ScreenFlow 10.0
Major upgrade to the screencast recording and video editing app with new simultaneous screen, camera, and microphone recording. ($129 new, upgrade pricing available, 85.4 MB, macOS 10.15+)

Read more »

A look back at the evolution of iPhone hardware with GRID frames [Gallery]
It has been 14 years since the first iPhone was introduced by Steve Jobs, and a lot has changed since then. Each generation of the iPhone has brought unique advances that are sometimes hard to notice, but that have made a difference when we look back at the past. And that’s what I did with GRID frames. more… The post appeared first on 9to5Mac.

Read more »

Apple tells Epic judge to consider Supreme Court NCAA decision
Apple's legal team submitted a decision by the US Supreme Court about the NCAA to the court over its lawsuit with Epic Games, claiming the decision "provides guidance" that the judge should consider for her own decision over the fate of the App Store.Apple's main trial activity with Epic finished in May, with both sides now awaiting a decision from Judge Yvonne Gonzalez Rogers on the matter. While the wait continues, Apple's lawyers are taking advantage of a Supreme Court decision to help its case.The filing, spotted by Stephen Totilo, refers to the decision on the case of the National Collegiate Athletic Association v Alston, et al. The decision from June 21 is attached in full to the filing, intended to be read by Judge Rogers. Read more...

Read more »

Tinderbox 9.0
Note-taking assistant upgraded with support for M1-based Macs and a new command bar. ($249 new, free update, 47.4 MB, macOS 10.13+)

Read more »

Zoom 5.7
Brings a variety of new features and improvements to the video conferencing app. (Free, 25.3 MB, macOS 10.9+)

Read more »

PDFpen and PDFpenPro 13.1
Improves the speed of scrolling and drawing on larger PDF documents. ($79.95/$129.95 new, $35 upgrade, free update for version 13, 212/259 MB, macOS 10.14+)

Read more »

SolarWinds hackers stole data from Microsoft's customer support system
A hacking group believed to be responsible for the SolarWinds breaches used access to Microsoft's support tools via a compromised customer service agent's computer, a breach that enabled the hackers to perform further hacks against Microsoft's customers.Disclosed on Friday via a blog post, Microsoft confirmed its investigation into the Nobelium hacking group found "information-stealing malware" on a computer used by a customer support agent. As the computer had access to "basic account information for a small number" of customers, Microsoft believes the data was used to launch "highly-targeted attacks."Microsoft claimed to have "responded quickly" to the breach, removing access and securing the device. Support agents are also allegedly configured with the "minimal set of permissions required" as part of Microsoft's Zero Trust "leased privileged access" approach regarding customer information. Read more...

Read more »

How to delete Time Machine local snapshots in macOS
Apple's Time Machine is an essential file backup tool for macOS, but it too has a backup that works off your Mac's primary drive. Here's how Time Machine's local snapshots work, and how to get rid of them if you want them gone.Most Mac users are very familiar with Time Machine, Apple's fantastic utility for keeping multiple copies of files backed up and accessible within minutes. Many will have favorable opinions of the tool, especially after using it to rescue an accidentally deleted, edited, or corrupted file that's urgently needed for a task.It's likely that many people think that Time Machine also only uses an external drive to house the files, but this isn't quite true. In fact, part of its functionality takes place on the primary storage of the Mac, in a feature called local snapshots. Read more...

Read more »

iOS 15 brings big changes to Safari — but don’t worry [Cult of Mac Magazine 407]
I’m too terrified to put the iOS 15 beta on my iPhone. Luckily, Cult of Mac writer Ed Hardy isn’t afraid to sacrifice his smartphone’s stability — and maybe his sanity. He’s been selflessly testing the next-gen operating system to evaluate the changes coming soon to an iPhone near you. And he’s ready to tell […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iOS 15 brings big changes to Safari — but don’t worry [Cult of Mac Magazine 407]
I’m too terrified to put the iOS 15 beta on my iPhone. Luckily, Cult of Mac writer Ed Hardy isn’t afraid to sacrifice his smartphone’s stability — and maybe his sanity. He’s been selflessly testing the next-gen operating system to evaluate the changes coming soon to an iPhone near you. And he’s ready to tell […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iPhone hotspots in iOS 15 to gain WPA3 security
The rollout of iOS 15 and iPadOS 15 this fall will help improve the security of iPhones and iPads as a Wi-Fi hotspot, with Apple including support for the improved WPA3 protocol for the feature in the operating systems.Users of iPhones and iPads on iOS 14 and iPadOS 14 will be familiar with using their devices as a Wi-Fi hotspot, connecting their other devices to share their iPhone's cellular connection. However, these impromptu hotspots are currently only able to offer connectivity over WPA2.With the introduction of iOS 15 and iPadOS 15, the inclusion of WPA3 support should help make the wireless hotspots more secure, reports MacRumors. While Apple devices are capable of connecting to existing WPA3 networks, the hotspot feature of iPhones didn't offer the option to use the protocol, which will change in the next milestone operating system release. Read more...

Read more »

Today in Apple history: The App Store gold rush begins
June 26, 2008: Apple sends an email to developers, calling for software to be distributed in the forthcoming App Store. Devs around the world greet the news with excitement. They hurry to submit their apps and get in on the looming App Store gold rush. Many rake in small fortunes when the App Store goes live […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

M1 MacBook Air is the best laptop at $999 (and $899 for students/teachers)
Apple unveiled the M1 MacBook Air at its special event in November last year. The machine happens to offer the best value for money ... Read more The post appeared first on iLounge.

Read more »

ScreenShot Tips for iPhone
In Mac Geek Gab 877 we covered how to use OnyX to control where your screenshots are saved.

Read more »

Telegram for iOS updated with group video calls, screen sharing, animated backgrounds, more
Telegram for iOS received a major update this week. After months of teasing and testing, Group Video Calls is finally available to all users and on all devices, including tablets and desktops more… The post appeared first on 9to5Mac.

Read more »

Chip shortage to get worse before it gets better, says Intel CEO
The global chip shortage will continue to worsen for the time being, according to Intel CEO Pat Gelsinger, with the industry forecast to endure a worsening situation throughout the second half of 2021, before there's any real hope of recovery.The shortage in semiconductor production affecting the supply of chips for electronic devices is thought to not quite reach its worst stage yet, the chief of Intel believes. Speaking in an interview, Gelsinger proposes the shoratage could reach that point before the end of 2021.A lack of supply of semiconductors will reach its lowest point in the second half of the year before starting its road to recovery, said Gelsinger, according to Bloomberg. However, even that may not be enough for some chip production clients. Read more...

Read more »

Keep your Apple gear charged with a 4-in-1 wireless charger, now just $41
There are two universal truths in life: 1) We will always want the latest iPhone, no matter how perfectly fine the one we currently have is. And 2) You can never have enough chargers. Never underestimate the luxury of always having your devices charged. Having easily accessible chargers usefully placed around your home simply makes […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple @ Work: Camo uses your iPhone to transform your Mac’s low-quality webcam
One of the most glaring faults of Apple’s laptop line is the built-in webcams. Apple looks to finally be moving to 1080 with the newest iMac and its FaceTime HD camera, but that doesn’t help anyone with a current Mac. We’ve all spent way too much time over the past 14 months in Zoom meetings, so in hindsight, it would have been great to see Apple upgrade the built-in FaceTime cameras years ago, but they didn’t. In its absence, many people have taken to upgrading to an external option like the Logitech StreamCam and Papalook PA930. What if there was another option that you likely already own? Let’s look at Camo, an app to use your iPhone as your Mac webcam. more… The post appeared first on 9to5Mac.

Read more »

Hotspot connections will be safer in iOS 15 thanks to WPA3 security protocol
Apple is expected to release iOS 15 and iPadOS 15 later this fall. As developers explore the new operating system, we’re able to discover new things on it. For example, in iOS 15, hotspot connections will feature a stronger WPA3 security protocol. more… The post appeared first on 9to5Mac.

Read more »

Second beta, leaker letters, and Windows 11 — This Week in Apple
In this week's edition, Apple causes a storm in the world of leakers, iOS 15 and iPadOS 15 may provide apps more RAM, and Microsoft shows Windows 11.Stay up to date on the last seven days of AppleEvery week, Appleinsider publishes hundreds of news stories about Apple, its announcements, its products, rumors, and other connected companies. Our weekend video series "This Week in Apple" aims to condense down a news-heavy week into an easier-to-digest recap, one covering the main stores. Read more...

Read more »

Poll: Which Windows 11 feature do you want Apple to copy for the Mac?
Microsoft introduced this week a redesigned Windows 11. Of all the features unveiled, do you think Apple should copy one of them for the Mac? more… The post appeared first on 9to5Mac.

Read more »

Remember how the iPod and iPhone failed? The 24-inch iMac is doomed too
The M1 iMacs have barely hit the streets and reports are that some of them are literally hitting the streets from being thrown out of people’s windows. Okay, technically, the Macalope doesn’t have any actual reports of that, but when you read the horrors of this new computer, you’ll wonder why that isn’t happening. Also, […]

Read more »

iPhone 5S changed the smartphone industry
Apple released the iPhone 5S in 2013, it was the first phone from the company to support 64-bit architecture. The A7 chip in the ... Read more The post appeared first on iLounge.

Read more »

iPhone 5C: The forgotten trendy phone!
Apple released the iPhone 5C alongside the iPhone 5S in 2013. It was supposed to be a trendy smartphone for people who preferred having ... Read more The post appeared first on iLounge.

Read more »

Beats Studio Buds now available for $149.99 at Apple stores
Apple has launched its new Beats Studio Buds – a premium wireless audio experience at $149.99 (USD). It features most of the features from ... Read more The post appeared first on iLounge.

Read more »

vDownloader (Lifetime) for Mac is 76% off
iLounge has a special deal on the vDownloader for Mac (Lifetime Subscription), which allows you to download any video on the most popular sites ... Read more The post appeared first on iLounge.

Read more »

Enjoy a $60 discount on the high-end AirPods Max
Apple has recently released a premium headphone that provides an immersive audio experience. Today, you can buy the AirPods Max for just $489, down ... Read more The post appeared first on iLounge.

Read more »

iOS 15 beta includes FaceTime SharePlay feature
iPadOS 15 and iOS beta versions are now entering their second phases, and developers have spotted a feature that allows SharePlay during FaceTime calls. ... Read more The post appeared first on iLounge.

Read more »

New ‘Time to Walk’ episodes for Apple Fitness+ to be added soon
Apple Fitness+ will be having more ‘Time to Walk’ episodes come June 28. The feature launched January, with audio stories of influential people becoming ... Read more The post appeared first on iLounge.

Read more »

Tim Cook makes an appearance at Apple Tower Theatre Grand opening
Tim Cook, Apple CEO showed up during the grand opening of its Apple Tower Theatre, an Apple Store located in Downtown LA. The grand ... Read more The post appeared first on iLounge.

Read more »

MyBook Users Urged to Unplug Devices from Internet
Hard drive giant Western Digital is urging users of its MyBook Live brand of network storage drives to disconnect them from the Internet, warning that malicious hackers are remotely wiping the drives using a previously unknown critical flaw that can be triggered by anyone who knows the Internet address of an affected device.

Read more »

Secure Password Recipes – Intego Mac Podcast Episode 193
One way of creating secure passwords is to use a number of memorable words; how secure are this type of password? We also look at a network bug that can disable wi-fi on iPhones, the new Brave privacy-protecting search engine, and an EU investigation of Google's FLoC technology. The post appeared first on The Mac Security Blog.

Read more »

How Cyber Sleuths Cracked an ATM Shimmer Gang
In 2015, police departments worldwide started finding ATMs compromised with advanced new "shimming" devices made to clone data from chip card transactions. Authorities in the United States and abroad had seized many of these shimmers, but for years couldn't decrypt the data on the devices. This is a story of ingenuity and happenstance, and how one former Secret Service agent helped crack a code that revealed the contours of a global organized crime ring.

Read more »

How Cyber Safe is Your Drinking Water Supply?
Amid multiple recent reports of hackers breaking into and tampering with drinking water treatment systems comes a new industry survey with some sobering findings: A majority of the 52,000 separate drinking water systems in the United States still haven't inventoried some or any of their information technology systems -- a basic first step in protecting networks from cyberattacks.

Read more »

First American Financial Pays Farcical $500K Fine
In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. [NYSE:FAF] was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back more than 16 years. This week, the U.S. Securities and Exchange Commission settled its investigation into the matter after the Fortune 500 company agreed to pay a paltry penalty of less than $500,000.

Read more »

New Features Coming in macOS Monterey, iOS 15, and iPadOS 15 – Intego Mac Podcast Episode 192
Apple issued a security update for iOS 12, and we wonder why. Google backtracks on a Chrome address bar change. New stats show an increasing in phishing sites. And we discuss the new features in Apple's next operating systems, due out in the fall. The post appeared first on The Mac Security Blog.

Read more »

Ukrainian Police Nab Six Tied to CLOP Ransomware
Authorities in Ukraine this week charged six people alleged to have been part of the CLOP ransomware group, a cybercriminal gang said to have extorted more than half a billion dollars from victims. Some of CLOP's victims this year alone include Stanford University Medical School, the University of California, and University of Maryland.

Read more »

How Does One Get Hired by a Top Cybercrime Gang?
The U.S. Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot, a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware. Just how did a self-employed web site designer and mother of two come to work for one of the world’s most rapacious cybercriminal groups and then leave such an obvious trail of clues indicating her involvement with the gang? This post explores answers to those questions, as well as some of the ways Trickbot and other organized cybercrime gangs gradually recruit, groom and trust new programmers.

Read more »

Vulnerability Summary for the Week of June 7, 2021
Original release date: June 14, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aomedia -- aomedia aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. 2021-06-04 7.5 CVE-2021-30475 MISC MISC broadcom -- sannav Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF). 2021-06-09 7.5 CVE-2020-15377 MISC chiyu-tech -- bf-430_firmware An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated. 2021-06-04 7.5 CVE-2021-31251 CONFIRM MISC MISC linux -- linux_kernel The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). 2021-06-04 7.2 CVE-2021-3489 MISC UBUNTU UBUNTU MISC MLIST linux -- linux_kernel The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). 2021-06-04 7.2 CVE-2021-3490 UBUNTU MISC MISC UBUNTU MLIST linux -- linux_kernel The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1). 2021-06-04 7.2 CVE-2021-3491 UBUNTU UBUNTU MISC MISC MLIST microsoft -- intune_management_extension Microsoft Intune Management Extension Remote Code Execution Vulnerability 2021-06-08 7.5 CVE-2021-31980 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31976. 2021-06-08 7.8 CVE-2021-31975 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31975. 2021-06-08 7.8 CVE-2021-31976 MISC microsoft -- windows_10 Kerberos AppContainer Security Feature Bypass Vulnerability 2021-06-08 7.5 CVE-2021-31962 MISC qualcomm -- apq8009_firmware Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking 2021-06-09 7.8 CVE-2020-11241 CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accela -- civic_platform In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. 2021-06-07 4.3 CVE-2021-33904 MISC MISC adiscon -- loganalyzer Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. 2021-06-08 4.3 CVE-2021-31738 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. 2021-06-04 4 CVE-2020-36142 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. 2021-06-04 6.5 CVE-2020-36141 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely). 2021-06-04 4.3 CVE-2020-36140 MISC broadcom -- sannav Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header. 2021-06-09 5 CVE-2020-15384 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. 2021-06-09 5 CVE-2020-15380 MISC broadcom -- sannav The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface. 2021-06-09 5 CVE-2020-15378 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission. 2021-06-09 5.5 CVE-2020-15385 MISC chiyu-tech -- bf-430_firmware An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it. 2021-06-04 5.8 CVE-2021-31252 CONFIRM MISC MISC chiyu-tech -- bf-430_firmware A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components. 2021-06-04 6.4 CVE-2021-31249 MISC MISC MISC cisco -- webex_meetings_desktop A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system, which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account. 2021-06-04 6.9 CVE-2021-1536 CISCO ckeditor -- ckeditor A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! > is mishandled. 2021-06-09 4.3 CVE-2021-33829 MISC cloverdx -- cloverdx A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10. 2021-06-09 4.3 CVE-2021-30133 CONFIRM MISC dino -- dino Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. 2021-06-07 5 CVE-2021-33896 CONFIRM MISC MLIST dlink -- dir-868l_firmware The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29321 MISC dlink -- dir-880l_firmware The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29322 MISC dlink -- dir-885l-mfc_firmware The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29323 MISC dlink -- dir-895l_mfc_firmware The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29324 MISC entrouvert -- lasso Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. 2021-06-04 5 CVE-2021-28091 MISC MISC MISC DEBIAN MLIST FEDORA FEDORA esri -- arcgis_server A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue. 2021-06-07 5 CVE-2021-29099 CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. 2021-06-08 4.3 CVE-2021-22220 CONFIRM MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30517 MISC MISC google -- chrome Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. 2021-06-07 4.3 CVE-2021-30533 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30532 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30531 MISC MISC google -- chrome Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30514 MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30513 MISC MISC google -- chrome Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page. 2021-06-04 5.8 CVE-2021-30511 MISC MISC google -- chrome Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30512 MISC MISC google -- chrome Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30537 MISC MISC google -- chrome Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30536 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30539 MISC MISC google -- chrome Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30510 MISC MISC google -- chrome Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension. 2021-06-04 6.8 CVE-2021-30509 MISC MISC google -- chrome Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30508 MISC MISC google -- chrome Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30507 MISC MISC google -- chrome Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30506 MISC MISC google -- chrome Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30534 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30538 MISC MISC google -- chrome Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30518 MISC MISC google -- chrome Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30527 MISC MISC google -- chrome Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30519 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30520 MISC MISC google -- chrome Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30521 MISC MISC google -- chrome Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30522 MISC MISC MISC google -- chrome Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. 2021-06-07 6.8 CVE-2021-30523 MISC MISC google -- chrome Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30524 MISC MISC google -- chrome Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30525 MISC MISC google -- chrome Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30526 MISC MISC google -- chrome Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30528 MISC MISC google -- chrome Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30515 MISC MISC google -- chrome Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30529 MISC MISC google -- chrome Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30535 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30542 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30543 MISC MISC google -- chrome Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30540 MISC MISC google -- chrome Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30516 MISC MISC google -- chrome Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30530 MISC MISC ibm -- datapower_gateway IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033. 2021-06-07 5 CVE-2020-5008 CONFIRM XF ibm -- websphere_application_server_nd IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435. 2021-06-07 6.5 CVE-2021-20517 CONFIRM XF inverse -- sogo SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.) 2021-06-04 5 CVE-2021-33054 MISC MISC MISC jnews -- jnews The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. 2021-06-07 4.3 CVE-2021-24342 CONFIRM luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration. 2021-06-04 5 CVE-2021-33838 MISC MISC MISC MISC luca-app -- luca The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature. 2021-06-04 5 CVE-2021-33840 MISC MISC luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting. 2021-06-04 5 CVE-2021-33839 MISC MISC MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31940. 2021-06-08 6.8 CVE-2021-31941 MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31941. 2021-06-08 6.8 CVE-2021-31940 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31942. 2021-06-08 6.8 CVE-2021-31943 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31943. 2021-06-08 6.8 CVE-2021-31942 MISC microsoft -- 3d_viewer 3D Viewer Information Disclosure Vulnerability 2021-06-08 4.3 CVE-2021-31944 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 2021-06-08 5.1 CVE-2021-33741 MISC microsoft -- kubernetes_tools Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-31938 MISC microsoft -- malware_protection_engine Microsoft Defender Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31985 MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31945, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31946 MISC MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31946, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31945 MISC MISC microsoft -- sharepoint_enterprise_server Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31963, CVE-2021-31966. 2021-06-08 6.5 CVE-2021-26420 MISC microsoft -- vp9_video_extensions VP9 Video Extensions Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31967 MISC microsoft -- windows_10 Windows Remote Desktop Services Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31968 MISC microsoft -- windows_10 Server for NFS Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31974 MISC microsoft -- windows_10 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31969 MISC microsoft -- windows_10 Windows GPSVC Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31973 MISC microsoft -- windows_10 Windows HTML Platform Security Feature Bypass Vulnerability 2021-06-08 6.8 CVE-2021-31971 MISC microsoft -- windows_server_2008 Windows DCOM Server Security Feature Bypass 2021-06-08 4.3 CVE-2021-26414 MISC microsoft -- windows_server_2008 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31199. 2021-06-08 4.6 CVE-2021-31201 MISC microsoft -- windows_server_2008 Windows Print Spooler Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-1675 MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-23215 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215. 2021-06-08 4.3 CVE-2021-26260 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-26945 MISC openexr -- openexr A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR. 2021-06-08 6.8 CVE-2021-23169 FEDORA MISC FEDORA openvpn -- openvpn_access_server OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service. 2021-06-04 5 CVE-2020-36382 MISC MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. 2021-06-07 4.3 CVE-2020-36383 MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via color settings. 2021-06-07 4.3 CVE-2020-36384 MISC qualcomm -- apq8009_firmware Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 6.9 CVE-2020-11233 CONFIRM qualcomm -- apq8009w_firmware Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking 2021-06-09 6.9 CVE-2020-11250 CONFIRM qualcomm -- apq8096au_firmware Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 4.6 CVE-2020-11160 CONFIRM refined-github_project -- refined-github The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns. 2021-06-09 4.3 CVE-2021-34364 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33661 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33660 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33659 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27641 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27638 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27639 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27640 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27642 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27643 MISC MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member". 2021-06-07 6.8 CVE-2020-18265 MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member". 2021-06-07 6.8 CVE-2020-18264 MISC tracefinanacial -- crestbridge Trace Financial CRESTBridge V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions), SIMATIC RF615R (All versions > V3.0), SIMATIC RF680R (All versions > V3.0), SIMATIC RF685R (All versions > V3.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation. 2021-06-08 not yet calculated CVE-2021-31340 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819) 2021-06-08 not yet calculated CVE-2021-27387 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820) 2021-06-08 not yet calculated CVE-2021-27399 MISC smartstream -- transaction_lifecycle_management_reconciliation_premium   SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23320 CONFIRM ubuntu -- ubuntu   Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25949 MISC MISC ubuntu -- ubuntu   Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25948 MISC MISC ubuntu -- ubuntu   It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. 2021-06-11 not yet calculated CVE-2021-25684 MISC ubuntu -- ubuntu   There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23321 CONFIRM ubuntu -- ubuntu   There is an Assertion in '(flags > > CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags > > CBC_STACK_ADJUST_SHIFT)) stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23319 CONFIRM ubuntu -- ubuntu   There is an Assertion in 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23322 CONFIRM ubuntu -- ubuntu   There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23314 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23310 CONFIRM ubuntu -- ubuntu   There is an Assertion 'scope_stack_p > context_p- >scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23313 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_depth == context_p- >context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23309 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23308 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23311 CONFIRM ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32553 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32552 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32551 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32550 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32554 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32555 MISC ubuntu -- ubuntu   It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. 2021-06-12 not yet calculated CVE-2021-32556 MISC ubuntu -- ubuntu   It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. 2021-06-12 not yet calculated CVE-2021-32557 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32549 MISC ubuntu -- ubuntu   It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. 2021-06-11 not yet calculated CVE-2021-25682 MISC ubuntu -- ubuntu   It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. 2021-06-11 not yet calculated CVE-2021-25683 MISC ubuntu -- ubuntu   There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23302 CONFIRM ubuntu -- ubuntu   There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23303 CONFIRM unix -- symbolic_link   A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1. 2021-06-10 not yet calculated CVE-2021-25322 CONFIRM vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 2 of 2). 2021-06-08 not yet calculated CVE-2021-26472 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 1 of 2). 2021-06-08 not yet calculated CVE-2021-26471 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated file write via a GET request that specifies a file's name and content. 2021-06-08 not yet calculated CVE-2021-26473 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated SSRF via a GET request that specifies a hostname and port number. 2021-06-08 not yet calculated CVE-2021-26474 MISC MISC MISC MISC MISC vernemq_mqtt_broker -- vernemq_mqtt_broker   VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system. 2021-06-08 not yet calculated CVE-2021-33176 MISC welch_allyn -- multiple_devices   The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27408 MISC welch_allyn -- multiple_products   The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27410 MISC werkzeug -- werkzeug   This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. 2021-06-11 not yet calculated CVE-2021-23393 MISC MISC western_digital -- edgerover   Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials. 2021-06-11 not yet calculated CVE-2021-33205 CONFIRM whatsapp -- business   A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files. 2021-06-11 not yet calculated CVE-2021-24035 CONFIRM windows -- mshtml_platform   Windows MSHTML Platform Remote Code Execution Vulnerability 2021-06-08 not yet calculated CVE-2021-33742 MISC wordpress -- wordpress   The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users 2021-06-07 not yet calculated CVE-2021-24336 MISC CONFIRM wordpress -- wordpress   The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues 2021-06-07 not yet calculated CVE-2021-24344 CONFIRM wordpress -- wordpress   The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones. 2021-06-07 not yet calculated CVE-2021-24340 CONFIRM MISC wordpress -- wordpress   The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. 2021-06-07 not yet calculated CVE-2021-24337 MISC CONFIRM wowonder -- wowonder   In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day. 2021-06-11 not yet calculated CVE-2021-27200 MISC MISC MISC wp-cli -- wp-cli   WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLIUtilshttp_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLIUtilshttp_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLIUtilshttp_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior. 2021-06-07 not yet calculated CVE-2021-29504 MISC MISC MISC MISC MISC MISC CONFIRM xen -- xen   HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. 2021-06-11 not yet calculated CVE-2021-28687 MISC xen -- xen   x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. 2021-06-11 not yet calculated CVE-2021-28689 MISC xscreensaver -- xscreensaver   XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. 2021-06-10 not yet calculated CVE-2021-34557 MISC MISC MISC MISC MLIST z-blogphp -- z-blogphp   Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." 2021-06-07 not yet calculated CVE-2020-18268 MISC MISC zoho_manageengine -- key_manager_plus   Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. 2021-06-07 not yet calculated CVE-2021-28382 MISC MISC zope_foundation -- zope   Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.21 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only. 2021-06-08 not yet calculated CVE-2021-32674 CONFIRM MISC MISC MISC zte -- zte   A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE. 2021-06-10 not yet calculated CVE-2021-21735 MISC zte -- zte   A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E 2021-06-10 not yet calculated CVE-2021-21736 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Is Apple’s iCloud Private Relay a VPN? Not Even Close—Here’s Why
Apple's iCloud Private Relay is not a VPN, but Intego Privacy Protection is. Compare the two, and learn why Intego Privacy Protection is the best VPN for Mac. The post appeared first on The Mac Security Blog.

Read more »

New Privacy Features in iOS 15 and macOS Monterey – Intego Mac Podcast Episode 191
Apple introduced its new operating systems this week, and there are plenty of privacy features to help users better control their data. We discuss these new features, and especially a number of important features that Apple didn't discuss at the keynote. The post appeared first on The Mac Security Blog.

Read more »

Save $420 on a 16″ MacBook Pro at Apple with these Certified Refurbished models
Apple has a full line of Certified Refurbished 16″ 6-Core & 8-Core MacBook Pros available for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, updated → Read More...

Read more »

Apple AirPods Max on sale for $489, save $60
Apple reseller Adorama has all colors of AirPods Max on sale today for $489 shipped. Their price is $60 off Apple’s MSRP, and it’s the lowest price we’ve seen so far for all AirPods Max colors. For the latest prices & sales, see our AirPods Price Tracker, → Read More...

Read more »

Sale! B&H has Apple 13″ M1 MacBook Airs on sale for up $100 off MSRP, starting at only $899
B&H has Apple’s 13″ M1 MacBook Airs on sale today for up $100 off MSRP, starting at $899. Expedited shipping is free to most addresses in the US: 8-Core M1 Silicon CPU, 7-Core GPU: – 13″ M1 MacBook Air/256GB Space Gray: $899 $100 off MSRP – 13″ M1 MacBook Air/256GB Silver: $899 $100 off MSRP – 13″ M1 MacBook Air/256GB Gold: $899 $100 off MSRP 8-Core M1 Silicon CPU, 8-Core GPU: – 13″ M1 MacBook Air/512GB Space Gray: $1199 $50 off MSRP – 13″ M1 MacBook Air/512GB Silver: $1249 $0 off MSRP – 13″ M1 MacBook Air/512GB Gold: $1149 $100 off MSRP Their prices are among the lowest available for these models from any Apple reseller. For the latest prices & sales, keep an eye on our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Apple has a wide range of M1-powered Macs in stock today for up to $230 off MSRP, Certified Refurbished
Prime Day 2021 may be over, but you can still realize significant savings on an Apple Mac powered by an Apple M1 processor. Apple has several models available today in their Certified Refurbished section for up to $230 off the cost of new models, with prices starting at only $589: (1): Apple has restocked a full line of standard configuration M1 Mac minis available in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Note that stock of these models will likely come and go, so be sure to check Apple’s site for the latest stock status. The $589 model is the cheapest M1 Mac currently for sale anywhere. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily. (2): Apple has a full line of 2020 13″ M1 MacBook Pros available Certified Refurbished, starting at only $1099 and up to $230 off original MSRP. These are the cheapest M1 MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Pro/256GB SSD/Space Gray: $1099 $200 off MSRP – 13″ M1 MacBook Pro/512GB SSD/Space Gray: $1269 $230 off MSRP – 13″ M1 MacBook Pro/256GB SSD/Silver: $1099 $200 off MSRP – 13″ 13″ M1 MacBook Pro/512GB SSD/Silver: $1269 $230 off MSRP For the latest sales & prices, see our 13″ MacBook Pro Price Tracker. (3): Apple has restocked a full line of 2020 13″ M1 MacBook Airs, Certified Refurbished, starting at only $849 and up to $190 off original MSRP. These are the cheapest M1 MacBook Airs for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Space Gray: $849 → Read More...

Read more »

Amazon Prime Day Sale: Apple’s 11″ M1 128GB iPad Pro for $699, $100 off MSRP
Amazon has the new 2021 11″ 128GB WiFi iPad Pro in stock today and on sale for $699 as part of their Prime Day 2021 sales. Shipping is free. Their price is $100 off Apple’s MSRP, and it’s the lowest price available for a 2021 iPad Pro from any Apple reseller. This is the same iPad Pro sold by Apple in their retail and online stores. Note that Amazon’s price can change at any time — see their site for the latest info. Sams Club has the 11″ M1 128GB WiFi iPad Pro on sale for $699 as well. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): For the latest prices & sales, keep an eye on our 11″ iPad Pro Price Tracker, → Read More...

Read more »

Amazon Prime Day 2021 Sale: Get an 8-Core CPU/8-Core GPU 13″ MacBook Air for $150 off Apple’s MSRP
Amazon has new 13″ Apple M1 MacBook Airs with 8-Core M1 Silicon CPUs & 8-Core GPUs on sale today for $150 off MSRP as part of their Prime Day 2021 sales, each including free shipping: – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB Space Gray: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB Silver: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB Gold: $1099.99 $150 off MSRP Amazon’s prices are the lowest available for these models from any Apple reseller. Airs with M1 8-Core CPUs & 7-Core GPUs are on sale for $899, $100 off Apple’s MSRP. For the latest prices & sales, keep an eye on our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Amazon Prime Day Sale: Get Apple’s M1 13″ MacBook Pros for $200 off MSRP
Amazon has Apple’s 13″ MacBook Pros with M1 Apple Silicon CPUs on sale for $200 off MSRP today as part of their Prime Day 2021 sales, starting at $1099. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1299.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1299.99 $200 off MSRP Amazon’s prices are currently the lowest available for these models from any Apple reseller. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Amazon discounts Apple’s popular new M1 Mac minis by up to $120 off MSRP for Prime Day 2021
Amazon has new Apple M1 Mac minis in stock today and on sale for $100-$120 off Apple’s MSRP, with prices starting at only $599, as part of their Prime Day 2021 sales. Their prices are the lowest currently available for these models from any Apple reseller: – Mac mini M1 CPU/256GB SSD: $599.99 $100 off MSRP – Mac mini M1 CPU/512GB SSD: $779.99 $120 off MSRP Prices are after instant coupons, clipped on Amazon’s product pages. Be sure to purchase from Amazon rather than a third-party seller. These are the same Mac minis sold by Apple in their retail and online stores. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Amazon Prime Day 2021 Deal: Apple’s 13″ 2GHz MacBook Pros on sale for up to $350 off MSRP
Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs on sale for $200-$350 off Apple’s MSRP as part of their Prime Day 2021 sales. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1599.99 $200 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1499.99 $300 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1649.99 $350 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1649.99 $350 off MSRP For the latest prices and sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Amazon Prime Day 2021 Sale: Get an Apple M1 MacBook Air for only $899, $100 off MSRP
Amazon is offering a $100 discount on Apple’s 13″ M1 MacBook Airs with 7-Core GPUs and 8-Core CPU as part of their Prime Day 2021 sales. With Amazon’s discount, their price drops to only $899 with free shipping. Their prices are the lowest available today for a 13″ M1 MacBook Air from any Apple reseller: 8-Core M1 Silicon CPU, 7-Core GPU. MSRP: $999 – 13″ MacBook Air/256GB SSD/Space Gray: $899.99 $100 off MSRP – 13″ MacBook Air/256GB SSD/Silver: $899.99 $100 off MSRP – 13″ MacBook Air/256GB SSD/Gold: $899.99 $100 off MSRP Keep an eye on our 13″ MacBook Air Price Tracker for the latest sales & deals from Apple and its resellers, → Read More...

Read more »

Amazon Prime Day Sale: 27″ 5K 6-Core Apple iMacs for $200-$300 off MSRP
Amazon has Apple’s 2020 27″ 5K 6-Core iMacs on sale for $200-$300 off MSRP as part of their Prime Day 2021 sales. Their prices are the lowest available for these 27″ iMacs from any Apple reseller. Shipping is free: – 27″ 5K 3.1GHz 6-Core iMac: $1599.99 $200 off MSRP – 27″ 5K 3.3GHz 6-Core iMac: $1699.99 $300 off MSRP For the latest prices and sales, keep an eye on our iMac Price Tracker, → Read More...

Read more »

Amazon Prime Day 2021 Deal: Get one of Apple’s 10.9″ iPad Airs for up to $90 off
Amazon has Apple 10.9″ iPad Airs on sale for up to $90 off MSRP as part of their Prime Day 2021 deals, each including free shipping. Sale price varies by color, as indicated below: – 10.9″ 64GB WiFi iPad Air Space Gray: $559 $40 off MSRP – 10.9″ 64GB WiFi iPad Air Green: $549.98 $50 off MSRP – 10.9″ 64GB WiFi iPad Air Rose Gold: $539 $60 off MSRP – 10.9″ 64GB WiFi iPad Air Blue: $539 $60 off MSRP – 10.9″ 64GB WiFi iPad Air Silver: $539 $60 off MSRP – 10.9″ 256GB WiFi iPad Air Space Gray: $699 $50 off MSRP – 10.9″ 256GB WiFi iPad Air Green: $669.99 $80 off MSRP – 10.9″ 256GB WiFi iPad Air Rose Gold: $659.99 $90 off MSRP – 10.9″ 256GB WiFi iPad Air Blue: $669.99 $80 off MSRP – 10.9″ 256GB WiFi iPad Air Silver: $669 $80 off MSRP 64GB Cellular-based models are available for as low as $699 ($30 off), while 256GB models are on sale for as low as $829 ($50 off). For the latest prices and sales, keep an eye on our iPad Air Price Tracker, → Read More...

Read more »