Apple Goes to Hollywood – Media+
Charlotte Henry and her guests bring focus — and a little something extra — to discussions about digital media in today’s world. She is joined by Tom Merritt to discuss Hollywood’s excitement at the new M1 Macs and Apple’s potential purchase of Wondery.

Read more »

ByteDance gets seven-day extension to divest TikTok
The Trump Administration on Wednesday granted TikTok owner ByteDance a seven-day extension on an order directing it to sell the video sharing platform.Credit: TikTokAccording to a court filing spotted by Reuters, ByteDance now has until Dev. 4 to sell the U.S. portion of its app to a domestic company. Previously, President Donald Trump in November had given ByteDance an additional 15 days to divest the app — a period that was set to expire on Friday, Nov. 27. Read more...

Read more »

This website shows you what software runs on M1 Macs
Apple’s decision to dump Intel processors and upgrade to the M1 chip in its Macs means that while some popular Mac software titles are The post appeared first on MacDailyNews.

Read more »

Apple enlists influencers to promote iPhone 12 mini on TikTo...
Apple is now using its previously dormant TikTok account and recruiting popular influencers on the platform to promote the iPhone 12 mini.Credit: Solen FeyissaThe new marketing campaign comes about seven months after Apple first established its verified account in April. Until now, the TikTok account has remained unused. Read more...

Read more »

Get early access to Black Friday pricing on this 5-in-1 gram...
Now that so much of our daily work and communication has shifted online, it’s more important than ever that our grammar is impeccable and our sentence structure is solid. Whether you’re drafting an email, wrapping up a report under a tight deadline, or even typing up your digital holiday card, you want to be sure […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How John Evelyn Created ‘The College Atlas’ Game for App...
Developer John Evelyn created a hand-drawn, first-person shooting game for Apple Arcade called The College Atlas. In this interview he shares his story. In broadly creative terms, and on a more positive note, there is a dizzyingly big market out there and the last 20 years have seen a huge diversification in terms of what kinds of games players will engage with. In decades gone by, I think I would have been laughed off the face of the Earth for my extremely low-poly approach - not to mention lack of scores or traditional narrative structure - but not now.

Read more »

Roborock’s Siri-ready S6 Pure robotic vacuum and mop now $...
Today we are taking a closer look at the Roborock S6 Pure robotic vacuum and mop, now available in black for $359.99 (Reg. $599) for 9to5Mac readers. Designed to offer users a completely customizable cleaning solution, the S6 Pure mops and sweeps on your command via the companion iOS app or just by yelling at Siri. Making use of a wide array of intelligent sensors and a LiDAR navigation system, the Roborock S6 Pure offers up a more intelligent cleaning system than your average robot vac on Amazon. Head below for more details on the customized cleaning system, expanded runtime, and today’s solid Black Friday price drop for 9to5readers.  more… The post Roborock’s Siri-ready S6 Pure robotic vacuum and mop now $240 off for Black Friday appeared first on 9to5Mac.

Read more »

European Parliament votes to facilitate consumer right to re...
The European Parliament on Wednesday voted to support the right of consumers to repair their own phones, tablets, laptops and other devices without going through the companies that produced them.Credit: AppleThe resolution, a report of recommendations to facilitate the right to repair, was passed with 395 votes in favor and 94 against, with 207 abstentions. As Euronews points out, it's only an advisory report, and it's still up to the European Commission to issue actual proposals. Read more...

Read more »

Apple Should Leave TikTok to The Experts – Its Users
Apple has had a TikTok account for a few months. Now though, reported 9to5 Mac, it is starting to use it. Last week, it posted videos of influencers using the iPhone 12 mini. It’s a slow, steady, move, no more than Apple dipping its toe into the water. Apple Testing Out TiTkTok With iPhone 12 Mini Videos On the face of it, it makes perfect sense for Apple to be publishing on TikTok - it attracts a young audience who want mobile devices that they can create content on. If nothing else, the company obviously needs to have the official account so nobody else gets hold of it. However, its products are already being readily promoted on the short-form video platform without it having to do anything. As I wrote previously: TikTok is, quite frankly, one of the best adverts for Apple around. Whether it is teenage girls talking into their mirrors holding up an iPhone, or an influencer talking into their EarPod’s mic (they’re both things…) countless videos on the platform show Apple products. It’s worth noting that there are official Apple TV and Music TikTok accounts, neither of which had published any content at the time of this writing. I suspect that will change in the near future. It's not a very Apple move, but it would have been bold, and possibly more effective, for it to have ceded control and just left users to demonstrate how much they love its products.

Read more »

Five ways to check if apps are optimized for M1 Macs
Now that M1 Macs are available and developers are updating their apps for official M1 support, you might be trying to figure out which of your apps (as well as ones you might want) are optimized for Apple Silicon. Read along for five free ways to check Universal macOS apps. more… The post appeared first on 9to5Mac.

Read more »

‘Coppice’ is a New Mind Mapping App for the Mac
Coppice is the latest app from Martin Pilkington. It’s a mind mapping app to help your organize your ideas, thoughts, and projects. You organize your thoughts on the Canvas where each one is represented as a Page. You can add text or images to Pages and resize them as you need. Pages can be added to multiple canvases, and even fill your window for when you want to focus on that one particular thought. Pages can be linked together to show the relationships between them, and when you combine Pages, Canvases, and Links, you can see your thoughts branching out. Clicking a link will show the relationship between those Pages on the Canvas. If you close a branch, Coppice will remember all the pages that were opened and how you arranged them, meaning that entire trains of thought are always just a click away.

Read more »

Rogue Amoeba audio apps are now compatible with new M1 Macs
Rogue Amoeba, the company behind several popular audio apps for Mac, has updated all of its software today with full support for M1 Macs — which includes the new MacBook Air, MacBook Pro, and Mac mini. more… The post appeared first on 9to5Mac.

Read more »

New Russo brothers film ‘Cherry’ starring Tom Holland ar...
"Cherry," coming to Apple TV+ in March 2021, is the first film that the Russo brothers have directed following the "Avengers" finales… The post New Russo brothers film ‘Cherry’ starring Tom Holland arriving on Apple TV+ in March 2021 appeared first on MacDailyNews.

Read more »

Twelve South Products on Sale for Black Friday 2020
Apple accessory maker Twelve South has officially announced its five-day-long Black Friday 2020 sale. You’ll find deals on everything from a BookBook vol. 2 iPhone case to a Curve desktop stand for MacBooks. Twelve South Black Friday 2020 Here are some of the product deals happening on the website: AirSnap Pro leather case - US$29.99 BookArc vertical desktop stand - US$49.99 Forte Apple Watch stand - US$39.99 Compass Pro adjustable iPad stand - US$49.99 MagicBridge holder for Magic Keyboard, Magic Trackpad - US$34.99 ActionSleeve armband for Apple Watch - US$19.99 Inspire limited edition Mac candle - US$19.99

Read more »

Harrowing Russo brothers film 'Cherry' arriving on...
"Cherry," a harrowing Russo brothers film following a bank-robbing opiate-addicted soldier is coming to Apple TV+ on March 12, 2021.Credit: Apple TV+Apple acquired the rights to "Cherry" back in September. Based on the bestselling novel of the same name by Nico Walker and starring Holland and Ciara Bravo, "Cherry" is set to hit theaters on Feb. 26, 2021 before premiering globally on Apple TV+ on March 12. Read more...

Read more »

∞ HomePod mini review followup: A mistake
I published my HomePod mini review on November 12, 2020, giving readers a view on how I use the devices, how and where I set them up, and how I felt about them. However, despite my best efforts to be thorough in my testing, I did make a mistake. I felt it was fair to correct that.

Read more »

iPhone 12 Pro components cost surprisingly little
The iPhone 12 Pro starts at $999, but the components for this high-end smartphone cost less than half the selling price. Market researchers disassembled Apple’s latest top-tier handset to ascertain its parts cost. And they figured out that only a tiny percentage of the device is actually made is China. iPhone 12 Pro parts cost […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Flash deal: $300 off Intel 13-inch MacBook Pro (16GB, 256GB)...
Black Friday deal hunters don't need to wait until Nov. 27 to snap up the lowest price on a well-equipped 13-inch MacBook Pro with an Intel Core i5 processor. Thanks to an exclusive price drop at Apple Authorized Reseller B&H Photo, shoppers can pick up the upgraded config with 16GB of RAM for $1,199 — a discount of $300 off retail.Thanksgiving 13" MacBook Pro dealFor less than 24 hours, Apple Authorized Reseller B&H Photo is slashing the price on a Mid 2020 13-inch MacBook Pro, knocking $300 off the quad-core Core i5-equipped model exclusively for AppleInsider readers. This deal delivers the lowest price available on the 1.4GHz, 16GB, 256GB model in Silver, with other resellers completely sold out of the popular config. Read more...

Read more »

The iPhone 12 Pro Costs Apple $406 to Manufacture
In a teardown of the iPhone 12 Pro, an estimation of the device’s components suggest it costs about US$406 to manufacture. iPhone 12 Pro Cost A breakdown of components reveal that South Korean parts account for 26.8% of the iPhone 12 Pro’s value, while components from the United States are valued at 21.9$ of the price. Compared to the iPhone 12, the number of South Korean components increased by 9.1 percentage points and U.S. parts dropped 3.9 points. The chart below lists all of the component providers for the iPhone 12 Pro. Four of the providers are based in Asia and this underscores how important the region remains to Apple, despite moves to bring its manufacturing to other countries. It is notable that Chinese parts only account for 4.6% of the iPhone 12 Pro, although Chinese companies accounts for most of the final assembly.

Read more »

First Look at ‘Cherry’ – Heading to Apple TV+ March 12
Cherry, directed by Anthony and Joe Russo and starring Tom Holland, will arrive in theaters on February 26 and on Apple TV+ on March 12. Vanity Fair got a first look at the upcoming feature. “We do think about it as an epic film, and it is very much a person’s life journey,” said Anthony Russo. “But it does have a little bit of a split personality between being this character study and an epic life cycle.” They described Cherry as six movies in one, spanning from the mid 2000s to the present. “He travels a great distance over a 15-year period,” Joe Russo said. “The movie’s broken up into six chapters that reflect those different periods, and each one has a different tone. It’s shot with different lenses, different production design. One’s got magical realism. Another chapter is absurdism. Another is horror…There’s a bit of gonzo in it. It’s raw in its tone. He’s a character in existential crisis.”

Read more »

Ming-Chi Kuo: New form factor redesigns for Apple Watch and ...
Apple analyst Ming-Chi Kuo indicates that form factor redesigns are coming to the Apple Watch and the MacBook lineup in 2H 2021… The post Ming-Chi Kuo: New form factor redesigns for Apple Watch and MacBooks in late 2021 appeared first on MacDailyNews.

Read more »

Tierra Whack Stars in ‘The Magic of Mini’ Apple Ad
Apple uploaded a new video on Wednesday starring rapper Tierra Whack. It includes using a HomePod mini and how music can improve a person’s mood. Two songs featured in the ad are “feel good” and “Peppers and Onions” both by Ms. Whack.

Read more »

Ming-Chi Kuo: Redesigned Apple Silicon MacBooks Launching H2...
Apple fans can look forward to Apple silicon-powered, redesigned, MacBooks in the second half of 2021, according to a note by Ming-Chi Kuo. The analyst's note, seen by MacRumors, also suggested various other new devices are on the way.   Kuo did not specify which models these will be, but he previously claimed that redesigned 14-inch and 16-inch MacBook Pro models with Apple Silicon would launch in the late second quarter or third quarter of 2021... Kuo also expects third-generation AirPods to launch in the late second quarter of 2021... Last, Kuo predicted that the "new Apple Watch shipment's momentum in 2021 will benefit from innovative health management functions and improved form factor design," but it is unclear if he is referring to the Apple Watch Series 6's new casing options like blue aluminum or to redesigned Apple Watch Series 7 models.

Read more »

Apple Silicon Macs still to come: Redesigned iMac, new MacBo...
The early Apple Silicon Macs are officially available to consumers. The first options include a 13-inch MacBook Pro, the MacBook Air, and the Mac mini, each of which is powered by Apple’s new M1 processor. There are still new Macs with Apple Silicon to come, and here are all of the details we know right now. more… The post Apple Silicon Macs still to come: Redesigned iMac, new MacBook Pro, and more appeared first on 9to5Mac.

Read more »

Twitter Client ‘Tweetbot’ Supports M1 Macs, macOS Big Su...
Tweetbot is a popular client for Twitter and the team recently updated it to support M1 Macs and macOS Big Sur. There is also a new icon to fit with the Big Sur design. Tweetbot So why is is Tweetbot a good Twitter alternative? Here are some of its features: Create and use Twitter Lists as multiple timelines. Filter any timeline via keywords or predefined criteria (like tweets with media or links only) and save for future access. Second column on iPad to view other content like a list, mentions, search results, and etc at the same time. Sync your unread status and timeline position across all of your devices running Tweetbot (Mac, iPhone, iPad). No inline ads. You can download Tweetbot from the Mac App Store for US$9.99.

Read more »

Security Friday on Wednesday, Black Friday Deals – TMO Dai...
Andrew Orr joins host Kelly Guimont to discuss Security Friday news (even though it’s Wednesday) and point out some Black Friday deals.

Read more »

Watch ‘A Charlie Brown Thanksgiving’ For Free Via Apple ...
Apple recently bought the rights to all the Peanuts holiday specials. After some controversy,  they will also air on PBS. A Charlie Brown Thanksgiving was shown on November 22, but is still available, for free, via Apple TV. Watch 'A Charlie Brown Thanksgiving' on Apple TV From Wednesday, November 25 through Friday, November 27, the special is free to view on the Apple TV app. Of course, the app is available on iPhones, iPads, Macs, and the Apple TV HD and 4K. However, it is also available on a host of third-party products. The Peanuts Halloween special is still available to Apple TV+ subscribers, with the Christmas special to follow.

Read more »

Unclutter Launches ‘The Macnificent 9’ Black Friday Sale
The team behind Unclutter has launched a Black Friday app bundle called The Macnificent 9. Starting on Wednesday the deal is available for three weeks. In total, all of these apps are worth US$272 but with this deal the bundle is US$59. The Macnificent 9 Here are the apps available. You can choose to buy the entire bundle or buy individual apps. Timetator 2: Automatic time-tracking based on your rules and activities - US$19.50 RapidWeaver 8: The best web design software for Mac - US$42.50 Unclutter: Files, notes & clipboard manager for Mac - US$10 Default Folder X: Enhanced Open and Save dialogs for macOS - US$17.50 One Switch: All the toggles in your menu bar - US$4 Unite 3: Turn websites into apps on your Mac - US$7.50 DaisyDisk: Analyze disk usage and free up disk space on Mac - US$5 ForkLift 3: The most advanced dual pane file manager for macOS - US$15 Mosaic Pro: Effortlessly resize and re-position windows on your Mac - US$15 Most of these apps come with the lifetime license, but there may be individual conditions for app activation and usage. For example, the number of allowed devices per license or time range for free updates may differ.

Read more »

Apple HomePod mini Review: Siri in a Compact Speaker
The HomePod mini is a compact device that combines audio, Siri, and home control. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of November 16, 2020
Original release date: November 23, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 2020-11-18 7.5 CVE-2020-28367 MISC CONFIRM MLIST MLIST FEDORA golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. 2020-11-18 7.5 CVE-2020-28366 MISC CONFIRM MLIST FEDORA jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. 2020-11-16 10 CVE-2020-25207 MISC CONFIRM riken -- xoonips Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. 2020-11-16 7.5 CVE-2020-5664 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info chronoengine -- chronoforums Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed. 2020-11-16 4.3 CVE-2020-27459 MISC cmsuno_project -- cmsuno An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server. 2020-11-13 6.5 CVE-2020-25538 MISC golang -- go Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. 2020-11-18 5 CVE-2020-28362 CONFIRM MLIST FEDORA intel -- proset/wireless_wifi Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. 2020-11-13 5.8 CVE-2020-12313 MISC ivanti -- endpoint_manager LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request. 2020-11-16 6.5 CVE-2020-13769 MISC MISC ivanti -- endpoint_manager In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required. 2020-11-16 5 CVE-2020-13772 MISC MISC jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. 2020-11-16 5 CVE-2020-25013 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. 2020-11-16 5 CVE-2020-25210 MISC CONFIRM jetbrains -- youtrack JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27626 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. 2020-11-16 5 CVE-2020-27625 MISC jetbrains -- youtrack JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27624 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. 2020-11-16 5 CVE-2020-25209 MISC CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS) 2020-11-17 4.3 CVE-2020-11860 CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS). 2020-11-17 4.3 CVE-2020-25834 CONFIRM netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. 2020-11-13 5 CVE-2020-8583 MISC netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information. 2020-11-13 4 CVE-2020-8582 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6147 FULLDISC MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance USDC file format path element token index. 2020-11-13 6.8 CVE-2020-6156 MISC pixar -- openusd A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. 2020-11-13 6.8 CVE-2020-6155 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6150 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section. 2020-11-13 6.8 CVE-2020-6149 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6148 MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.5 CVE-2020-25695 MISC MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.8 CVE-2020-25694 MISC MISC riken -- xoonips SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. 2020-11-16 6.5 CVE-2020-5659 MISC MISC riken -- xoonips Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 4 CVE-2020-5663 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- infosphere_information_server IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910. 2020-11-13 2.1 CVE-2020-4886 XF CONFIRM jetbrains -- youtrack Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. 2020-11-16 2.1 CVE-2020-24366 MISC CONFIRM microfocus -- filr Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. 2020-11-17 3.5 CVE-2020-25832 CONFIRM microfocus -- idol Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. 2020-11-17 3.5 CVE-2020-25833 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). 2020-11-16 3.5 CVE-2020-27988 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). 2020-11-16 3.5 CVE-2020-27989 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). 2020-11-16 3.5 CVE-2020-27990 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). 2020-11-16 3.5 CVE-2020-27991 CONFIRM riken -- xoonips Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 3.5 CVE-2020-5662 MISC MISC salesagility -- suitecrm SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML. 2020-11-18 3.5 CVE-2020-14208 MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info airleader -- master_and_easy_devices   Airleader Master and Easy =12.8, =13.4, =13.5, =8.14, =13.4, =13.5, cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font. 2020-11-21 not yet calculated CVE-2020-25725 CONFIRM MISC reddoxx -- maildepot_2033   REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. 2020-11-18 not yet calculated CVE-2020-26554 MISC MISC resourcexpress -- qubi3_devices   QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility. 2020-11-17 not yet calculated CVE-2020-25746 CONFIRM MISC rsa -- archer   RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application. 2020-11-18 not yet calculated CVE-2020-26884 CONFIRM schneider_electric -- easergy_t300   A CWE-284: Improper Access Control vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of problems, including information exposure, denial of service, and command execution when access to a resource from an attacker is not restricted or incorrectly restricted. 2020-11-19 not yet calculated CVE-2020-7561 MISC schneider_electric -- ecostruxure_building_operation_enterprise_server   A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location. 2020-11-19 not yet calculated CVE-2020-28209 MISC schneider_electric -- ecostruxure_building_operation_webreports A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser. 2020-11-19 not yet calculated CVE-2020-7572 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7570 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution. 2020-11-19 not yet calculated CVE-2020-7569 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7571 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control. 2020-11-19 not yet calculated CVE-2020-7573 MISC schneider_electric -- ecostruxure_building_operation_webstation   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser. 2020-11-19 not yet calculated CVE-2020-28210 MISC schneider_electric -- ecostruxure_control_expert A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus. 2020-11-19 not yet calculated CVE-2020-28213 MISC schneider_electric -- ecostruxure_control_expert   A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus. 2020-11-19 not yet calculated CVE-2020-28212 MISC schneider_electric -- ecostruxure_control_expert   A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger. 2020-11-19 not yet calculated CVE-2020-28211 MISC schneider_electric -- ecostruxure_control_expert   A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7559 MISC schneider_electric -- ecostruxure_operator_terminal_expert   A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert. 2020-11-19 not yet calculated CVE-2020-7544 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7556 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7558 MISC schneider_electric -- igss_definition   A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7557 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7555 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7550 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7551 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7552 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7554 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7553 MISC schneider_electric -- modicon_m221 A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys. 2020-11-19 not yet calculated CVE-2020-7567 MISC schneider_electric -- modicon_m221   A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7566 MISC schneider_electric -- modicon_m221   A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7565 MISC schneider_electric -- modicon_m221   A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7568 MISC schneider_electric -- multiple_products A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7564 MISC schneider_electric -- multiple_products   A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7562 MISC schneider_electric -- multiple_products   A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7563 MISC schneider_electric -- plc_simulator_on_ecostruxure_control_expert   A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7538 MISC scratchverifier -- scratchverifier   In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login. 2020-11-20 not yet calculated CVE-2020-26236 MISC CONFIRM semantic-release -- semantic-release   In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3. 2020-11-18 not yet calculated CVE-2020-26226 MISC CONFIRM sensormatics_electronics -- american_dynamics_victor_web_client_and_software_house_c.cure_web_client   A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack. 2020-11-19 not yet calculated CVE-2020-9049 CERT CONFIRM sokrates -- sowa   A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter. 2020-11-19 not yet calculated CVE-2020-28350 MISC sourcecodester -- gym_management_system   Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'. 2020-11-17 not yet calculated CVE-2020-28129 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. 2020-11-17 not yet calculated CVE-2020-28138 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. 2020-11-17 not yet calculated CVE-2020-28140 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. 2020-11-17 not yet calculated CVE-2020-28139 MISC MISC sourcecodester -- online_library_management_system   An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root). 2020-11-17 not yet calculated CVE-2020-28130 MISC MISC sourcecodester -- simple_grocery_store_sales_and_inventory_system   An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php. 2020-11-17 not yet calculated CVE-2020-28133 MISC MISC sourcecodester -- tourism_management_system   An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. 2020-11-17 not yet calculated CVE-2020-28136 MISC MISC sourcecodester -- water_billing_system   SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. 2020-11-17 not yet calculated CVE-2020-28183 MISC MISC MISC suitecrm -- suitecrm SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. 2020-11-18 not yet calculated CVE-2020-15300 MISC suitecrm -- suitecrm   SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation. 2020-11-18 not yet calculated CVE-2020-15301 MISC symantec -- endpoint_detection_and_response   Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data. 2020-11-18 not yet calculated CVE-2020-12593 CONFIRM taskcafe -- project_management_tool   Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token. 2020-11-17 not yet calculated CVE-2020-25400 MISC tenable -- tp-link_archer   UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router. 2020-11-21 not yet calculated CVE-2020-5797 MISC tobesoft -- xplatform   Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto:// 2020-11-17 not yet calculated CVE-2020-7841 MISC tp-link -- multiple_devices   Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N. 2020-11-20 not yet calculated CVE-2020-28877 MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-24297 MISC MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing a denial of service) by sending a POST request to the /admin/syslog endpoint. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-28005 MISC MISC trend_micro -- apex_one   A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. 2020-11-18 not yet calculated CVE-2020-28572 MISC trend_micro -- interscan_web_security_virtual_appliance A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28581 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28578 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28579 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28580 MISC MISC trend_micro -- security_2020 Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27697 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27695 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27696 MISC trend_micro -- worry-free_business_security   A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console. 2020-11-18 not yet calculated CVE-2020-28574 MISC MISC trusted_computing_group -- trusted_platform_module_library_family   Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack. 2020-11-18 not yet calculated CVE-2020-26933 MISC CONFIRM typ03 -- typ03   An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved. 2020-11-18 not yet calculated CVE-2020-28917 MISC typo3 -- fluid   TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory. 2020-11-17 not yet calculated CVE-2020-26216 MISC CONFIRM MISC valve -- game_networking_sockets   Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution. 2020-11-18 not yet calculated CVE-2020-6016 MISC vmware -- esxi   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004) 2020-11-20 not yet calculated CVE-2020-4005 CONFIRM vmware -- multiple_products   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. 2020-11-20 not yet calculated CVE-2020-4004 CONFIRM volkswagon -- discover_media_infotainment_system   The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainment system and executed as root. 2020-11-16 not yet calculated CVE-2020-28656 MISC werkzeug -- werkzeug   Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. 2020-11-18 not yet calculated CVE-2020-28724 MISC MISC MISC western_digital -- inand_devices   Western Digital iNAND devices through 2020-06-03 allow Authentication Bypass via a capture-replay attack. 2020-11-18 not yet calculated CVE-2020-13799 MISC CONFIRM wordpress -- wordpress   The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles. 2020-11-16 not yet calculated CVE-2020-28650 MISC wordpress -- wordpress   The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. 2020-11-16 not yet calculated CVE-2020-28649 MISC MISC xstream -- xstream   XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14. 2020-11-16 not yet calculated CVE-2020-26217 CONFIRM CONFIRM CONFIRM y18n -- y18n   This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true 2020-11-17 not yet calculated CVE-2020-7774 MISC MISC MISC MISC yzmcms -- yzmcms   In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. 2020-11-19 not yet calculated CVE-2020-22394 MISC zte -- multiple_devices   Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2. 2020-11-19 not yet calculated CVE-2020-6879 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

How to Use Apple’s Built-in Features to Encrypt Files and ...
Use features built in to macOS to encrypt files, folders, and disks to ensure that your data is secure. The post How to Use Apple’s Built-in Features to Encrypt Files and Folders appeared first on The Mac Security Blog.

Read more »

GoDaddy Employees Used in Attacks on Multiple Cryptocurrency...
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy, the world's largest domain name registrar, KrebsOnSecurity has learned.

Read more »

Convicted SIM Swapper Gets 3 Years in Jail
A 21-year-old Irishman who pleaded guilty to charges of helping to steal millions of dollars in cryptocurrencies from victims has been sentenced to just under three years in prison. The defendant is part of an alleged conspiracy involving at least eight others in the United States who stand accused of theft via SIM swapping, a […]

Read more »

How To Prepare Your Mac for macOS Big Sur – Intego Mac Pod...
Apple released macOS Big Sur last week. On release day, there were a number of issues, including problems launching apps on Macs. We discuss what happened, and how Apple is changing its Gatekeeper security check. We also talk about when you should upgrade to Big Sur and how you should prepare your Mac for the big upgrade. The post How To Prepare Your Mac for macOS Big Sur – Intego Mac Podcast Episode 162 appeared first on The Mac Security Blog.

Read more »

Trump Fires Security Chief Christopher Krebs
President Trump on Tuesday fired his top election security official Christopher Krebs (no relation). The dismissal came via Twitter two weeks to the day after Trump lost an election he baselessly claims was stolen by widespread voting fraud.

Read more »

Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain...
The macOS and iOS keychain allows you to store passwords securely, and access them on all your Apple devices. The post Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain Works appeared first on The Mac Security Blog.

Read more »

Be Very Sparing in Allowing Site Notifications
An increasing number of websites are asking visitors to approve "notifications," browser modifications that periodically display messages on the user's mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters.

Read more »

How to switch search engines on macOS and iOS (and why you s...
Using a different search engine than the default requires you to manually make a change. Here's how to switch default search engines in OS X and iOS. The post How to switch search engines on macOS and iOS (and why you should) appeared first on The Mac Security Blog.

Read more »

How to Securely Dispose of Your Old Mac
So it’s time to move on and end your relationship with your Mac. You had good times together; you’ll always have memories of the best moments you shared. But there’s a better Mac now, it may be faster, have a better display, or be lighter and more portable. While break-ups are always tough, it’s a […] The post appeared first on The Mac Security Blog.

Read more »

Black Friday deal at Amazon now live: Get Apple AirPods Pro ...
Amazon has Apple AirPods Pro on sale for only $169 as part of their Black Friday 2020 sale, now live on their site. Amazon’s price is $80 off Apple’s MSRP, and it’s the lowest price we’ve ever seen for Apple AirPods Pro. Act now if you’re interested! For the latest prices and sales, see our AirPods Price Tracker, → Read More...

Read more »

Buy Apple’s hot new M1 Mac mini this Black Friday/Cyber Mo...
Apple reseller Datavision has received stock of Apple’s popular new M1 Mac minis. DataVision charges sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you can save on sales tax by purchasing through DataVision, depending on your state’s current rate: – Mac mini M1 CPU/256GB SSD: $699 – Mac mini M1 CPU/512GB SSD: $895, $4 off These are the same Mac minis sold by Apple in their retail and online stores. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

OWC has Apple HomePods on sale for $80-$90 off MSRP as part ...
Other World Computing has discounted, new, Apple HomePods on sale for $80-$90 off Apple’s MSRP as part of their Black Friday week 2020 sale: – HomePod Space Gray: $219.88 $80 off MSRP – HomePod White: $209.88 $90 off MSRP These are the same HomePods sold by Apple in their retail and online stores, and OWC’s prices are the lowest available for new HomePods anywhere. Keep an eye on our HomePod Price Tracker for the latest deals and sales from Apple and → Read More...

Read more »

Owners Of Apple’s iPhone 12 Series Report Being Plagued Wi...
NEWS: 11.25.20 – No, the OLED display on your new iPhone isn’t on LSD (and neither are you)… it really has been exhibiting a greenish, or, in other cases, grayish or yellowish, hue. According to a report last Wednesday from the website, MacRumors, Apple has acknowledged a display issue with its new iPhone 12 models. The problem appears to be either a green or gray glow — or other unintended lighting variations under some conditions — as well as flickering of the screen. A photo uploaded to the Apple Communities discussion threads by user “m4x1k” illustrating the green glow on the display of an iPhone 12 Pro, left, compared to a normal screen on the iPhone X S to its right. (Photo: Apple Communities) Based on reports from iPhone 12 owners on the Apple Communities discussion threads and the MacRumors reader forums, the quirk appears to occur when the screen brightness is set to approximately 90% or lower. The flickering or glowing is not always persistent, disappearing after a short time for some individuals. Many have been experiencing the display issue on iOS 14.1, iOS 14.2, and even the first two beta versions of iOS 14.3. MacRumors reported that the display issue can affect all iPhone 12 models from the iPhone 12 and iPhone 12 mini to the iPhone 12 Pro and iPhone 12 Pro Max. How does one know if their particular iPhone 12 model is affected by the display issue? According to a report last Friday from the website, Lifehacker, owners of these iPhones shouldn’t panic just yet and should do the following steps to confirm signs that their screen is exhibiting the problem: turn off the lights in the room and restart the iPhone view a darker image or pull up an all-black background on the screen if the display has a strange green glow, it will be evident After determining that one’s iPhone exhibits the display issue, Lifehacker recommended that people contact Apple — → Read More...

Read more »

B&H offers $150 discount on clearance 2020 13″ Intel-b...
Apple reseller B&H Photo has clearance 2020 13″ 1.4GHz Intel-based MacBook Pros on sale today for $150 off Apple’s original MSRP with prices starting at only $1149. Expedited shipping is free to most US addresses. B&H is offering the lowest prices for these models: – 2020 13″ 1.4GHz/256GB MacBook Pro Space Gray: $1149 $150 off MSRP – 2020 13″ 1.4GHz/256GB MacBook Pro Silver: $1149 $150 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Space Gray: $1349 $150 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Silver: $1349 $150 off MSRP For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Verizon offers $99 Apple iPads as part of their Black Friday...
Verizon will take up to $350 off the price of an 8th generation 2020 Apple Cellular iPad with select trade-ins and a new iPhone purchase as part of their Black Friday 2020 sale. With their discounts, the price for a 32GB WiFi + Cellular iPad can drop to only $99.99. The fine print: “Save $100 w/ select trade. Plus, save $250 more w/iPhone purchase. And, enjoy 6 months of Apple News+ on your iPad, on us. New lines required. 5G Ultra Wideband available only in parts of select cities. 5G Nationwide available in 1800+ cities. $1599.99 purchase on device payment or at retail price required. New line required. Less $100 + $150 promo credit applied to account over 24 mos; promo credit ends if eligibility requirements are no longer met; 0% APR. Trade-in conditions apply. Up to $1599.00 device payment purchase per phone required. Device Payment Purchase required. Less up to $100 promo credit applied over 24 months” Final discount will depend on the value of your trade-in. Verizon’s deal is live on their site today. Offer is valid from November 25th through → Read More...

Read more »

Find the best Black Friday/Holiday shopping deals on Apple A...
Looking for the best price on Apple AirPods this Black Friday and Holiday shopping season? Use our award-winning Apple AirPods Price Tracker to scan price and sales from Apple as well as 20 Apple Authorized Resellers. We update the tracker on a continual basis and point you to the absolute lowest prices on Apple AirPods, Apple AirPods with Wireless Charging Case, and Apple AirPods Pro. Here are the lowest available prices, current as of this post: – Apple AirPods: $119 ($40 off MSRP) at Amazon and Staples. – Apple AirPods with Wireless Charging Case: $149.99 ($50 off MSRP) at Amazon. – Apple AirPods Pro: $189.99 ($60 off MSRP) at Woot. See our price tracker for the latest information as prices can → Read More...

Read more »

Black Friday week 2020 sale: 27″ 5K 6-Core iMacs for $150-...
Amazon has Apple’s 2020 27″ 5K 6-Core iMacs on sale for $150-$250 off MSRP today as part of their Black Friday week 2020 sale. Their price for the 3.3GHz model reflects an extra $150 instant discount reflected in your Amazon shopping cart during checkout. Shipping is free: – 27″ 5K 3.1GHz 6-Core iMac: $1649 $150 off MSRP – 27″ 5K 3.3GHz 6-Core iMac: $1749.99 $250 off MSRP B&H Photo has the 3.1GHz model on sale for $150 off MSRP as well. Expedited shipping is free: – 27″ 5K 3.1GHz 6-Core iMac: $1649 $150 off MSRP These are currently the cheapest prices available for new 27″ iMacs from any of Apple’s resellers. For the latest prices and sales, keep an eye on our iMac Price Tracker, → Read More...

Read more »

Black Friday week 2020 sale at B&H: Hot new 10.9″ Appl...
B&H Photo has new 2020 10.9″ Apple iPad Airs in stock and on sale today for up to $50 off MSRP as part of their Black Friday week 2020 sale. Expedited shipping is free to most addresses in the US: – 10.9″ 64GB WiFi iPad Air: $559 $50 off MSRP – 10.9″ 256GB WiFi + Cell iPad Air: $749 $0 off MSRP – 10.9″ 64GB WiFi iPad Air: $689 $40 off MSRP – 10.9″ 256GB WiFi + Cell iPad Air: $849 $30 off MSRP For the latest prices and sales, keep an eye on our iPad Air Price Tracker, → Read More...

Read more »

Black Friday week 2020 at Amazon: Take up to $110 off Apple ...
Amazon has Apple Watch Series 6 models on sale for $50-$110 off Apple’s MSRP as part of their Black Friday week 2020 sales. These are the same Watches sold by Apple in their retail and online stores. Be sure to order from Amazon, rather than a third-party seller, and note that stock at Amazon can change at any time: – 44mm Apple Watch Series 6 GPS + Cellular: $479.99 $50 off MSRP – 40mm Apple Watch Series 6 GPS + Cellular: $389.98 $110 off MSRP – 44mm Apple Watch Series 6 GPS: $359.98 $70 off MSRP – 40mm Apple Watch Series 6 GPS: $329.98 $70 off MSRP Some sale prices may be restricted to certain watch colors. See our Apple Watch Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Get a 16″ MacBook Pro for up to $740 off MSRP today at App...
Apple has standard-configuration Certified Refurbished 2019 16″ MacBook Pros available for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 Here are Apple’s standard configurations: 16″ 2.6GHz 16-inch TFT Retina Display 2.6GHz Intel 6-Core i7 16GB memory 512GB SSD Radeon Pro 5300M/4GB Touch Bar and Touch ID 16″ 2.3GHz 16-inch TFT Retina Display 2.3GHz Intel 8-Core i9 16GB memory 1TB SSD Radeon Pro 5500M/4GB Touch Bar and Touch ID Save up to $740 on a custom-configured 16″ MacBook Pro with a range of Certified Refurbished models at Apple. You won’t find cheaper custom configurations anywhere else. The following custom models are available today. Stock is likely to come and go, so check Apple’s site for current availability: – 16″ 2.6GHz/32GB RAM/512GB SSD/ Radeon Pro 5300M: $2379 Apple Certified Refurbished $420 off MSRP – 16″ 2.6GHz/16GB RAM/512GB SSD/ Radeon Pro 5500M 8GB: $2209 Apple Certified Refurbished $290 off MSRP – 16″ 2.6GHz/16GB RAM/1TB SSD/ Radeon Pro 5300M: $2209 Apple Certified Refurbished $390 off MSRP – 16″ 2.3GHz/64GB RAM/2TB SSD/ Radeon Pro 5500M 8GB: $3479 Apple Certified Refurbished $620 off MSRP – 16″ 2.3GHz/32GB RAM/1TB SSD/ Radeon Pro 5500M 8GB: $2799 Apple Certified Refurbished $500 off MSRP – 16″ 2.3GHz/32GB RAM/1TB SSD/ Radeon Pro 5500M 8GB/Silver: $2799 Apple Certified Refurbished $500 off MSRP – 16″ 2.3GHz/32GB RAM/2TB SSD/ Radeon Pro 5500M:

Read more »

Best Black Friday week 2020 deals: New 13″ MacBook Pros wi...
Apple resellers have new 13″ MacBook Pros with M1 Apple Silicon CPUs in stock and on sale for this Black Friday week 2020. Save $50-$71 off Apple’s standard MSRP, or save on sales tax in many US states. The following resellers are offering the best deals today on these new models: (1): Apple’s new 2020 13″ MacBook Pros with M1 Apple Silicon CPUs are now on sale at B&H Photo for $50 off MSRP, starting at $1249, as part of their Black Friday week 2020 sales event. Free expedited shipping is available for most addresses in the US: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1449 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1449 $50 off MSRP (2): Amazon has Apple’s new 2020 13″ MacBook Pros with M1 Apple Silicon CPUs now on sale for $50 off MSRP, starting at $1249. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1449 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1449 $50 off MSRP (3): Apple reseller DataVision has Apple’s new 2020 13″ MacBook Pros with Apple Silicon M1 processors available for order including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 2020 13″ MacBook Pro M1 CPU/256GB SSD: $1299 – 2020 13″ MacBook Pro M1 CPU/512GB SSD: $1499 Space Gray, Silver, and Gold colors → Read More...

Read more »