iPhone 14 non-Pro models might not get ProMotion displays after all
A reliable source shot down an earlier leak about the the two “standard’ iPhone 14 models including 120Hz ProMotion screens. This would have brought them closer in line with Apple’s Pro handsets that already have the feature. This is an example of the challenges of making predictions about a handset that is still many months […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iPad Air 5 with ultra-wide cam might beautify video calls
The next-generation iPad Air is right around the corner, according to a leak coming out of Asia. The upcoming tablet will allegedly get a better front-facing camera with support for Center Stage. And a general specs boost. On the inside, the iPad Air 5 supposed to have much in common with the iPad mini 6. […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple once prototyped HomePod with battery power
Apple allegedly thought about creating a portable version of the HomePod with a battery, with a report claiming a prototype was produced but not turned into a final product.A HomePod mini and a USB-C battery pack. Both the HomePod and the HomePod mini are designed for use indoors, with each equipped with power cables and to be plugged into an outlet. While Apple doesn't currently sell a portable version, it did once consider the possibility. Read more...

Read more »

Harness Solar Power to Charge Your Devices and Save Nearly 30%
Who can pass up free electricity, and a renewable one at that? Today, you can get the Paxcess 60W 18V Portable Solar Panel, which ... Read more The post appeared first on iLounge.

Read more »

Non-Pro 'iPhone 14' models won't have ProMotion displays
The "iPhone 14" may not use ProMotion in its non-Pro models, with consumers potentially waiting until the next generation in 2023 to see the display feature.The capabilities of upcoming iPhone displays are persistently rumored about between launches. However, while the iPhone 13 Pro range saw the addition of 120Hz ProMotion to its display, it may not spread to all "iPhone 14" models.In a tweet thread about the camera hole design for the iPhone 14 Pro models, analyst Ross Young of Display Supply Chain Consultants responded to a query about the non-Pro models, and whether there was any expectation of ProMotion's addition in 2022. Young said it wasn't going to happen. Read more...

Read more »

Class action lawsuit points out Powerbeats Pro battery life not as advertised
A lawsuit against Apple is being issued for the Powerbeats Pro over the fact that battery life is not the same as Apple advertised. ... Read more The post appeared first on iLounge.

Read more »

Apple requires employees to present COVID-19 booster shot proof
The Verge has reported that Apple employees will need to present proof that they got a booster shot for COVID-19 or face frequent virus ... Read more The post appeared first on iLounge.

Read more »

The new backdoor exploit affects Linux, Windows and macOS
A new backdoor exploit has proven to be capable of entering many popular operating systems, including devices running Linux, Windows and macOS. Intezer reported ... Read more The post appeared first on iLounge.

Read more »

Mophie has an All-in-One Wireless Charging Station at $50 Off
A wireless charging station serves as the perfect hub for those with multiple devices and families. Today, you can grab the Mophie Wireless Charging ... Read more The post appeared first on iLounge.

Read more »

Entry submissions for the iPhone photography awards go live
The 15th annual iPhone Photography Awards has gone live, with the group’s website now accepting submissions in various categories. The IPPAWARDS portal has a ... Read more The post appeared first on iLounge.

Read more »

$100M App Store class action lawsuit claims launched
Developers who are eligible for the 2019 class action lawsuit made against Apple can now submit their claims. In 2019 a group of app ... Read more The post appeared first on iLounge.

Read more »

Documentary series ‘Lincoln’s Dilemma’ to appear on Apple TV+
New content will be arriving on Apple’s streaming platform- ‘Lincoln’s Dilemma’, a 4-part documentary series. ‘Lincoln’s Dilemma’ explores the actions of former president Abraham ... Read more The post appeared first on iLounge.

Read more »

Monitor Your Pet and Give Him Treats Remotely with the Owlet HD Pet Cam, Now at 52% Off
Pet owners should get an indoor camera to check how their loved ones are doing even while on vacation. The Owlet Home Pet Camera ... Read more The post appeared first on iLounge.

Read more »

Another Modified iPhone with USB-C Port Up For Sale
A second modified iPhone X with USB-C instead of Lightning will be auctioned off on eBay. Following Ken Pillonel’s modification of the iPhone X ... Read more The post appeared first on iLounge.

Read more »

iOS 15 installation figures released
Apple has recently updated its iOS 15 adoption rate, giving viewers an idea of the number of devices that are using the latest operating ... Read more The post appeared first on iLounge.

Read more »

GeForce now service puts Fortnite back on iOS
Epic Games is partnering up with Nvidia to have Fortnite available on the iOS platform. Popular battle royale game Fortnite has been shut out ... Read more The post appeared first on iLounge.

Read more »

Best deals Jan. 16: $447 Panasonic Lumix FZ300, $50 Kindle, Razer discounts, more!
Sunday's best deals include hefty discounts on Razer gear, $150 off the Panasonic Lumix FZ300, and $40 off the Amazon Kindle.Best Deals for January 16Following the chaos of the January sales, we've collected some of the best deals we could find on Apple products, tech accessories, and other items for the AppleInsider audience. Read more...

Read more »

Today in Apple history: Macintosh Plus brings big changes to Mac
January 16, 1986: Apple introduces the Macintosh Plus, its third Mac model and the first to be released after Steve Jobs was forced out of the company the previous year. The Mac Plus boasts an expandable 1MB of RAM and a double-sided 800KB floppy drive. And it’s the first Macintosh to include a SCSI port, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple AR headset could cost consumers over $2,000
Apple's long-rumored mixed-reality headset could cost consumers over $2,000 when it eventually ships, with a report claiming the expensive development and components justifies the potential price.The lengthly development process of the Apple VR headset has resulted in a long wait for its release, with a possibility of a launch in late 2022 or delayed into 2023. While it is anticipated to be a premium device, with pricing rumors between $1,000 and $3,000, Apple may be planning to go closer to the middle of that range.Apple has internally discussed price points for the headset "above $2,000," according to Bloomberg's Mark Gurman in his "Power On" newsletter. Though Apple usually does charge a premium for its hardware over its rivals, the company is apparently doing so because of "some of its internal technologies." Read more...

Read more »

Eve Cam review: a simple and small HomeKit camera
The Eve Cam is a simple indoor camera for HomeKit and HomeKit Secure Video. By relying on HomeKit alone, there’s no extra subscription to pay for and no complicated third-party service to maintain. It (almost) all just works, all using Eve’s device and Apple’s apps and OS integrations. Read on for my full review. more… The post appeared first on 9to5Mac.

Read more »

Apple’s AR/VR headset could be priced above $2,000, feature M1 Pro-like performance
A Friday report indicated that Apple was having trouble with its rumored AR/VR headset due to overheating, camera, and software challenges, which could make the company delay its plans to unveil its Mixed Reality headset this year. Now, Bloomberg’s Mark Gurman is back with some more tidbits regarding the product. more… The post appeared first on 9to5Mac.

Read more »

CarKey support may spread to Hyundai, Genesis by the summer
Drivers may be able to open more cars with an iPhone or Apple Watch in the coming months, with Hyundai and Genesis expected to support Apple's CarKey feature by the summer.Originally introduced in June 2020, Apple's CarKey is a feature designed to unlock and start cars and other vehicles, using a digital key stored in the Wallet app of an iPhone or Apple Watch. While it has so far been officially supported only by BMW, it seems that support could expand in 2022.It is said that CarKey will start to become available in certain models from Hyundai and its Genesis spinoff, according to sources of Mark Gurman's "Power On" newsletter for Bloomberg. Functionality for CarKey will apparentlly roll out for the unidentified models by the summer. Read more...

Read more »

Boost your health with 4 deals on fitness-tracking smartwatches
The most common New Year’s resolution is (you guessed it) to exercise more to improve health and fitness. If that’s your goal for 2022, you’ll have a lot more luck sticking to your resolutions by using a fitness-tracking smartwatch as your accountability buddy. The Apple Watch is our go-to smartwatch, of course. But if you […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Report: Apple’s CarKey feature to expand beyond BMW with new automakers starting this summer
In 2020 at WWDC, Apple announced its CarKey feature. With that, drivers can unlock their cars with the U1 chip on selected iPhones and Apple Watches. Unfortunately, this function had a very slow rollout as only selected BMW models have it. Now, a new report indicates this is about to change. more… The post appeared first on 9to5Mac.

Read more »

Safari API bug leaks browsing data that can reveal a user's identity
A bug in Safari in how it handles the IndexedDB API is potentially leaking information about a user's browsing habits, an issue that could be used to reveal the user's identity.Apple has continuously attempted to make Safari privacy-focused, with the introduction of initiatives to prevent cross-site tracking and the Safari Privacy Report meant to help protect users. However, a bug in how Safari functions may have undone all of that work.A blog post by browser fingerprinting service FingerprintJS points out that there's a problem with the way Apple implemented IndexedDB API in Safari 15. According to the researchers, the bug can allow any website to track a browser's internet activity, and potentially determine their identity. Read more...

Read more »

Pokémon GO Community Day is back in 2022 with Spheal in the spotlight
Pokémon GO is holding today the first Community Day of 2022. With that, trainers will be able to find the snow Pokémon Spheal more frequently in the wild, including its Shiny version for the first time. more… The post appeared first on 9to5Mac.

Read more »

Crime blotter: Gangs suspected in Apple Store robberies in Spain and U.K.
In the latest Apple Crime Blotter, The latest on January 6 defendants who used the Signal app, an iPad was stolen along with a teddy bear, and UPS loses iPhone packages.The Apple Store in Valencia, Spain The latest in an occasional AppleInsider series, looking at the world of Apple-related crime. Read more...

Read more »

Intel, AMD, and Nvidia want to beat Apple silicon. Here’s why they won’t
Once upon a time, you could watch a keynote presentation from any major computer chip company and rest easy in the confidence that the name “Apple” would never pass the lips of any presenter. The message always seemed to be, as per the classic Mad Men meme, “I don’t think of you at all.” But oh how the tables have turned. With the transition to Apple silicon well underway, and the debut of the high-powered M1 Pro and M1 Max chips last summer, major players in the silicon market are hastening to not only mention Apple, but to prove how much better their latest products are than that computer company that nobody used to care about. This past week’s Consumer Electronics Show was a news cavalcade for the likes of Intel, AMD, and Nvidia, all of whom took their time to reassure the vendors that rely on them that, yes, they could play in the same league as Apple. Intel me no secrets, Intel you no lies Perhaps none of these three protested so vociferously as Apple’s most recent ex-partner, Intel. The company took the wraps off its latest series of laptop-bound processors, the Alder Lake series, including a top-of-the-line model that it described as “the fastest mobile processor. Ever.” And, in the truest press conference braggadocio, Intel put out the benchmarks to drive home that fact, showing its Core i9-12900HK processor just edging out the M1 Max in some tests, and handily surpassing it in others. Of course, if we took every benchmark chart from every manufacturer at face value, our brains would go up in a puff of smoke like an evil robot. And given that these chips will probably never make their way into a Mac, we are probably stuck with apples-to-oranges (if you’ll pardon the expression) comparisons. Sure, the Alder Lake performance looks impressive. but did anyone else notice the amount of power Intel’s chip consumes compared to the M1 Mac? Intel But, even before we get to that point, there’s an important factor in one of Intel’s own charts: impressive though the Core i9-12900HK processor may be, its power consumption is much higher than the M1 Max, starting just below that chip’s 35W and climbing all the way to around 75W. Putting that chip in a MacBook Pro would mean a lot of design tradeoffs that Apple wouldn’t be willing to make, even in the name of more power. Graphic content But computer processors aren’t the only industry where Apple’s silicon advances are firing shots across the bow. One of the big stories with the M1 Max and M1 Pro is their graphics performance. In the past, Apple has worked with both major graphics card companies, AMD (which acquired GPU company ATI back in 2006) and Nvidia—both of whom are taking shots at Apple this year, with varying degrees of obliqueness. Nvidia, often considered the graphics card behemoth to beat, boasted during its CES keynote that laptops using its new RTX GPUs are “up to seven times faster” than a 16-inch MacBook Pro with an M1 Max. Except, several of the tools for which Nvidia provides benchmarks have either only beta support for running natively on Apple silicon or no support at all. Others benchmarks, such as the Blender Cycles package that showed the biggest difference, don’t currently support Apple’s Metal graphics framework, potentially putting them at a big disadvantage at the moment. AMD, meanwhile, at least took aim at the power efficiency of Apple’s chips, claiming that some laptops using its new Ryzen 6000 chips can get up to 24-hour battery life—though, that is specifically for video playback. (To be fair, Apple cites similar caveats in its own battery performance.) AMD claims 24-hour battery life (video playback) is possible with its new Ryzen 6000 chip. Apple claims 21 hours of Apple TV playback with the M1 MaxAMD Apple’s not the only competition for these two graphics heavyweights, though. Intel decided to stick its own toe into the GPU business this year, with a new series of discrete graphics cards called Arc. With Intel on one side and Apple on the other—not to mention continued supply chain woes that have made graphics cards scarce—both AMD and Nvidia are likely to be feeling the squeeze this year. Walking away with it How did this all happen? Did Apple just walk into yet another industry and sit down as the titan? Granted, it’s hard to consider Apple the underdog these days, when its market capitalization is flirting with $3 trillion, but let’s dispense with the myth that these silicon advances are things that Apple’s just pulled out of its hat. The company spent the last decade carefully designing and continually improving the processors and graphics chips for its mobile devices before finally implementing that technology in its desktop and laptop computers. It acquired companies that specialize in silicon, from the PA Semi purchase in 2008 that laid the groundwork for Apple’s processors to picking up parts of Dialog Semiconductor in 2018, and invested heavily in graphics tech firms like Imagination Technologies. And, moreover, it’s optimized for a specific case: the best performance it can get at the lowest power consumption. With 45 years under its belt, Apple’s become a master of playing the long game and strategically investing in key technologies, then nurturing them over the course of years. So what looks like an amazing magic trick is actually the result of long periods of hard work—propped up by a whole lot of money. All of that said, let’s not forget that performance isn’t the only reason people choose to use a Mac over a PC. Many consumers aren’t likely to switch, no matter how much power Apple can bring to bear—the gaming market on the Mac, for example, has never been comparable to the PC. And even if Apple silicon performance is eventually outclassed, there will always be those that simply prefer the experience of the Mac. But at least as it stands now, you can get the joys of that experience and the satisfaction of knowing that your platform’s the one to beat.

Read more »

Fifth-gen iPad Air may launch in the Spring with A15 Bionic, 5G
Apple's fifth-generation iPad Air could release in early 2022, a report claims, with it incorporating features similar to the sixth-generation iPad mini, including 5G connectivity and an ultra-wide FaceTime HD camera.Rumors and speculation has Apple holding another special event in the spring, possibly as early as March. While the iPhone SE is expected to be the main launch, it is thought that the iPad Air could go through a refresh at the same time.The sixth-generation iPad Air will apparently incorporate a specifications list that echoes the iPad mini, including an A15 Bionic chip and support for 5G mobile networks, according to Chinese sources of Macotakara. Read more...

Read more »

Making sense of the latest rumors about Apple’s looming AR and Mixed Reality headsets
Apple is likely to enter a new product category with headsets in the near future. So far, there are two rumored products: the AR headset and the Mixed Reality headset, usually called AR/VR headset or “Apple Glasses.” With rumors gaining traction about these products, here’s what we know so far about each of them. more… The post appeared first on 9to5Mac.

Read more »

At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates
The Russian government said today it arrested 14 people accused of working for "REvil," a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin's decision to station 100,000 troops along the nation's border with Ukraine.

Read more »

SysJoker: Cross-Platform Backdoor Malware for Mac, Windows, and Linux
  SysJoker is one of the most recently discovered Mac malware families. But SysJoker is not just Mac malware—it’s cross-platform malware that can also infect PCs running Windows or Linux. Intego detects this malware’s various components as OSX/SysJoker.gen, OSX/SysJoker.lct, Linux/SysJoker.A, and Win32/SysJoker.A. Let’s examine this new threat and what makes it unique. How was SysJoker […] The post appeared first on The Mac Security Blog.

Read more »

SysJoker Malware and Scams in the App Store – Intego Mac Podcast Episode 222
New SysJoker malware attacks Mac, Windows, and Linux computers. Apple has difficulty managing scams and copycat apps in its App Stores. And iCloud Private Relay is provoking ire among phone carriers. The post appeared first on The Mac Security Blog.

Read more »

Who is the Network Access Broker ‘Wazawaka?’
In a great many ransomware attacks, the criminals who pillage the victim's network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene.

Read more »

‘Wormable’ Flaw Leads January 2022 Patch Tuesday
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is "wormable," meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.

Read more »

Vulnerability Summary for the Week of January 3, 2022
Original release date: January 10, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info beyondtrust -- appliance_base_software BeyondTrust Secure Remote Access Base Software through 6.0.1 allows an attacker to achieve full admin access to the appliance, by tricking the administrator into creating a new admin account through an XSS/CSRF attack involving a crafted request to the /appliance/users?action=edit endpoint. This cross-site-scripting (XSS) vulnerability occurs when it does not properly sanitize an unauthenticated crafted web request to the server 2022-01-05 9.3 CVE-2021-31589 MISC MISC MISC sun_moon_jingyao -- network_computer_terminal_protection_system_firmware The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service. 2022-01-03 7.7 CVE-2021-45917 CONFIRM transloadit -- uppy uppy is vulnerable to Server-Side Request Forgery (SSRF) 2022-01-04 7.5 CVE-2022-0086 MISC CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info artifex -- ghostscript Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). 2022-01-01 4.3 CVE-2021-45944 MISC MISC DEBIAN artifex -- ghostscript Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). 2022-01-01 4.3 CVE-2021-45949 MISC MISC MISC DEBIAN assimp -- assimp Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-based buffer overflow in _m3d_safestr (called from m3d_load and Assimp::M3DWrapper::M3DWrapper). 2022-01-01 4.3 CVE-2021-45948 MISC MISC asus -- rt-ac52u_b1_firmware Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack. 2022-01-03 4.3 CVE-2021-46109 MISC atlassian -- jira_server_and_data_center Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. 2022-01-04 4.3 CVE-2021-43942 MISC booking_calendar_project -- booking_calendar The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting 2022-01-03 4.3 CVE-2021-25040 MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. 2022-01-05 4 CVE-2022-22110 CONFIRM MISC daybydaycrm -- daybyday_crm In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application. 2022-01-05 6.5 CVE-2022-22111 CONFIRM MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information. 2022-01-05 4 CVE-2022-22108 CONFIRM MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all. 2022-01-05 4 CVE-2022-22107 CONFIRM MISC dhrystone_project -- dhrystone A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS). 2022-01-03 5 CVE-2020-23026 MISC dmproadmap_project -- dmproadmap DMP Roadmap before 3.0.4 allows XSS. 2022-01-01 4.3 CVE-2021-44896 MISC MISC MISC fluxbb -- fluxbb Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. 2022-01-04 4.3 CVE-2021-43677 MISC MISC geminilabs -- site_reviews The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin 2022-01-03 4.3 CVE-2021-24973 CONFIRM MISC github_readme_stats_project -- github_readme_stats Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError. 2022-01-06 4.3 CVE-2020-23986 MISC gpac -- gpac A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2, which causes a Denial of Service. 2022-01-05 4.3 CVE-2021-45831 MISC gpac -- gpac A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent). 2022-01-05 4.3 CVE-2021-46038 MISC ideabox -- powerpack_addons_for_elementor The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue 2022-01-03 4.3 CVE-2021-25027 CONFIRM MISC premio -- chaty The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting 2022-01-03 4.3 CVE-2021-25016 MISC updraftplus -- updraftplus The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues 2022-01-03 4.3 CVE-2021-25022 CONFIRM CONFIRM MISC uwebsockets_project -- uwebsockets uWebSockets 19.0.0 through 20.8.0 has an out-of-bounds write in std::__1::pair uWS::HttpParser::fenceAndConsumePostPadded

Read more »

How to Run Windows on an Intel or M1 Mac
There used to be many options for running Windows on a Mac, and now it's more limited, but you can still run Windows on your Mac if you want. The post appeared first on The Mac Security Blog.

Read more »

500M Avira Antivirus Users Introduced to Cryptomining
Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn't alone in this dubious endeavor: Avira antivirus -- which has built a base of 500 million users worldwide largely by making the product free -- was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.

Read more »

Norton 360 Now Comes With a Cryptominer
Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers' computers. Norton's parent firm says the cloud-based service that activates the program and enables customers to profit from the scheme -- in which the company keeps 15 percent of any currencies mined -- is "opt-in," meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, "Dude, where's my crypto?"

Read more »

Look-Alike Letters Lead Users to Lose Moola – Intego Mac Podcast Episode 221
Attackers can simulate an iPhone restart to keep malware alive, and an interesting HomeKit vulnerability could brick your device. We discuss malicious QR codes, and we take a deep dive into Apple's two-factor authentication, which more and more users need to use Apple devices. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of December 27, 2021
Original release date: January 4, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no high vulnerabilities recorded this week. Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- log4j Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. 2021-12-28 6 CVE-2021-44832 MISC MISC MLIST CONFIRM MLIST livehelperchat -- live_helper_chat livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-26 4.3 CVE-2021-4169 MISC CONFIRM mediawiki -- mediawiki In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. 2021-12-24 5 CVE-2021-45471 MISC MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. 2021-12-24 4.3 CVE-2021-45472 MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). 2021-12-24 4.3 CVE-2021-45473 MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. 2021-12-24 4.3 CVE-2021-45474 MISC MISC netgear -- rbk752_firmware Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6. 2021-12-26 5.2 CVE-2021-45584 MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info invoiceninja -- invoice_ninja invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-24 3.5 CVE-2021-3977 MISC CONFIRM Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info netgear -- ac2600_firmware Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.88, AC2400 before 1.2.0.88, AC2600 before 1.2.0.88, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.84, R6330 before 1.1.0.84, R6350 before 1.1.0.84, R6700v2 before 1.2.0.88, R6800 before 1.2.0.88, R6850 before 1.1.0.84, R6900v2 before 1.2.0.88, R7200 before 1.2.0.88, R7350 before 1.2.0.88, R7400 before 1.2.0.88, and R7450 before 1.2.0.88. 2021-12-26 not yet calculated CVE-2021-45644 MISC netgear -- d7000v2_firmware Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000 before 1.0.11.110, R7100LG before 1.0.0.72, R7900 before 1.0.4.30, R8000 before 1.0.4.62, XR300 before 1.0.3.56, R7000P before 1.3.2.132, R8500 before 1.0.2.144, R6900P before 1.3.2.132, and R8300 before 1.0.2.144. 2021-12-26 not yet calculated CVE-2021-45624 MISC 4nb -- videooffice   An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check. 2021-12-28 not yet calculated CVE-2020-7878 MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25025 MISC MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25024 MISC MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25026 MISC MISC apache -- apisix_dashboard   In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication. 2021-12-27 not yet calculated CVE-2021-45232 CONFIRM MLIST archivy -- archivy   archivy is vulnerable to Cross-Site Request Forgery (CSRF) 2021-12-25 not yet calculated CVE-2021-4162 CONFIRM MISC asus -- rt-n53_devices   ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp. 2021-12-28 not yet calculated CVE-2019-20082 MISC MISC attendance_management_system -- attendance_management_system   Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system. 2021-12-26 not yet calculated CVE-2021-44598 MISC authguard -- authguard   basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. 2021-12-27 not yet calculated CVE-2021-45890 MISC MISC MISC MISC avast -- antivirus Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense. 2021-12-27 not yet calculated CVE-2021-45339 MISC MISC avast -- antivirus   Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC interfaces which could lead to exit the sandbox and acquire SYSTEM privileges. 2021-12-27 not yet calculated CVE-2021-45336 MISC MISC avast -- antivirus   Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wsc_proxy.exe which could lead to acquire antimalware (AM-PPL) protection. 2021-12-27 not yet calculated CVE-2021-45337 MISC MISC avast -- antivirus   Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security. 2021-12-27 not yet calculated CVE-2021-45338 MISC MISC MISC MISC avast -- antivirus   Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files. 2021-12-27 not yet calculated CVE-2021-45335 MISC MISC biostar -- racing_gt_evo   An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000. 2022-01-01 not yet calculated CVE-2021-44852 MISC bitmask -- riseup   Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges. 2021-12-30 not yet calculated CVE-2021-44466 MISC brave -- brave_desktop   In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916. 2021-12-27 not yet calculated CVE-2021-45884 MISC MISC MISC MISC carinal -- tien_hospital_health_report_system   Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user. 2021-12-29 not yet calculated CVE-2021-44160 MISC celery -- celery   This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. 2021-12-29 not yet calculated CVE-2021-23727 MISC MISC cscms -- cscms   An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. 2021-12-27 not yet calculated CVE-2020-21238 MISC damicms -- damicms   A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie. 2021-12-27 not yet calculated CVE-2020-21236 MISC dl-axist -- devices   The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings. 2022-01-01 not yet calculated CVE-2021-43333 MISC CONFIRM dmp -- roadmap   DMP Roadmap before 3.0.4 allows XSS. 2022-01-01 not yet calculated CVE-2021-44896 MISC MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). 2022-01-01 not yet calculated CVE-2021-45957 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in check_bad_address (called from check_for_bogus_wildcard and FuzzCheckForBogusWildcard). 2022-01-01 not yet calculated CVE-2021-45951 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). 2022-01-01 not yet calculated CVE-2021-45956 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). 2022-01-01 not yet calculated CVE-2021-45952 MISC MISC dnsmasq -- dnsmasq Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from hash_questions and fuzz_util.c). 2022-01-01 not yet calculated CVE-2021-45953 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from answer_auth and FuzzAuth). 2022-01-01 not yet calculated CVE-2021-45954 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c). 2022-01-01 not yet calculated CVE-2021-45955 MISC MISC elgg -- elgg   elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-24 not yet calculated CVE-2021-4072 MISC CONFIRM emerson -- xweb_300d_evo   Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal. 2021-12-30 not yet calculated CVE-2021-45427 MISC MISC MISC emuse -- eservices_and_envoice   Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host. 2021-12-29 not yet calculated CVE-2021-36722 CONFIRM emuse -- eservices_and_envoice   Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service. 2021-12-29 not yet calculated CVE-2021-36723 CONFIRM evga -- precision_xoc   The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descriptor which allows attackers to access sensitive components and data. 2021-12-28 not yet calculated CVE-2020-22057 MISC expat -- expat   In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). 2022-01-01 not yet calculated CVE-2021-45960 MISC MISC MISC fatek -- winproladder   FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code. 2021-12-28 not yet calculated CVE-2021-43556 MISC fatek -- winproladder   FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code. 2021-12-28 not yet calculated CVE-2021-43554 MISC forescout -- secureconnector_local_service   ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash. 2021-12-29 not yet calculated CVE-2021-36724 CONFIRM gdal -- gdal   GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment). 2022-01-01 not yet calculated CVE-2021-45943 MISC MISC MISC MISC gerapy -- gerapy   Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8. 2021-12-27 not yet calculated CVE-2021-43857 CONFIRM MISC MISC ghostscript -- ghostpdl Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). 2022-01-01 not yet calculated CVE-2021-45944 MISC MISC ghostscript -- ghostpdl   Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). 2022-01-01 not yet calculated CVE-2021-45949 MISC MISC MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the allocated buffer. The attacker has control over a part of the address that data is written to, control over the written data, and (to some extent) control over the amount of data that is written. 2021-12-28 not yet calculated CVE-2021-45910 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large amount of arbitrary data outside the boundaries of a buffer. 2021-12-28 not yet calculated CVE-2021-45909 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted. 2021-12-28 not yet calculated CVE-2021-45907 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted. 2021-12-28 not yet calculated CVE-2021-45908 MISC gif2apng -- gif2apng   An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundaries of the buffer. 2021-12-28 not yet calculated CVE-2021-45911 MISC giftrans -- giftrans   The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. This allows an attacker to overwrite up to 250 bytes outside of the allocated buffer with arbitrary data. 2022-01-01 not yet calculated CVE-2021-45972 MISC MISC MISC glewlwyd -- glewlwyd   Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. 2021-12-30 not yet calculated CVE-2021-45379 MISC MISC go -- go   net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. 2022-01-01 not yet calculated CVE-2021-44716 CONFIRM go -- go   Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. 2022-01-01 not yet calculated CVE-2021-44717 CONFIRM google -- android   An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later 2021-12-29 not yet calculated CVE-2021-38688 CONFIRM grok -- grok   Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func

Read more »

Get an Apple Watch Series 7 for $50 off MSRP, prices start at $349
Amazon has Apple Watch Series 7 models on sale for $50 off MSRP including free shipping. Their prices are the lowest available for Apple Watch Series 7 models today: – 41mm Apple Watch Series 7 GPS + Cellular: $449, save $50 – 45mm Apple Watch Series 7 GPS + Cellular: $479, save $50 – 41mm Apple Watch Series 7 GPS: $349, save $50 – 45mm […] The post first appeared on MacPrices.net.

Read more »

Here are the details of Apple’s 2022 Education discounts for students, teachers, and staff
Need a new Apple Mac or iPad for school? Whether you’re a student, teacher, or staff member, you can use your .edu email address when ordering at Apple Education to take up to $400 off the price of a new Mac and up to off the price of a new iPad. All teachers, students, and staff of any educational institution with a .edu email address […] The post first appeared on MacPrices.net.

Read more »

Amazon is blowing out 2020 21″ iMacs for only $599
Amazon has clearance 2020 21″ iMacs (2.3GHz Dual-Core i5, 8GB RAM, 256GB SSD) on sale right now for $599.99 including free shipping. Original MSRP for this model was $1099. Amazon expects delivery in February, so the iMac is not in stock today. However, they are accepting orders at this discounted price. Check their site for the latest stock status. For the latest prices and deals, […] The post first appeared on MacPrices.net.

Read more »

Find the best deal on an Apple MacBook using our exclusive MacBook Price Trackers
In the market for a new 13″ MacBook Air, 13″ MacBook Pro, 14″ MacBook Pro, or 16″ MacBook Pro with M1, M1 Pro, or M1 Max Apple Silicon? Use our Apple award-winning and exclusive price trackers to find the best deal or lowest price on one of Apple’s Silicon MacBooks, as well as the rest of their lineup of Macs, iPads, iPhones, and accessories: – […] The post first appeared on MacPrices.net.

Read more »

Red Pocket Mobile is offering the Apple iPhone 13 for up to $50 off with free 6 months of Unlimited nationwide 5G service
Switch to Red Pocket Mobile and get an Apple iPhone 13 Pro for $50 off MSRP, plus get free 6 months of Unlimited nationwide 5G service with the purchase of any iPhone 13. Red Pocket Mobile is a nationwide service using all the major wireless carrier networks and offers 50GB plans for $50 per month, no contract required, and cheaper plans starting at $20/month for […] The post first appeared on MacPrices.net.

Read more »

24″ M1 iMacs on sale for $1249, $50 off Apple’s MSRP
Amazon has base 24″ M1 iMacs (8-Core CPU/7-Core GPU/8GB RAM/256GB SSD) on sale today for $1249 shipped. Their price is $50 off Apple’s MSRP, and it’s the lowest price available for a new 24″ M1 iMac. Check their site for the stock status of your chosen color, as Amazon’s stock continues to flucuate. For the latest prices and sales, see our iMac Price Tracker, updated […] The post first appeared on MacPrices.net.

Read more »

Open-Box 16″ M1 Pro MacBook Pros available for $200-$300 off MSRP, prices start at $2249
QuickShip Electronics has open-box return 16″ M1 Pro MacBook Pros in stock and on sale for $200-$300 off MSRP on their eBay store right now with free express delivery. According to QuickShip, “The item in this listing is an Open Box (packaging maybe slightly distressed) The unit powers on with factory settings restored and includes the original accessories.” The following standard-configuration models are available: – […] The post first appeared on MacPrices.net.

Read more »

Stock Alert! Order a new 16″ M1 Pro MacBook Pro today and get free 1-2 day shipping
New 16″ MacBook Pros with Apple’s M1 Pro and M1 Max CPUs have been very hard to find, largely due to current global supply constraints. However, B&H Photo is reporting stock of Space Gray standard 16″ M1 Pro configurations this morning with free 1-2 day shipping to most US addresses. Act now if you’re interested: – 16″ 10-Core M1 Pro MacBook Pro (16GB RAM/512GB SSD/Space […] The post first appeared on MacPrices.net.

Read more »

Apple has maxed-out 13″ M1 MacBook Airs (16GB RAM/1TB SSD) on sale for only $1399 today, $250 off MSRP
Save $250 on maxed-out 13″ M1 MacBook Airs today at Apple (16GB RAM/1TB SSD) with Certified Refurbished models available for $1399 in Space Gray and Gold colors. Regular price for this configuration is $1649. Apple’s Certified Refurbished products are like-new and come with Apple’s standard one-year warranty and available AppleCare. According the Apple, “You will receive a “like new” device with genuine Apple replacement parts […] The post first appeared on MacPrices.net.

Read more »

Apple has maxed-out 13″ M1 MacBook Airs (16GB RAM/1TB SSD) on sale for only $1399 today, $250 off MSRP
Save $250 on maxed-out 13″ M1 MacBook Airs today at Apple (16GB RAM/1TB SSD) with Certified Refurbished models available for $1399 in Space Gray and Gold colors. Regular price for this configuration is $1649. Apple’s Certified Refurbished products are like-new and come with Apple’s standard one-year warranty and available AppleCare. According the Apple, “You will receive a “like new” device with genuine Apple replacement parts […] The post first appeared on MacPrices.net.

Read more »

New promo at Xfinity Mobile: $400 off any Apple iPhone for new customers
Xfinity Mobile is offering any new Apple iPhone for $400 off MSRP for new customers. This includes the iPhone 13. Price for the phone, including the discount, is spread monthly over a 24 month term. The fine print: “Offer ends 2/15/22. Requires purchase of new, eligible 5G iPhone while supplies last, 24 month Xfinity Mobile Device Payment Plan Agreement (“Device Agreement”), activation of new Xfinity […] The post first appeared on MacPrices.net.

Read more »

Apple iPhone SE on sale for $249 at no-contract wireless carrier Boost Mobile, $150 off Apple’s MSRP
Boost Mobile is offering Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249. 128GB models are offered at a $50 discount: $399. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly […] The post first appeared on MacPrices.net.

Read more »