hybrid-like operating system that is part mobile and part desktop, further blurs the lines between iOS, “the world’s most advanced mobile operating system,” and MacOS, “the world’s most advanced desktop operating system,” and this latest move by Apple suggests that an impending merger of its two operating systems is on the horizon, something that continues to look even more likely than ever before (if not definitely). … • www.macprices.net/2019/07/26/with-the-new-ipados-apple-is-paving-the-way-to-a-forthcoming-merger-of-ios-macos/ No. 2: 15,450 Total Hits “iPhone SE Successor Possibly To Come In Form Of New 4.8-inch ‘XE’ Model” NEWS: 04.15.19- Current owners of the iPhone SE who are fans of the smaller 4-inch form factor in Apple’s smartphone → Read More...

Read more »

Apple offers wide range of discounted custom 21″ and 27″...
Save up to $610 on a custom-configured 21″ or 27″ iMac with these Certified Refurbished models available at Apple. Each iMac features a new outer case, free shipping, and includes Apple’s standard 1-year warranty. You won’t find cheaper custom configurations anywhere else. See our iMac Price Tracker for the latest sales & prices from Apple and its resellers as well as Apple’s stock iMac configurations The following models were available on Apple’s site today. Stock is likely to come and go, so check their site for current availability: – 21″ 3.6GHz iMac 16GB RAM/1TB HD/Radeon Pro 555X:$1269 Apple Certified Refurbished $230 off MSRP – 21″ 3.6GHz iMac 8GB RAM/512GB SSD/Radeon Pro 555X:$1439 Apple Certified Refurbished $260 off MSRP – 21″ 3.6GHz iMac 16GB RAM/512GB SSD/Radeon Pro 555X:$1609 Apple Certified Refurbished $290 off MSRP → Read More...

Read more »