Tim Cook says he believes China is getting coronavirus ‘un...
While Apple has acknowledged the impact of coronavirus on its supply chain and product demand in China, CEO Tim Cook seems to think the situation is improving in China. In an interview with Fox Business this afternoon, Cook explained his thinking as well as Apple’s ongoing work in China. more… The post Tim Cook says he believes China is getting coronavirus ‘under control’ appeared first on 9to5Mac.

Read more »

Apple AR tech will bring Alabama civil rights history to lif...
In Birmingham today, Apple CEO Tim Cook announced Ed Farm, which will help teach students to program with Apple’s “Everyone Can Code” curriculum. In addition, Cook  reportedly spoke about employing his company’s augmented reality tools in Birmingham’s civil rights historical sites. Apple plants an Ed Farm in Alabama Details on this newly-announced education initiative are […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Shazam adds Apple Music integration to its Android app
Apple Music might not be the first thing you’d think of for Android users, but as the service grows in popularity many have been converting. Apple has also had a solid track record of updating its Android app with new features. Now, Shazam for Android is adding Apple Music integration. more… The post appeared first on 9to5Mac.

Read more »

Airbnb’s Secret Algorithms Plunder Your Social Media
Airbnb uses a secret algorithm to figured out how trustworthy you are, and it mines your social media for sex work, porn, drugs, and more.

Read more »

Review: Anker’s Nebula Mars II is a solid AirPlay proj...
The Anker Nebula Mars II speaker is a compact portable project that allows you to turn any wall into the big screen. Watch movies, play games, catch up on sports, and binge peak TV anywhere you have an open space, either wired or wire-free.

Read more »

Has Apple CEO Tim Cook made Apple too dependent on China?
Apple today seeing the biggest losses on the Dow. This has led some observers to ask if Apple CEO Tim Cook has made Apple too dependent on China… The post appeared first on MacDailyNews.

Read more »

Apple CEO Cook ‘optimistic’ China getting handle on coro...
Apple CEO Tim Cook said he is “optimistic” that China is starting to contain the coronavirus outbreak. Cook also said device production stalled by quarantines and travels restrictions are now in “ramp mode.” Cook’s comments came during an interview Wednesday with Susan Li of FOX Business. It feels to me that China is getting the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Samsung had the most successful Android phones, but iPhone d...
Samsung is the biggest smartphone maker on the planet, but Apple’s tight reigns on the US market give the company a run for its money. Now, a report on last year’s numbers reveals that Apple absolutely dominated the US market while Samsung had the most successful Android phones of 2019. more… The post Samsung had the most successful Android phones, but iPhone dominated 2019’s top 10 appeared first on 9to5Mac.

Read more »

“First in Flight”: The story of a unique photograph
This article combines two of my passions - motorcycling and photography. Jones is an incredible MotoGP photographer and the story of this amazing image is a combination of luck, perseverance, skill, equipment, and a talented shooter all coming together to get The Perfect Shot. Imagine trying to get a specific image (both wheels off the ground, race winner, etc.) of a motorcycle traveling at 165mph coming up over a blind hill.∞ Read this on The Loop

Read more »

[Update: Now available] Zagg unveils new 10.2-inch iPad keyb...
At CES 2020 this week, Zagg Brands has unveiled a new collection of accessories for Apple’s 10.2-inch iPad, as well as a new Mophie Powerstation Go portable battery, and more. more… The post [Update: Now available] Zagg unveils new 10.2-inch iPad keyboards, new Mophie charger, more appeared first on 9to5Mac.

Read more »

Proposed EU law looks to force Apple iPhone to have removabl...
Leaked EU proposals could force smartphone manufacturers to to make all smartphones, including Apple's iPhone, to feature removable batteries… The post Proposed EU law looks to force Apple iPhone to have removable batteries appeared first on MacDailyNews.

Read more »

How to stop your UWB-equipped iPhone 11 from tracking you
iOS tracks your location to see if UWB is legal at your current location, and toggles the U1 chip accordingly. Switch this off, if you like. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Will Apple cancel WWDC 2020 due to coronavirus?
Mobile World Congress was one of the first major international events canceled this year due to the coronavirus epidemic. Now as the virus continues to spread, more tough decisions are being made like Facebook canceling its F8 Developers Conference that was scheduled for May. With June around the corner and Apple’s developer conference attracting attendees from all around the world, will Apple have to cancel WWDC 2020? more… The post appeared first on 9to5Mac.

Read more »

Coronavirus forces ‘Plague Inc’ game off the Chi...
The ongoing coronavirus outbreak in China has led to popular game "Plague Inc" to be pulled from the country's App Store after China decided it was illegal -- despite having been available for eight years.

Read more »

9to5Mac Daily: February 27, 2020 – OTA recovery feature fo...
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Hyper:  Hyper’s next-gen of USB-C Hubs is now available to preorder. Thanks to Hyper, we’re also giving 9to5Mac readers the chance to win Apple’s new Mac Pro worth $6000 this month.

Read more »

Tim Cook optimistic that coronavirus is getting under contro...
In an excerpt from an interview that will Air on Friday, Apple CEO Tim Cook says that he is hopeful that coronavirus is starting to get under control in China, and factories are coming back online.

Read more »

To Key Operations Execs Are Leaving Apple
Two long-serving Apple execs, Nick Forlenza and Duco Pasmooij, are leaving the company’s operations division.

Read more »

Two Key Operations Execs Are Leaving Apple
Two long-serving Apple execs, Nick Forlenza and Duco Pasmooij, are leaving the company’s operations division.

Read more »

China Says That Plague Inc. Game is Illegal, Gets Removed Fr...
Ndemic Creations, the creator of the popular game Plague Inc. received a warning from China that the game contained illegal content.

Read more »

Don’t Expect Apple TV+ to Move Beyond Original Content Any...
Comments from Tim Cook at the Apple shareholder meeting indicate that Apple TV+ will continue to focus solely on original content.

Read more »

Steinberg’s new USB-C audio interface for Mac/iOS features...
Steinberg is adding to its lineup of USB-C Mac interfaces today with the new UR24C two-channel model. After installing going on sale back in September of last year, Steinberg’s UR-C line of audio interfaces is seeing an interesting addition today with the latest entry int he family. With some interesting headphone monitoring options in tow for stage performers and studio producers, the new UR24C falls int he middle of the line offering up an affordable option for musicians that need a little bit more than the base model UR22C can offer. Head below for a closer look. more… The post Steinberg’s new USB-C audio interface for Mac/iOS features split DJ monitoring appeared first on 9to5Mac.

Read more »

Spotify for iOS gets new Shuffle Play button and other UI tw...
Spotify is rolling out some big UI changes as part of its latest update for its iOS app. The new UI tweaks bring a more streamlined experience to Apple Music’s biggest rival, including a universal ‘Shuffle Play’ button that combines the app’s two most-pressed icons into one button. Subscribers of both the free and paid […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Hidden ways to save up to $3,000 on Apple Mac Pros at B&...
With powerful components and a sleek design, the Mac Pro is a high-performance rig that is incredibly quiet, making it an excellent choice for music producers. But with 5,000+ configurations to choose from, it can be hard selecting the perfect set of specs. Luckily, with these hidden ways to save up to $3,000 on the 2019 Mac Pro, the choice got a whole lot easier.

Read more »

Zyxel 0day Affects its Firewall Products, Too
On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products.

Read more »

Red Hat Security Advisory 2020-0568-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Zyxel Fixes 0day in Network Storage Devices
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a "ZyXEL") is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

Read more »

Switch default apps on iPhone or iPad for better security an...
Modern operating systems, both on the desktop and on mobile devices, include plenty of “stock apps”—apps provided by default so you can use your device without needing a lot of third-party software. You get an email app, a calendar, a web browser, a messaging app, and more. This wasn’t always the case; I remember when […]

Read more »

Red Hat Security Advisory 2020-0559-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Hackers Were Inside Citrix for Five Months
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.

Read more »

Encoding Stolen Credit Card Data on Barcodes
Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the U.S. Secret Service, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code.

Read more »

Red Hat Security Advisory 2020-0515-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability has been addressed.

Read more »

Pay Up, Or We’ll Make Google Ban Your Ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google's AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher's ads with so much bot and junk traffic that Google's automated anti-fraud systems suspend the user's AdSense account for suspicious traffic.

Read more »

Vulnerability Summary for the Week of February 10, 2020
Original release date: February 17, 2020The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- framemaker   Adobe Framemaker versions 2019.0.4 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-02-13 10 CVE-2020-3740CONFIRM ajaxeplorer -- ajaxeplorer   Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php). 2020-02-11 10 CVE-2013-4267MISCMISCMISC artica -- pandora_fms   functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. 2020-02-12 9 CVE-2020-8947MISCMISCMISC atutor -- atutor   confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. 2020-02-11 7.5 CVE-2014-9753MISCMISCMISCMISCMISC belkin -- n300_router   An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." 2020-02-07 10 CVE-2013-3091MISCMISCMISC biscom -- secure_file_transfer   Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. 2020-02-07 7.5 CVE-2020-8796MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/175922 bosch -- bvms_mobile_video_service   Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = V3.0), SCALANCE S612 (All versions >= V3.0), SCALANCE S623 (All versions >= V3.0), SCALANCE S627-2M (All versions >= V3.0). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. 2020-02-11 5 CVE-2019-13925MISC siemens -- multiple_scalance_switches   A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (all versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (all versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known. 2020-02-11 4.3 CVE-2019-13924MISC siemens -- multiple_simatic_devices   A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 PN/DP CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions). Affected devices contain a vulnerability that could cause a Denial-of-Service condition of the web server by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device’s web server. Beyond the web service, no other functions or interfaces are affected by the Denial-of-Service condition. 2020-02-11 5 CVE-2019-13940MISCMISC siemens -- ozw672_and_772_web_servers   A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system. 2020-02-11 5 CVE-2019-13941MISC simple_machines -- simple_machines_forum   File Disclosure in SMF (SimpleMachines Forum) character exists. This causes a denial of service in which the recipient cannot read all of their messages. 2020-02-12 not yet calculated CVE-2020-7957CONFIRMCONFIRMMISC dovecot -- dovecot   lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. 2020-02-12 not yet calculated CVE-2020-7046CONFIRMCONFIRMMISC drupal -- drupal   The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field. 2020-02-11 not yet calculated CVE-2013-4225MISCMISCMISCMISC easyxdm -- easyxdm   Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file. 2020-02-14 not yet calculated CVE-2013-5212MISCXF etherpad -- etherpad   Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297. 2020-02-13 not yet calculated CVE-2015-3309MISCMISCMISC extrun -- ilbo   ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors. 2020-02-14 not yet calculated CVE-2020-5532MISCMISCMISC fasterxml -- jackson-databind   FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 2020-02-10 not yet calculated CVE-2020-8840MISC foxit -- phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400. 2020-02-14 not yet calculated CVE-2020-8846MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560. 2020-02-14 not yet calculated CVE-2020-8855MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9358. 2020-02-14 not yet calculated CVE-2020-8845MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9591. 2020-02-14 not yet calculated CVE-2020-8853MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of JPEG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9606. 2020-02-14 not yet calculated CVE-2020-8854MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9640. 2020-02-14 not yet calculated CVE-2020-8856MISCMISC foxit -- reader This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9416. 2020-02-14 not yet calculated CVE-2020-8852MISCMISC foxit -- reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862. 2020-02-14 not yet calculated CVE-2020-8857MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9414. 2020-02-14 not yet calculated CVE-2020-8847MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9406. 2020-02-14 not yet calculated CVE-2020-8851MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9407. 2020-02-14 not yet calculated CVE-2020-8848MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9415. 2020-02-14 not yet calculated CVE-2020-8850MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413. 2020-02-14 not yet calculated CVE-2020-8849MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102. 2020-02-14 not yet calculated CVE-2020-8844CONFIRMMISC free_reprintables -- articlefr   A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information. 2020-02-13 not yet calculated CVE-2014-4170MISCMISCMISCMISC freebsd -- bsd_libc   regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. 2020-02-12 not yet calculated CVE-2011-3336FULLDISCBIDMISCBUGTRAQ fujitsu -- multiple_products   The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V11 and other versions, Interstage Job Workload Server V8, Interstage List Works V10 and other versions, Interstage Studio V12 and other versions, Interstage Web Server Express V11, Linkexpress V5, Safeauthor V3, ServerView Resource Orchestrator V3, Systemwalker Cloud Business Service Management V1, Systemwalker Desktop Keeper V15, Systemwalker Desktop Patrol V15, Systemwalker IT Change Manager V14, Systemwalker Operation Manager V16 and other versions, Systemwalker Runbook Automation V15 and other versions, Systemwalker Security Control V1, and Systemwalker Software Configuration Manager V15. 2020-02-07 not yet calculated CVE-2019-13163CONFIRM git -- git   Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. 2020-02-12 not yet calculated CVE-2014-9390MISCMISCMISCMISCMISCMISCMISC gitlab -- gitlab   GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. 2020-02-14 not yet calculated CVE-2019-15592MISCMISC gitlab -- gitlab   GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. 2020-02-14 not yet calculated CVE-2019-15594MISCMISC global_payments -- php-sdk   Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. 2020-02-14 not yet calculated CVE-2019-20455MISCMISC gocloud -- mutliple_devices   Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring. 2020-02-12 not yet calculated CVE-2020-8949MISC google -- android In notifyNetworkTested and related functions of NetworkMonitor.java, there is a possible bypass of private DNS settings. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-122652057 2020-02-13 not yet calculated CVE-2020-0028MISC google -- android   In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-141552859 2020-02-13 not yet calculated CVE-2020-0005MISC google -- android   It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520 2020-02-13 not yet calculated CVE-2020-0014MISC google -- android   In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel 2020-02-13 not yet calculated CVE-2020-0030MISC google -- android   The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. 2020-02-12 not yet calculated CVE-2011-2343CONFIRMMISC google -- android   In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-67319274 2020-02-13 not yet calculated CVE-2019-2200MISC google -- android   In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139017101 2020-02-13 not yet calculated CVE-2020-0015MISC google -- android   In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140419401 2020-02-13 not yet calculated CVE-2020-0026MISC google -- android   In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892 2020-02-13 not yet calculated CVE-2020-0017MISC google -- android   In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049 2020-02-13 not yet calculated CVE-2020-0018MISC google -- android   In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144040966 2020-02-13 not yet calculated CVE-2020-0027MISC google -- android   In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731 2020-02-13 not yet calculated CVE-2020-0020MISC google -- android   In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could lead to remote denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141413692 2020-02-13 not yet calculated CVE-2020-0021MISC google -- android   In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715 2020-02-13 not yet calculated CVE-2020-0022FULLDISCMISC google -- android   In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871 2020-02-13 not yet calculated CVE-2020-0023MISC hashicorp -- sentinel HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. 2020-02-14 not yet calculated CVE-2019-19879MISC hcl -- appscan_standard_edition   HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. 2020-02-14 not yet calculated CVE-2019-4392MISC hitachi -- command_suite_and_automation_director   A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21032MISCCONFIRM hitachi -- multiple_products   A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21033MISCCONFIRM hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7208MISC hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7209MISC ibm -- tivoli_monitoring_service   IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647. 2020-02-13 not yet calculated CVE-2019-4592XFCONFIRM ibm -- urbancode_deploy_and_urbancode_build IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248. 2020-02-13 not yet calculated CVE-2019-4666XFCONFIRMCONFIRM intel -- converged_security_and_management_engine   Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access. 2020-02-13 not yet calculated CVE-2019-14598MISC intel -- e1000e/82574l_network_controller_devices   A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex, 33 hex, or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image. 2020-02-13 not yet calculated CVE-2013-1634MISCMISCMLISTMLISTSECTRACKXF intel -- manycore_platform_software_stack   Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0563MISC intel -- renesas_electronics_usb   Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0560MISC intel -- sgx_software_development_kit Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0561MISC intel --  raid_web_console_2 Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0562MISC intel --  raid_web_console_3_for_windows Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0564MISC invision_power_services -- invision_power_board   Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. 2020-02-12 not yet calculated CVE-2013-3725MISC istio -- istio   An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4. 2020-02-14 not yet calculated CVE-2020-8843MISCMISCCONFIRM joomla! -- joomla!   Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. 2020-02-12 not yet calculated CVE-2011-4906CONFIRMEXPLOIT-DBMISC joomla! -- joomla!   TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. 2020-02-12 not yet calculated CVE-2011-4908MISCEXPLOIT-DBMLIST jsreport -- jsreport   An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8128MISC jsreport -- script-manager   An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8129MISC juniper -- junos_os   Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. 2020-02-11 not yet calculated CVE-2014-6447CONFIRMMISC kaseya -- virtual_system_administrator   Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. 2020-02-13 not yet calculated CVE-2015-6589MISCMISCMISCMISC kde -- paste_applet   The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack. 2020-02-11 not yet calculated CVE-2013-2120MISCMISCMISCMISCMISC kde -- paste_applet   The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output. 2020-02-11 not yet calculated CVE-2013-2213MISCMISCMISC kinetica -- kinetica   The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command. 2020-02-11 not yet calculated CVE-2020-8429MISCMISC lenovo -- ez_media_&_backup_center A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page. 2020-02-14 not yet calculated CVE-2019-19758CONFIRM lenovo -- multiple_devices   Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled. 2020-02-14 not yet calculated CVE-2019-6190CONFIRM lenovo -- xclarity_administrator   An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. 2020-02-14 not yet calculated CVE-2019-19757CONFIRM lenovo -- xclarity_administrator   An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. 2020-02-14 not yet calculated CVE-2019-6194CONFIRM lenovo -- xclarity_administrator   An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes. 2020-02-14 not yet calculated CVE-2019-6193CONFIRM lenovo -- xclarity_controller   An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. 2020-02-14 not yet calculated CVE-2019-6195CONFIRM lexmark -- multiple_devices   Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. 2020-02-13 not yet calculated CVE-2019-18791MISCCONFIRM libuv -- libuv   The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition. 2020-02-11 not yet calculated CVE-2014-9748MISCMISCMISCMISCMISC linux -- linux_kernel   ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. 2020-02-14 not yet calculated CVE-2020-8992MISC lvm2 -- lvm2   vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. 2020-02-14 not yet calculated CVE-2020-8991MISC magento -- magento Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. 2020-02-13 not yet calculated CVE-2012-6091MLISTBIDXF mailu -- mailu   In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354 2020-02-13 not yet calculated CVE-2020-5239MISCCONFIRM mambo -- mambo_cms Mambo CMS through 4.6.5 has multiple XSS. 2020-02-12 not yet calculated CVE-2011-2499MLIST mantisbt -- mantisbt   A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. 2020-02-13 not yet calculated CVE-2020-8981MISCMISC matestack-ui-core_gem_for_ruby_on_rails -- matestack-ui-core_gem_for_ruby_on_rails matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. 2020-02-13 not yet calculated CVE-2020-5241CONFIRM maxum_development_corporation -- rumpus_ftp   A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html. 2020-02-10 not yet calculated CVE-2019-19664MISCMISC maxum_development_corporation -- rumpus_ftp_server   A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html. 2020-02-10 not yet calculated CVE-2019-19662MISCMISC mcafee -- endpoint_security   Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. 2020-02-14 not yet calculated CVE-2020-7251CONFIRM microsoft -- multiple_windows_products An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0728MISCBUGTRAQ microsoft -- multiple_windows_products An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0714MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0745, CVE-2020-0792. 2020-02-11 not yet calculated CVE-2020-0715MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0727MISC microsoft -- multiple_windows_products   A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0708MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0719, CVE-2020-0720, CVE-2020-0721, CVE-2020-0722, CVE-2020-0723, CVE-2020-0724, CVE-2020-0725, CVE-2020-0726, CVE-2020-0731. 2020-02-11 not yet calculated CVE-2020-0691MISC microsoft -- office_online_server   A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0695MISC microsys -- promotic   Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service. 2020-02-13 not yet calculated CVE-2014-1617MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. 2020-02-13 not yet calculated CVE-2013-7287MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm 2020-02-12 not yet calculated CVE-2013-7286MISCMISC moxa -- mgate_5105-mb-eip_devices   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. 2020-02-14 not yet calculated CVE-2020-8858MISCMISC netgear -- cg3100_devices   A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information. 2020-02-13 not yet calculated CVE-2014-3919MISC netis -- wf2471_devices   Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter. 2020-02-12 not yet calculated CVE-2020-8946MISC nvidia -- graphics_drivers   A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. 2020-02-12 not yet calculated CVE-2012-0951MISCMISC nxp -- kw41z_devices   The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet. 2020-02-12 not yet calculated CVE-2019-17519MISC openconnect_project -- openconnect_vpn_client OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection. 2020-02-13 not yet calculated CVE-2013-7098CONFIRM openvpn -- access_server OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). 2020-02-13 not yet calculated CVE-2020-8953CONFIRM openx -- openx_ad_server   A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code 2020-02-14 not yet calculated CVE-2013-4211MISCMISCMISCMISCMISC otrs -- itsm_and_faq   A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code. 2020-02-12 not yet calculated CVE-2013-2637MISCMISCMISCMISC palo_alto_networks -- expedition_migration_tool   Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions. 2020-02-12 not yet calculated CVE-2020-1977CONFIRM palo_alto_networks -- globalprotect   A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS. 2020-02-12 not yet calculated CVE-2020-1976CONFIRM palo_alto_networks -- pan-os   Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. 2020-02-12 not yet calculated CVE-2020-1975CONFIRM pcre -- pearl_compatible_regular_expressions   An out-of-bounds read was discovered in PCRE before 10.34 when the pattern X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. 2020-02-14 not yet calculated CVE-2019-20454MISCMISCMISCMISC podman -- podman   A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. 2020-02-11 not yet calculated CVE-2020-1726CONFIRM prestashop -- prestashop   PrestaShop before 1.4.11 allows logout CSRF. 2020-02-14 not yet calculated CVE-2013-4792MISC prestashop -- prestashop   PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. 2020-02-14 not yet calculated CVE-2013-4791MISC prismview -- prismview_system_and_prismview_player   The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.) 2020-02-10 not yet calculated CVE-2019-20451MISC proglottis -- gpgme   The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. 2020-02-12 not yet calculated CVE-2020-8945MISCMISCMISCMISC progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. 2020-02-14 not yet calculated CVE-2020-8611MISCCONFIRMCONFIRMCONFIRM progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS. 2020-02-14 not yet calculated CVE-2020-8612MISCCONFIRMCONFIRMCONFIRM python-mode -- python-mode A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. 2020-02-12 not yet calculated CVE-2013-5106MISC qemu -- qemu   An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. 2020-02-11 not yet calculated CVE-2020-1711CONFIRMMISCMISC qnap -- viocard-300_devices   QNAP VioCard 300 has hardcoded RSA private keys. 2020-02-13 not yet calculated CVE-2013-6277MISCMISC realtek -- ndis_driver_rt64x64.sys   Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0. 2020-02-12 not yet calculated CVE-2019-11867MISCMISC red_hat -- openshift_enterprise   The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. 2020-02-12 not yet calculated CVE-2014-0234MISCMISCMISCMISCMISC runc -- runc   runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) 2020-02-12 not yet calculated CVE-2019-19921SUSEMISCMISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. 2020-02-13 not yet calculated CVE-2020-8804MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. 2020-02-13 not yet calculated CVE-2020-8803MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. 2020-02-13 not yet calculated CVE-2020-8802MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows PHAR Deserialization. 2020-02-13 not yet calculated CVE-2020-8801MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. 2020-02-13 not yet calculated CVE-2020-8800MISCMISCMISC samsung -- s6_edge_smartphone   Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter. 2020-02-12 not yet calculated CVE-2015-7890MISCMISCMISC sap -- business_objects_intelligence_platform Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6189MISCMISC sap -- enterprise_resource_planning_and_s/4hana   VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check. 2020-02-12 not yet calculated CVE-2020-6188MISCMISC sap -- host_agent SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability. 2020-02-12 not yet calculated CVE-2020-6183MISCMISC sap -- host_agent   SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6186MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management. 2020-02-12 not yet calculated CVE-2020-6192MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation. 2020-02-12 not yet calculated CVE-2020-6191MISCMISC sap -- mobile_platform   SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server. 2020-02-12 not yet calculated CVE-2020-6177MISCMISC sap -- netweaver   SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6187MISCMISC sap -- netweaver   SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6193MISCMISC sap -- netweaver_and_abap_platform   Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability. 2020-02-12 not yet calculated CVE-2020-6181MISCMISC sap -- netweaver_and_s/4hana Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6184MISCMISC sap -- netweaver_and_s/4hana   Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability. 2020-02-12 not yet calculated CVE-2020-6185MISCMISC sap -- netweaver_as_java   Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6190MISCMISC shaman -- shaman   Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password. 2020-02-12 not yet calculated CVE-2011-4338MISCMISC siemens -- multiple_devices   A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All Versions < V4.5), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All Versions < V4.6), PROFINET Driver for Controller (All Versions < V2.1), RUGGEDCOM RM1224 (All versions < V4.3), SCALANCE M-800 / S615 (All versions < V4.3), SCALANCE W700 IEEE 802.11n (All versions

Read more »

Cryptocurrency 101 – Part 1: Blockchain and basic concepts
This is the first in a series of articles exploring Bitcoin, cryptocurrencies and their fundamental technologies, and how you might find these technologies useful and use them safely. You’ve likely heard about Bitcoin, which is a type of cryptocurrency or digital currency, and perhaps you’ve wondered what all the fuss is about. What exactly are […]

Read more »

13″ 1.4GHz Silver MacBook Pros on sale for $150 off Apple�...
B&H Photo has new 2019 13″ 1.4GHz Silver MacBook Pros on sale for $150 off Apple’s MSRP today with prices starting at $1149. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1349 $150 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple resellers offer $150-$170 discounts on new 13″ MacBo...
Amazon has new 2019 13″ MacBook Airs on sale for $150-$170 off Apple’s MSRP, with prices starting at $949, each including free shipping. These are the same MacBook Airs Apple sells in their retail and online stores. Be sure to select Amazon as the seller during checkout, rather than a third party: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $949 $150 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1129 $170 off MSRP B&H Photo has 13″ MacBook Airs prices on sale starting at $949 as well. Overnight shipping is free to many locations in the US: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $949 $150 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $949 $150 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1129 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1129 $170 off MSRP For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

B&H is again offering $100 discounts on Mac minis with m...
B&H Photo has 4-Core and 6-Core Mac minis on sale for $100 off Apple’s standard MSRP, with prices starting at only $699. Overnight shipping is free to many US addresses: – 3.6GHz Quad-Core mini: $699 $100 off MSRP – 3.0GHz 6-Core mini: $999 $100 off MSRP These are the same Mac minis sold by Apple in their retail and online stores. B&H’s prices are the lowest currently available from any Apple reseller. Keep an eye on our Mac mini Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

B&H Photo drops iMac prices, offers models for up to $25...
B&H Photo has new 2019 21″ and 27″ 5K iMacs in stock today and on sale for up to $250 off Apple’s MSRP, with prices starting at only $999. These are the same iMacs sold by Apple in their retail and online stores, and B&H’s prices are the lowest available for these models: – 27″ 3.0GHz 6-Core 5K iMac: $1599 $200 off MSRP – 27″ 3.1GHz 6-Core 5K iMac: $1799 $200 off MSRP – 27″ 3.7GHz 6-Core 5K iMac: $2049 $250 off MSRP – 21″ 2.3GHz 2-Core iMac: $999 $100 off MSRP – 21″ 3.6GHz 4-Core 4K iMac: $1149 $150 off MSRP – 21″ 3.0GHz 6-Core 4K iMac: $1329 $170 off MSRP See our iMac Price Tracker for the latest sales and prices from Apple and → Read More...

Read more »

Flash sale! 11″ 64GB WiFi iPad Pro for $674, $125 off Appl...
Walmart has the 11″ 64GB WiFi iPad Pro on sale on their online store today for $674. That’s $125 off Apple’s MSRP for this model and the cheapest price available from any Apple reseller. Choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price → Read More...

Read more »

Sale! Get the 256GB 13″ Silver MacBook Air for $300 off to...
Amazon has new 2019 13″ 1.6GHz/256GB MacBook Airs, in Silver, on sale today for only $999 shipped. Their price is $300 off Apple’s MSRP for this model, and it’s the cheapest price for a 256GB MacBook Air from any Apple reseller. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Check their site for the latest availability of this MacBook Air. See our 13″ MacBook Air Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Verizon offers free iPhone 7 to customers opening new line o...
Verizon is offering a free 32GB iPhone 7 for new or existing customers who open a new line of service, no trade-in required. Cost of the phone is credited to your account monthly over 24 months. The fine print: “$349.99 purchase on device payment or at retail price & new smartphone line req’d. Less $349.99 promo credit applied to account over 24 mos; promo credit ends if eligibility req’s are no longer met; 0% APR.” This deal is live at → Read More...

Read more »

Sale! 10.5″ 256GB WiFi iPad Air for $549, $100 off Apple�...
Amazon has new 10.5″ 256GB WiFi iPad Airs, in Space Gray, on sale today for $549 shipped. Their price is $100 off Apple’s MSRP for this model, and it’s the cheapest price available from any Apple reseller. Keep an eye on our 10.5″ iPad Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

Back on sale! Apple’s new Mac Pro for $5499, $500 off MSRP...
B&H Photo has the base 2019 Mac Pro (3.5GHz 8-Core Xeon, 32GB RAM, 256GB SSD) in stock today and on sale for $5499 including free overnight delivery to many addresses in the US. Their price is $500 off Apple’s MSRP, and it’s the cheapest price currently available for a new Mac Pro anywhere. Multiple custom configurations are also available for order, although only a few are in stock and ready for shipping. See their site for details. Keep an eye on our Mac Pro Price Tracker, as well as our Pro Display XDR Price Tracker, for the latest prices & deals from Apple and → Read More...

Read more »

B&H offers $100 discount on base 13″ 1.4GHz Apple MacB...
B&H Photo has new 2019 13″ 1.4GHz MacBook Pros on sale for $100 off Apple’s MSRP today with prices starting at $1199. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros sold by Apple in their retail and online stores. B&H’s prices are the lowest available for new 13″ MacBook Pros: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1199 $100 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1199.99 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1399 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1399.99 $100 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple continues to offer Certified Refurbished iPhone XS mod...
Apple has Certified Refurbished iPhone XS models available for up to $350 off MSRP, with prices starting at $699. Each iPhone is unlocked and comes with Apple’s standard one-year warranty and a new outer case. Multiple colors are available: – 64GB iPhone XS: $699 save $200 – 256GB iPhone XS: $829 save $230 – 512GB iPhone XS: $999 save $350 – 64GB iPhone XS Max: $799 save $200 – 256GB iPhone XS Max: $929 save $230 – 512GB iPhone XS Max: $1099 → Read More...

Read more »

Apple AirPods are on sale for $30 off today
Amazon has new 2019 Apple AirPods (non-Pro models) on sale today for $30 off MSRP, starting at $129. Shipping is free: – AirPods with Wireless Charging Case: $169 $30 off MSRP – AirPods with Charging Case: $129.98 $30 off MSRP See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »