Review: Keychron K3 is a classic mechanical keyboard in a mo...
The Keychron K3 is a particularly well-designed slimline mechanical keyboard, but its chief competition is other keyboards from the same manufacturer.The Keychron K3 can feature hot-swappable keysIf you don't like mechanical keyboards, then the Keychron K3 is not going to change your mind — but it might come close. It's larger than the kind of chiclet keyboard you get from Apple, yet slimline and small compared to most other mechanical ones. Read more...

Read more »

Share repurchases helped grow Berkshire Hathaway's Appl...
Berkshire Hathaway's annual letter to shareholders has praised Apple, using the iPhone maker as a demonstration of how share repurchases can be a good thing for investors.Berkshire Hathaway chairman of the board Warren BuffettEvery year, Warren Buffett's Berkshire Hathaway writes a letter to shareholders, outlining its investments and events over the previous 12 months. In the 2020 letter released on Saturday, the investment firm wrote at length about its ownership in Apple. Read more...

Read more »

Warren Buffett praises AAPL stock in annual letter, Berkshir...
Warren Buffett’s Berkshire Hathaway Inc. published its highly-anticipated annual letter this morning, offer details on the conglomerate’s investments in 2020. In this year’s letter, Buffett touted that Apple ranks as Berkshire’s biggest common stock investment, even though the conglomerate sold 9.81 million shares of AAPL at the end of 2020. more… The post Warren Buffett praises AAPL stock in annual letter, Berkshire’s stake now valued at $120 billion appeared first on 9to5Mac.

Read more »

Apple releases limited-edition Billie Eilish-themed gift car...
Coinciding with the release of the Apple TV+ documentary "Billie Eilish: The World's a Little Blurry," Apple is offering a limited-edition version of its gift card themed to represent the musical artist.The Billie Eilish Limited Edition Apple Gift Card is listed in the online Apple Store alongside Apple's other designs. The new option is both the top listing and the default for the page, and is one of nine designs users can choose from.The Billie Eilish-themed Apple logo is green on a blue background, with gradients on each of the sides to give a form of glowing effect. The logo matches the aesthetic of the documentary's promotional images, as well as Eilish's signature green hair coloring. Read more...

Read more »

Minnesota bill targets Apple App Store
A proposed bill in the Minnesota state legislature would force Apple's App Store and Alphabet's derivative Google Play store to keep the… The post appeared first on MacDailyNews.

Read more »

Feature Request: HomePod needs to properly count Apple Music...
HomePod and even the new HomePod mini don’t count songs when you ask Siri to play something on your smart speaker. This affects your Apple Music Replay statistics and integration with third-party Apple Music applications. Luckily, there is a workaround, but hopefully this is something Apple fixes sooner rather than later. more… The post Feature Request: HomePod needs to properly count Apple Music played songs and stats appeared first on 9to5Mac.

Read more »

The Rewind: M1 Mac mini diary – my favorite Apple product ...
In this look back at the M1 Mac mini, I discuss my experiences with Apple’s most affordable M1-enabled Mac. Is Apple’s compact desktop computer worth it? Watch my M1 Mac mini diary for more details. more… The post The Rewind: M1 Mac mini diary – my favorite Apple product of the moment [Video] appeared first on 9to5Mac.

Read more »

Facebook agrees to $650M settlement to end Illinois privacy ...
A judge has approved a settlement valued at $650 million from Facebook to end a privacy lawsuit, one which alleged the social network used facial recognition technology on user photos stored on its iPhone app without permission.Facebook CEO Mark ZuckerbergThe lawsuit, which started in April 2015, alleged Facebook did not gain consent from users to use its facial tagging features on their photographs. Originally filed by Chicago attorney Jay Edelson on behalf of plaintiff Carlo Licata, the complaint claimed the consent-less tagging was not allowed under privacy laws in Illinois. Read more...

Read more »

Apple selling limited-edition Billie Eilish Gift Card follow...
Apple TV+ debuted a new Billie Eilish documentary yesterday, entitled The World’s A Little Blurry. To coincide with that, Apple is also now selling a limited-edition Apple Gift Card inspired by Eilish. more… The post Apple selling limited-edition Billie Eilish Gift Card following TV+ documentary release appeared first on 9to5Mac.

Read more »

Apple @ Work: A $99 low-cost Magic Keyboard would turn the i...
It’s about that time of year when we start thinking about what Apple will release throughout the year hardware and software-wise, so being in education, I naturally start thinking about what I want to see Apple do with the iPad in 2021. The more I think about it, the more I think Apple’s next act with the iPad has nothing to do with the iPad itself. This week, I want to talk about the need for a low-cost Magic Keyboard. more… The post Apple @ Work: A $99 low-cost Magic Keyboard would turn the iPad into a sub-$400 laptop appeared first on 9to5Mac.

Read more »

Portless 'iPhone 13' could restore iOS without nee...
A version of the "iPhone 13" that lacks a Lightning port could force changes to recovery processes, a report claims, with an "Internet Recovery" mode allowing for the reinstallation of iOS without needing to connect the iPhone to a Mac or PC.Recovering an unresponsive iPhone usually requires it to be connected to another device, typically via the Lightning port on the base. If rumors of a port-less iPhone are true, the lack of a Lightning port or any other standard physical connection may make the device difficult to maintain.To allow for a complete reinstallation of iOS on an unresponsive iPhone without a distinct physical connection, Apple is allegedly looking at ways to do so. Based on rumors from Appleosophy, the main way to do this is by something tentatively called "Internet Recovery." Read more...

Read more »

Starling Home Hub 8.0 firmware adds Developer Connect API to...
The Starling Home Hub is one of my favorite technology products in recent memory because it puts you back in control of your technology integrations. I love Nest products, particularly the thermostat, but it has yet to add HomeKit control. Being someone that has built my entire smart home setup around HomeKit, I won’t buy a product that doesn’t work with HomeKit. The Starling Home Hub turns all of your Nest products into HomeKit compatible options. With its new 8.0 firmware, Starling is going even further with a new Developer Connect API. more… The post Starling Home Hub 8.0 firmware adds Developer Connect API to take Nest products beyond HomeKit appeared first on 9to5Mac.

Read more »

M1 MacBook Air vs Pro: What to buy and why to spend extra on...
The first Mac laptops with Apple silicon have changed the game. But now that the MacBook Air and MacBook Pro models have nearly identical M1 processors, choosing which model to buy isn't as easy as it used to be. That's why we're here to break it all down and take away the guesswork.Design Neither the 13-inch MacBook Pro nor the MacBook Air is any different than the models they replace. They both measure the same 8.36 inches by 11.97 inches, and the Air still has a tapered edge that extends from 0.16 inches to 0.63 inches while the Pro has a fixed 0.61-inch height. And the Air is lighter at 2.8 pounds versus just 3 pounds on the Pro.To read this article in full, please click here

Read more »

Achieve a stylish look with the Anwaut stainless steel wrist...
Few are more sophisticated than a stainless steel link band for a watch. When you’re aiming for an all-around stylish accessory for your Apple ... Read moreAchieve a stylish look with the Anwaut stainless steel wristband for your Apple Watch, now only $13 The post Achieve a stylish look with the Anwaut stainless steel wristband for your Apple Watch, now only $13 appeared first on iLounge.

Read more »

Achieve a stylish look with the Anwaut stainless steel wrist...
Few are more sophisticated than a stainless steel link band for a watch. When you’re aiming for an all-around stylish accessory for your Apple ... Read moreAchieve a stylish look with the Anwaut stainless steel wristband for your Apple Watch, now only $13 The post Achieve a stylish look with the Anwaut stainless steel wristband for your Apple Watch, now only $13 appeared first on iLounge.

Read more »

MagBuddy Wireless Charge Desk Mount is 28% off
iLounge has a special deal on the MagBuddy Wireless Charge Desk Mount, which allows you to quickly charge up your iPhone and Apple Watch ... Read more The post appeared first on iLounge.

Read more »

Siri to get atypical speech upgrades
Apple is currently trying to make Siri better by researching how the digital assistant could understand atypical speech. The Wall Street Journal reports that ... Read more The post appeared first on iLounge.

Read more »

Apple MacArthur Center closing amid mall safety issues
Apple’s retail store in MacArthur Center mall in Virginia is set to be closing permanently after being operational for more than 14 years. The ... Read more The post appeared first on iLounge.

Read more »

Apple increasing sign language interpreters in stores
Apple will be increasing the number of sign language interpreters in Apple Store locations around the globe, which means more hard of hearing and ... Read more The post appeared first on iLounge.

Read more »

Apple Forced To Add iPhone and MacBook Repairability Scores ...
Apple has added iPhone and MacBook repairability scores to its online store in France to comply with a new French law that came into effect this year. From a report: MacGeneration reports that the rating takes into account features like how easily a device can be disassembled and the availability of repair manuals and spare parts. Links to each product's final score, with details for how they were calculated, are available on this support page. The ratings for Apple's products vary between products and generations. Its iPhone 12 lineup all have scores of six out of 10 for example, while the previous year's iPhone 11s are rated lower at between 4.5 and 4.6. The improvement, according to the detailed scoring assessment, is due to the newer iPhones being easier to dismantle than the previous year's models, and spare parts being cheaper compared to the cost of the phone itself. There's less of a spread between the company's different MacBook models, whose scores range from 5.6 to 7. Read more of this story at Slashdot.

Read more »

Apple Mail and Hidden Tracking Images
John Gruber, writing at DaringFireball: In my piece yesterday about email tracking images ("spy pixels" or "spy trackers"), I complained about the fact that Apple -- a company that rightfully prides itself for its numerous features protecting user privacy -- offers no built-in defenses for email tracking. A slew of readers wrote to argue that Apple Mail does offer such a feature: the option not to load any remote resources at all. It's a setting for Mail on both Mac and iOS, and I know about it -- I've had it enabled for years. But this is a throwing-the-baby-out-with-bath-water approach. What Hey offers -- by default -- is the ability to load regular images automatically, so your messages look "right", but block all known images from tracking sources (which are generally 1 x 1 px invisible GIFs). Typical users are never going to enable Mail's option not to load remote content. It renders nearly all marketing messages and newsletters as weird-looking at best, unreadable at worst. And when you get a message whose images you do want to see, when you tell Mail to load them, it loads all of them -- including trackers. Apple Mail has no knowledge of spy trackers at all, just an all-or-nothing ability to turn off all remote images and load them manually. Mail's "Load remote content in messages" option is a great solution to bandwidth problems -- remember to turn it on the next time you're using Wi-Fi on an airplane, for example. It's a terrible solution to tracking. No one would call it a good solution to tracking if Safari's only defense were an option not to load any images at all until you manually click a button in each tab to load them all. But that's exactly what Apple offers with Mail. "Don't get me started on how predictable this entire privacy disaster was, once we lost the war over whether email messages should be plain text only or could contain embedded HTML. Effectively all email clients are web browsers now, yet don't have any of the privacy protection features actual browsers do," he adds. Read more of this story at Slashdot.

Read more »

‘BARS’ is a new Facebook app for creating and sharing ra...
The NPE Team, which is part of Facebook, today introduced an experimental iPhone app called BARS. The idea of the app is to provide a quick and easy way to create and share raps using professionally created beats. more… The post ‘BARS’ is a new Facebook app for creating and sharing raps appeared first on 9to5Mac.

Read more »

Developers have until March 31 to return DTK Mac mini to App...
As we reported earlier this month, Apple has asked developers to prepare DTK Mac minis to be returned to the company sometime this year. Now Apple has confirmed that developers have until March 31, 2021 to send the Developer Transition Kit (DTK) back to Cupertino. more… The post Developers have until March 31 to return DTK Mac mini to Apple and get $500 credit appeared first on 9to5Mac.

Read more »

Apple says Developer Transition Kit must be returned by Marc...
Apple in an email sent out on Friday requested developers who took part in the Universal App Quick Start Program to return the Developer Transition Kit, a custom A12Z Bionic-powered Mac mini designed to prepare app makers for Apple Silicon Macs.According to the letter, program participants have until March 31, 2021, to return the loaned DTK to Apple."Now that the new MacBook Air, Mac mini, and MacBook Pro powered by the Apple M1 chip are available, youll need to return the Developer Transition Kit (DTK ) that was loaned to you as part of the program. Please follow the instructions below to return the DTK, at no cost to you," Apple says in a post to its dedicated Universal App Quick Start Program website. Read more...

Read more »

'Narcos' star Wagner Moura to star in Apple TV+ or...
Wagner Moura, best known for his turn as Pablo Escobar in Netflix series "Narcos," will lead opposite Elisabeth Moss in Apple TV+ thriller "Shining Girls," according to a report on Friday.Source: Variety"Shining Girls" is a metaphysical, time travel thriller based on Lauren Beukes' 2013 best-selling novel. The story revolves around a Depression-era drifter who discovers a key to a house that unlocks to different eras in Chicago's history. In order to travel through the portal, however, he must murder women burning with potential. Read more...

Read more »

What will drive Apple stock this year
How will Apple stock fare throughout the rest of this year? The answer to that question hinges on these seven factors affecting AAPL shares… The post appeared first on MacDailyNews.

Read more »

Narcos’ Wagner Moura to star opposite Elizabeth Moss in �...
"Narcos" star Wagner Moura has been tapped as a lead opposite Elisabeth Moss in "Shining Girls," Apple TV+’s metaphysical thriller series… The post Narcos’ Wagner Moura to star opposite Elizabeth Moss in ‘Shining Girls’ for Apple TV+ appeared first on MacDailyNews.

Read more »

How to watch the new Billie Eilish documentary ‘The World�...
Billie Eilish shot into the mainstream over the last couple of years as she swept the 2020 Grammys with her album, “When We All Fall Asleep, Where Do We Go?” Today her documentary is premiering on Apple TV+ and in limited theaters. Read along for how to watch The World’s a Little Blurry even if you aren’t already an Apple TV+ subscriber. more… The post How to watch the new Billie Eilish documentary ‘The World’s a Little Blurry’ on Apple TV+ appeared first on 9to5Mac.

Read more »

How to watch the Post Malone Pokemon 25 virtual concert on y...
Pokemon is holding a Post Malone concert in honor of its 25-year anniversary on February 27. Here's how to watch the event on your iPhone, iPad, or Mac.Celebrate 25 years of Pokemon by watching the Post Malone concertPokemon day commemorates the anniversary of the release of the original versions of Pokemon Red and Pokemon Green in Japan in 1996. The Pokemon Company is holding a concert to kick off its yearlong celebration which will take place on Saturday, February 27 at 7:00 PM Eastern Time. Read more...

Read more »

‘Masters of the Air’: Austin Butler and Callum Turner to...
The latest event series in the "Band of Brothers" saga, "Masters of the Air: is gaining some momentum at Apple Studios as Austin Butler … The post ‘Masters of the Air’: Austin Butler and Callum Turner to star in ‘Band Of Brothers’ sequel for Apple TV+ appeared first on MacDailyNews.

Read more »

How $100M in Jobless Claims Went to Inmates
The U.S. Labor Department's inspector general said this week that roughly $100 million in fraudulent unemployment insurance claims were paid in 2020 to criminals who are already in jail. That's a tiny share of the estimated tens of billions of dollars in jobless benefits states have given to identity thieves in the past year. To help reverse that trend, many states are now turning to a little-known private company called ID.me. This post examines some of what that company is seeing in its efforts to stymie unemployment fraud.

Read more »

Silver Sparrow Malware Targets Apple’s New M1 Macs – Int...
Silver Sparrow malware has been found targeting Macs, including Apple's new M1 models, but we don't know what the malware is trying to do. Apple has started going after App Store subscription scams, patches an iCloud website vulnerability, will make "zero-click" attacks harder to carry out in iOS. And, yes, we have some good news for Android users. The post Silver Sparrow Malware Targets Apple’s New M1 Macs – Intego Mac Podcast Episode 176 appeared first on The Mac Security Blog.

Read more »

Silver Sparrow: 40,000 Macs Infected by Mysterious M1-native...
A new family of Mac malware dubbed Silver Sparrow (detected by Intego and others as OSX/Slisp) has apparently infected at least 40,000 Macs, according to reports. It is also one of the first pieces of Mac malware that runs natively on Apple’s new M1 processors. These facts combined have propelled Silver Sparrow into the mainstream […] The post Silver Sparrow: 40,000 Macs Infected by Mysterious M1-native Malware appeared first on The Mac Security Blog.

Read more »

Checkout Skimmers Powered by Chip Cards
Easily the most sophisticated skimming devices made for hacking terminals at retail self-checkout lanes are a new breed of PIN pad overlay combined with a flexible, paper-thin device that fits inside the terminal's chip reader slot. What enables these skimmers to be so slim? They draw their power from the low-voltage current that gets triggered when a chip-based card is inserted. As a result, they do not require external batteries, and can remain in operation indefinitely.

Read more »

How to choose the right Mac for your use case
Apple’s Mac product line has changed a lot recently, and if you’re looking for a new Mac, you have a number of options to consider. For some, it’s a simple choice, but for others, the choice can be more complex. You may need a desktop Mac, and you currently have four options for that type […] The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of February 15, 2021
Original release date: February 22, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accellion -- fta Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later. 2021-02-16 7.2 CVE-2021-27102 MISC MISC accellion -- fta Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later. 2021-02-16 10 CVE-2021-27104 MISC MISC accellion -- fta Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. 2021-02-16 7.5 CVE-2021-27103 MISC MISC accellion -- fta Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later. 2021-02-16 7.5 CVE-2021-27101 MISC MISC advantech -- webaccess/scada An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server Application Privilege Escalation, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege. 2021-02-17 7.2 CVE-2020-13555 MISC advantech -- webaccess/scada An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege. 2021-02-17 7.2 CVE-2020-13553 MISC advantech -- webaccess/scada An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege. 2021-02-17 7.2 CVE-2020-13552 MISC advantech -- webaccess/scada An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via PostgreSQL executable, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege. 2021-02-17 7.2 CVE-2020-13551 MISC citsmart -- citsmart CITSmart before 9.1.2.23 allows LDAP Injection. 2021-02-15 7.5 CVE-2020-35775 MISC CONFIRM MISC MISC dlink -- dap-1860_firmware This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service, which listens on TCP port 80 by default. When parsing the Authorization request header, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10880. 2021-02-12 8.3 CVE-2020-27864 MISC MISC dlink -- dap-1860_firmware This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1860 firmware version 1.04B03 WiFi extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the uhttpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the device. Was ZDI-CAN-10894. 2021-02-12 8.3 CVE-2020-27865 MISC MISC elecom -- wrc-300febk-s_firmware ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. 2021-02-12 7.7 CVE-2021-20648 MISC MISC iptime -- c200_firmware The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability, an attacker can send a GET request that executes arbitrary OS commands via cookie value. 2021-02-17 7.7 CVE-2020-7848 MISC limesurvey -- limesurvey LimeSurvey before 4.0.0-RC4 allows SQL injection via the participant model. 2021-02-14 7.5 CVE-2019-25019 MISC MISC logitec -- lan-w300n/pgrb_firmware Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors. 2021-02-12 7.7 CVE-2021-20640 MISC MISC logitec -- lan-w300n/pgrb_firmware LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. 2021-02-12 7.7 CVE-2021-20639 MISC MISC logitec -- lan-w300n/pgrb_firmware LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. 2021-02-12 7.7 CVE-2021-20638 MISC MISC microfocus -- operations_bridge_manager Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2019.11, 2020.05, 2020.10. The vulnerability could allow remote attackers to execute arbitrary code on an OBM server. 2021-02-12 10 CVE-2021-22504 MISC nagios -- nagios_xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. 2021-02-15 9 CVE-2021-25298 MISC MISC MISC nagios -- nagios_xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. 2021-02-15 9 CVE-2021-25297 MISC MISC MISC nagios -- nagios_xi Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. 2021-02-15 9 CVE-2021-25296 MISC MISC MISC netgear -- ac2100_firmware This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 firmware version 1.2.0.62_1.0.1 routers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. When parsing the funjsq_access_token parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11653. 2021-02-12 7.7 CVE-2020-27867 MISC MISC netgear -- ac2100_firmware This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 firmware version 1.2.0.62_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service, which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-11355. 2021-02-12 8.3 CVE-2020-27866 MISC MISC netgear -- cbk40_firmware This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Orbi 2.5.1.16 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UA_Parser utility. A crafted Host Name option in a DHCP request can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-11076. 2021-02-12 8.3 CVE-2020-27861 MISC MISC pelco -- digital_sentry_server DSUtility.dll in Pelco Digital Sentry Server before 7.19.67 has an arbitrary file write vulnerability. The AppendToTextFile method doesn't check if it's being called from the application or from a malicious user. The vulnerability is triggered when a remote attacker crafts an HTML page (e.g., with "OBJECT classid=" and "") to overwrite arbitrary files. 2021-02-12 8.8 CVE-2021-27197 MISC MISC pystemon_project -- pystemon config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used. 2021-02-14 7.5 CVE-2021-27213 MISC MISC qognify -- ocularis This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of serialized objects provided to the EventCoordinator endpoint. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-11257. 2021-02-12 10 CVE-2020-27868 MISC MISC racom -- m!dge_cellular_router_firmware Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows for privilege escalation via configd. 2021-02-16 7.2 CVE-2021-20075 MISC sdg -- pnpscada PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 2021-02-16 7.5 CVE-2020-24841 MISC MISC solarwinds -- network_performance_monitor This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. Was ZDI-CAN-11804. 2021-02-12 9 CVE-2020-27869 MISC zscaler -- client_connector The Zscaler Client Connector prior to 3.1.0 did not sufficiently validate RPC clients, which allows a local adversary to execute code with system privileges or perform limited actions for which they did not have privileges. 2021-02-16 7.2 CVE-2020-11635 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info advantech -- webaccess/scada A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability. 2021-02-17 4 CVE-2020-13550 MISC apache -- thrift In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. 2021-02-12 5 CVE-2020-13949 MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST MLIST MLIST atlassian -- data_center Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field options via an Information Disclosure vulnerability in the /rest/api/2/customFieldOption/ endpoint. The affected versions are before version 8.15.0. 2021-02-15 5 CVE-2020-36237 MISC atlassian -- data_center Affected versions of Atlassian Jira Server and Data Center allow remote attackers to enumerate Jira projects via an Information Disclosure vulnerability in the Jira Projects plugin report page. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.14.1. 2021-02-15 4 CVE-2020-29451 MISC atlassian -- jira Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to view custom field and custom SLA names via an Information Disclosure vulnerability in the mobile site view. The affected versions are before version 8.13.2, and from version 8.14.0 before 8.14.1. 2021-02-15 5 CVE-2020-36235 MISC atlassian -- jira Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the ViewWorkflowSchemes.jspa and ListWorkflows.jspa endpoints. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. 2021-02-15 4.3 CVE-2020-36236 MISC changjia_property_management_system_project -- changjia_property_management_system The CGE property management system contains SQL Injection vulnerabilities. Remote attackers can inject SQL commands into the parameters in Cookie and obtain data in the database without privilege. 2021-02-17 5 CVE-2021-22856 CONFIRM MISC changjia_property_management_system_project -- changjia_property_management_system The CGE page with download function contains a Directory Traversal vulnerability. Attackers can use this loophole to download system files arbitrarily. 2021-02-17 5 CVE-2021-22857 CONFIRM MISC deepnetsecurity -- dualshield DualShield 5.9.8.0821 allows username enumeration on its login form. A valid username results in prompting for the password, whereas an invalid one will produce an "unknown username" error message. 2021-02-16 5 CVE-2020-28918 MISC MISC dlink -- dva-2800_firmware This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DVA-2800 and DSL-2888A firmware version 2.3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. When parsing the path parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-10911. 2021-02-12 5.8 CVE-2020-27862 MISC MISC elecom -- file_manager Directory traversal vulnerability in ELECOM File Manager all versions allows remote attackers to create an arbitrary file or overwrite an existing file in a directory which can be accessed with the application privileges via unspecified vectors. 2021-02-12 6.4 CVE-2021-20651 MISC MISC elecom -- ld-ps/u1_firmware Improper access control vulnerability in ELECOM LD-PS/U1 allows remote attackers to change the administrative password of the affected device by processing a specially crafted request. 2021-02-12 5 CVE-2021-20643 MISC MISC elecom -- ncc-ewf100rmwh2_firmware Cross-site request forgery (CSRF) vulnerability in ELECOM NCC-EWF100RMWH2 allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started. 2021-02-12 4.3 CVE-2021-20650 MISC MISC elecom -- wrc-1467ghbk-a_firmware ELECOM WRC-1467GHBK-A allows arbitrary scripts to be executed on the user's web browser by displaying a specially crafted SSID on the web setup page. 2021-02-12 4.3 CVE-2021-20644 MISC MISC elecom -- wrc-300febk-a_firmware Cross-site scripting vulnerability in ELECOM WRC-300FEBK-A allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2021-02-12 4.3 CVE-2021-20645 MISC MISC elecom -- wrc-300febk-a_firmware Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-A allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started. 2021-02-12 4.3 CVE-2021-20646 MISC MISC elecom -- wrc-300febk-s_firmware ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device. 2021-02-12 5.8 CVE-2021-20649 MISC MISC elecom -- wrc-300febk-s_firmware Cross-site request forgery (CSRF) vulnerability in ELECOM WRC-300FEBK-S allows remote attackers to hijack the authentication of administrators and execute an arbitrary request via unspecified vector. As a result, the device settings may be altered and/or telnet daemon may be started. 2021-02-12 4.3 CVE-2021-20647 MISC MISC f5 -- access_policy_manager_clients In Edge Client version 7.2.x before 7.2.1.1, 7.1.9.x before 7.1.9.8, and 7.1.x-7.1.8.x before 7.1.8.5, an untrusted search path vulnerability in the BIG-IP APM Client Troubleshooting Utility (CTU) for Windows could allow an attacker to load a malicious DLL library from its current directory. User interaction is required to exploit this vulnerability in that the victim must run this utility on the Windows system. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 6.9 CVE-2021-22980 MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.2.8, 13.1.x before 13.1.3.5, and all 12.1.x versions, a reflected Cross-Site Scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility when Fraud Protection Service is provisioned and allows an attacker to execute JavaScript in the context of the current logged-in user. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 4.3 CVE-2021-22979 MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, and 14.1.x before 14.1.3.1, under some circumstances, Traffic Management Microkernel (TMM) may restart on the BIG-IP system while passing large bursts of traffic. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 4.3 CVE-2021-22975 MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.6 and all versions of BIG-IQ 7.x and 6.x, an authenticated attacker with access to iControl REST over the control plane may be able to take advantage of a race condition to execute commands with an elevated privilege level. This vulnerability is due to an incomplete fix for CVE-2017-6167. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 6 CVE-2021-22974 MISC f5 -- big-ip_access_policy_manager On all versions of BIG-IP 12.1.x and 11.6.x, the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 5.8 CVE-2021-22981 MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.0-16.0.1 and 14.1.2.4-14.1.3, cooperation between malicious HTTP client code and a malicious server may cause TMM to restart and generate a core file. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 5 CVE-2021-22977 MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x versions, JSON parser function does not protect against out-of-bounds memory accesses or writes. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 5 CVE-2021-22973 MISC f5 -- big-ip_advanced_web_application_firewall On BIG-IP Advanced WAF and ASM version 16.0.x before 16.0.1.1, 15.1.x before 15.1.2, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.6, and all 12.1.x versions, when the BIG-IP ASM system processes WebSocket requests with JSON payloads, an unusually large number of parameters can cause excessive CPU usage in the BIG-IP ASM bd process. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 5 CVE-2021-22976 MISC f5 -- big-ip_advanced_web_application_firewall On BIG-IP Advanced WAF and ASM version 15.1.x before 15.1.0.2, 15.0.x before 15.0.1.4, 14.1.x before 14.1.2.5, 13.1.x before 13.1.3.4, 12.1.x before 12.1.5.2, and 11.6.x before 11.6.5.2, when receiving a unauthenticated client request with a maliciously crafted URI, a BIG-IP Advanced WAF or ASM virtual server configured with a DoS profile with Proactive Bot Defense (versions prior to 14.1.0), or a Bot Defense profile (versions 14.1.0 and later), may subject clients and web servers to Open Redirection attacks. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 5.8 CVE-2021-22984 MISC f5 -- big-ip_domain_name_system On BIG-IP DNS and GTM version 13.1.x before 13.1.0.4, and all versions of 12.1.x and 11.6.x, big3d does not securely handle and parse certain payloads resulting in a buffer overflow. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 6.5 CVE-2021-22982 MISC foxitsoftware -- foxit_reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.0.1.35811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA templates. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-11727. 2021-02-12 6.8 CVE-2020-27860 MISC MISC horde -- groupware An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of x00x00x00 and x01x01x01 interferes with XSS defenses. 2021-02-14 4.3 CVE-2021-26929 MISC MLIST CONFIRM MISC MISC ibm -- spectrum_protect_operations_center IBM Spectrum Protect Operations Center 7.1 and 8.1could allow a remote attacker to execute arbitrary code on the system, caused by improper parameter validation. By creating an unspecified servlet request with specially crafted input parameters, an attacker could exploit this vulnerability to load a malicious .dll with elevated privileges. IBM X-Force ID: 192155. 2021-02-15 5.2 CVE-2020-4955 XF CONFIRM ibm -- spectrum_protect_operations_center IBM Spectrum Protect Operations Center 7.1 and 8.1 could allow a remote attacker to bypass authentication restrictions, caused by improper session validation . By using the configuration panel to obtain a valid session using an attacker controlled IBM Spectrum Protect server, an attacker could exploit this vulnerability to bypass authentication and gain access to a limited number of debug functions, such as logging levels. IBM X-Force ID: 192153. 2021-02-15 4.8 CVE-2020-4954 XF CONFIRM logitec -- lan-w300n/pr5b_firmware Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted. 2021-02-12 4.3 CVE-2021-20636 MISC MISC logitec -- lan-w300n/pr5b_firmware Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL. 2021-02-12 4.3 CVE-2021-20637 MISC MISC logitec -- lan-w300n/rs_firmware Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted. 2021-02-12 4.3 CVE-2021-20641 MISC MISC logitec -- lan-w300n/rs_firmware Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL. 2021-02-12 4.3 CVE-2021-20642 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about other users and devices in the account. 2021-02-16 4 CVE-2020-35568 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php. 2021-02-16 5.8 CVE-2020-35560 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default. 2021-02-16 5 CVE-2020-35565 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code. 2021-02-16 5 CVE-2020-35564 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of an account and thus not allow creation of new devices and users. 2021-02-16 4 CVE-2020-35559 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ports and gain some information about possible credentials. 2021-02-16 5 CVE-2020-35558 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing. 2021-02-16 5 CVE-2020-35570 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page. 2021-02-16 4.3 CVE-2020-35569 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports. 2021-02-16 5 CVE-2020-35561 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances. 2021-02-16 4.6 CVE-2020-35567 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.2. Inproper use of access validation allows a logged in user to see devices in the account he should not have access to. 2021-02-16 4 CVE-2020-35557 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An attacker can read arbitrary JSON files via Local File Inclusion. 2021-02-16 5 CVE-2020-35566 MISC MISC nagios -- nagios_xi Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. 2021-02-15 4.3 CVE-2021-25299 MISC MISC MISC online_book_store_project -- online_book_store The id parameter in detail.php of Online Book Store v1.0 is vulnerable to union-based blind SQL injection, which leads to the ability to retrieve all databases. 2021-02-17 5 CVE-2020-36003 MISC MISC MISC open-emr -- openemr A SQL injection vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the schedule_facility parameter when restrict_user_facility=on is in global settings. 2021-02-15 6.5 CVE-2020-29142 MISC MISC MISC MISC MISC openzfs -- openzfs An issue was discovered in OpenZFS through 2.0.3. When an NFS share is exported to IPv6 addresses via the sharenfs feature, there is a silent failure to parse the IPv6 address data, and access is allowed to everyone. IPv6 restrictions from the configuration are not applied. 2021-02-12 5 CVE-2013-20001 MISC MISC php -- php In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash. 2021-02-15 5 CVE-2021-21702 CONFIRM DEBIAN php -- php In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL. 2021-02-15 5 CVE-2020-7071 CONFIRM DEBIAN seat-reservation-system_project -- seat-reservation-system Seat-Reservation-System 1.0 has a SQL injection vulnerability in index.php in the id and file parameters where attackers can obtain sensitive database information. 2021-02-17 5 CVE-2020-36002 MISC MISC MISC secomea -- sitemanager_embedded A vulnerability in SiteManager-Embedded (SM-E) Web server which may allow attacker to construct a URL that if visited by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application. This issue affects all versions and variants of SM-E prior to version 9.3 2021-02-16 4.3 CVE-2020-29025 MISC tp-link -- archer_c5v_firmware TP-Link Archer C5v 1.7_181221 devices allows remote attackers to retrieve cleartext credentials via [USER_CFG#0,0,0,0,0,0#0,0,0,0,0,0]0,0 to the /cgi?1&5 URI. 2021-02-13 4 CVE-2021-27210 MISC xn--b1agzlht -- fx_aggregator_terminal_client The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 allows attackers to cause a denial of service (access suspended for five hours) by making five invalid login attempts to a victim's account. 2021-02-12 5 CVE-2021-27188 MISC MISC xn--b1agzlht -- fx_aggregator_terminal_client The Sovremennye Delovye Tekhnologii FX Aggregator terminal client 1 stores authentication credentials in cleartext in login.sav when the Save Password box is checked. 2021-02-12 5 CVE-2021-27187 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info atlassian -- data_center Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in the Screens Modal view. The affected versions are before version 8.5.11, from version 8.6.0 before 8.13.3, and from version 8.14.0 before 8.15.0. 2021-02-15 3.5 CVE-2020-36234 N/A blackcat-cms -- blackcat_cms The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php. 2021-02-16 3.5 CVE-2021-27237 MISC MISC MISC dlink -- dva-2800_firmware This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A firmware version 2.3 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dhttpd service, which listens on TCP port 8008 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10912. 2021-02-12 3.3 CVE-2020-27863 MISC MISC f5 -- big-ip_access_policy_manager On BIG-IP version 16.0.x before 16.0.1, 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all 12.1.x and 11.6.x versions, undisclosed endpoints in iControl REST allow for a reflected XSS attack, which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 2.6 CVE-2021-22978 MISC f5 -- big-ip_advanced_firewall_manager On BIG-IP AFM version 15.1.x before 15.1.1, 14.1.x before 14.1.3.1, and 13.1.x before 13.1.3.5, authenticated users accessing the Configuration utility for AFM are vulnerable to a cross-site scripting attack if they attempt to access a maliciously-crafted URL. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated. 2021-02-12 3.5 CVE-2021-22983 MISC ibm -- maximo_for_civil_infrastructure IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196622. 2021-02-18 3.5 CVE-2021-20446 XF CONFIRM ibm -- spectrum_protect_operations_center IBM Spectrum Protect Operations Center 7.1 and 8.1 is vulnerable to a denial of service, caused by a RPC that allows certain cache values to be set and dumped to a file. By setting a grossly large cache value and dumping that cached value to a file multiple times, a remote attacker could exploit this vulnerability to cause the consumption of all memory resources. IBM X-Force ID: 192156. 2021-02-15 2.3 CVE-2020-4956 XF CONFIRM logitec -- lan-wh450n/gr_firmware Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network. 2021-02-12 3.3 CVE-2021-20635 MISC MISC mbconnectline -- mbconnect24 An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page. 2021-02-16 3.5 CVE-2020-35563 MISC MISC nfstream -- nfstream An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS). 2021-02-16 2.1 CVE-2020-25340 MISC peel -- peel_shopping A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 which is publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc. 2021-02-12 3.5 CVE-2021-27190 MISC MISC MISC racom -- m!dge_cellular_router_firmware Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the sms.php dialogs. 2021-02-16 3.5 CVE-2021-20071 MISC racom -- m!dge_cellular_router_firmware Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scriptings attacks via the virtualization.php dialogs. 2021-02-16 3.5 CVE-2021-20070 MISC racom -- m!dge_cellular_router_firmware Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the regionalSettings.php dialogs. 2021-02-16 3.5 CVE-2021-20069 MISC racom -- m!dge_cellular_router_firmware Racom's MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to conduct cross-site scripting attacks via the error handling functionality of web pages. 2021-02-16 3.5 CVE-2021-20068 MISC secomea -- sitemanager_1129_firmware Cross-site Scripting (XSS) vulnerability in GUI of Secomea SiteManager could allow an attacker to cause an XSS Attack. This issue affects: Secomea SiteManager all versions prior to 9.3. 2021-02-16 3.5 CVE-2020-29027 MISC tp-link -- archer_c5v_firmware In the management interface on TP-Link Archer C5v 1.7_181221 devices, credentials are sent in a base64 format over cleartext HTTP. 2021-02-13 3.6 CVE-2021-27209 MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 74cms -- 74cms   In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server. 2021-02-17 not yet calculated CVE-2020-35339 MISC MISC activepresenter -- activepresenter   ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution. 2021-02-15 not yet calculated CVE-2021-3375 MISC agora -- video_sdk   Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic. 2021-02-17 not yet calculated CVE-2020-25605 MISC MISC alfresco_enterprise -- content_management   An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco. 2021-02-19 not yet calculated CVE-2020-12873 MISC MISC amaze -- file_manager   Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. 2021-02-19 not yet calculated CVE-2020-36246 MISC MISC apache -- airflow   The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0. 2021-02-17 not yet calculated CVE-2021-26697 MLIST MLIST MISC MLIST MLIST apache -- airflow   Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0. 2021-02-17 not yet calculated CVE-2021-26559 MLIST MISC MLIST apache -- myfaces   In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application. 2021-02-19 not yet calculated CVE-2021-26296 FULLDISC MISC askey -- multiple_devices   Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. 2021-02-19 not yet calculated CVE-2021-27403 MISC askey -- multiple_devices   Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header. 2021-02-19 not yet calculated CVE-2021-27404 MISC async-git -- async-git   The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb') 2021-02-18 not yet calculated CVE-2020-28490 MISC MISC MISC atlassian -- bitbucket_server_and_data_center   The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. 2021-02-18 not yet calculated CVE-2020-36233 MISC CERT-VN baby_care_system -- baby_care_system   Baby Care System v1.0 is vulnerable to SQL injection via the 'id' parameter on the contentsectionpage.php page. 2021-02-17 not yet calculated CVE-2021-25779 MISC baby_care_system -- baby_care_system   An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell. 2021-02-17 not yet calculated CVE-2021-25780 MISC batflat -- batlfat   ** UNSUPPORTED WHEN ASSIGNED ** Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2021-02-15 not yet calculated CVE-2020-35734 MISC MISC MISC MISC bind -- multiple_products   BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 - > 9.11.27, 9.12.0 - > 9.16.11, and versions BIND 9.11.3-S1 - > 9.11.27-S1 and 9.16.8-S1 - > 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 - > 9.17.1 of the BIND 9.17 development branch 2021-02-17 not yet calculated CVE-2020-8625 MLIST MLIST CONFIRM MLIST DEBIAN bloodhound -- bloodhound   components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound odyssey - > dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF 2021-02-18 not yet calculated CVE-2020-28463 CONFIRM CONFIRM rust -- rust An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free. 2021-02-18 not yet calculated CVE-2021-27377 MISC rust -- rust   An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures. 2021-02-18 not yet calculated CVE-2021-27376 MISC rust -- rust   An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data. 2021-02-18 not yet calculated CVE-2021-27378 MISC sangoma -- asterisk An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash. 2021-02-18 not yet calculated CVE-2021-26717 MISC FULLDISC MISC CONFIRM CONFIRM sangoma -- asterisk   A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch. 2021-02-19 not yet calculated CVE-2021-26713 MISC MISC MISC sangoma -- asterisk   A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses. 2021-02-18 not yet calculated CVE-2020-35776 MISC FULLDISC CONFIRM MISC CONFIRM sangoma -- asterisk   Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets. 2021-02-18 not yet calculated CVE-2021-26712 MISC FULLDISC MISC CONFIRM CONFIRM secomea -- gatemanager An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c 2021-02-15 not yet calculated CVE-2020-29031 MISC secomea -- gatemanager   A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c. 2021-02-15 not yet calculated CVE-2020-29026 MISC secomea -- gatemanager   Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3. 2021-02-16 not yet calculated CVE-2020-29024 MISC secomea -- gatemanager   Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim's computer when opened in a spreadsheet program (like Excel). This issue affects: Secomea GateManager all versions prior to 9.3. 2021-02-16 not yet calculated CVE-2020-29023 MISC CONFIRM secomea -- gatemanager   Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3 2021-02-16 not yet calculated CVE-2020-29022 MISC smartstorenet -- smartstorenet   An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to create an admin account). 2021-02-19 not yet calculated CVE-2020-27997 MISC MISC soar -- cloud_system The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands. 2021-02-17 not yet calculated CVE-2021-22855 CONFIRM MISC soar -- cloud_system   The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work. 2021-02-17 not yet calculated CVE-2021-22853 CONFIRM MISC soar -- cloud_system   The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege. 2021-02-17 not yet calculated CVE-2021-22854 CONFIRM MISC steghide -- steghide   steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. 2021-02-15 not yet calculated CVE-2021-27211 MISC MISC MISC sytech -- xl_reporter   An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory. Depending on the vector chosen, an attacker can overwrite service executables and execute arbitrary code with privileges of user set to run the service or replace other files within the installation folder, which would allow for local privilege escalation. 2021-02-19 not yet calculated CVE-2020-13549 MISC teachers_record_management_system -- teachers_record_management_system   Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in 'searchteacher' POST parameter in search-teacher.php. This vulnerability can be exploited by a remote unauthenticated attacker to leak sensitive information and perform code execution attacks. 2021-02-15 not yet calculated CVE-2021-26822 MISC MISC telsa -- solarcity_solar_monitoring_gateway   Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a "Use of Hard-coded Credentials" issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. 2021-02-18 not yet calculated CVE-2020-9306 CONFIRM MISC MISC MISC testes_de_codigo -- testes_de_codigo   Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters "isAdmin" and "isPremium" located on device storage. 2021-02-16 not yet calculated CVE-2021-25648 MISC three -- three   This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms") 2021-02-18 not yet calculated CVE-2020-28496 MISC MISC MISC MISC traefik -- traefik   Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. 2021-02-18 not yet calculated CVE-2021-27375 MISC CONFIRM uap-core -- uap-core   uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes. 2021-02-16 not yet calculated CVE-2021-21317 MISC CONFIRM MISC uprism -- uprism   A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient input(server domain) validation. An attacker could exploit this vulnerability through crafted URL. 2021-02-17 not yet calculated CVE-2020-7849 MISC vertigis -- weboffice   VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve "Zugriff auf Inhalte der WebOffice Applikation." 2021-02-17 not yet calculated CVE-2021-27374 MISC MISC visualware -- myconnection_server   In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. 2021-02-19 not yet calculated CVE-2021-27509 MISC voloko-- twitter-stream   In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused). 2021-02-19 not yet calculated CVE-2020-24392 MISC MISC voloko-- twitter-stream   TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack. 2021-02-19 not yet calculated CVE-2020-24393 MISC MISC webware -- webdesktop   SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. 2021-02-19 not yet calculated CVE-2021-3204 MISC wireshark -- wireshark   Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file 2021-02-17 not yet calculated CVE-2021-22174 CONFIRM MISC MISC wireshark -- wireshark   Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file 2021-02-17 not yet calculated CVE-2021-22173 CONFIRM MISC MISC xen -- xen   An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565. 2021-02-18 not yet calculated CVE-2021-27379 MISC yeastar -- neogate_devices Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key. 2021-02-19 not yet calculated CVE-2021-27328 MISC MISC zoho -- manageengine_adselfservice_plus   A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905. 2021-02-19 not yet calculated CVE-2021-27214 MISC MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Get to Know Your Mac’s Dock
The Dock is one of the key elements you use to interact with your Mac. Here's how to use the Dock and turn it into a high-powered productivity booster. The post appeared first on The Mac Security Blog.

Read more »

Mexican Politician Removed Over Alleged Ties to Romanian ATM...
The leader of Mexico's Green Party has been removed from office following allegations that he received money from a Romanian ATM skimmer gang that stole hundreds of millions of dollars from tourists visiting Mexico's top tourist destinations over the past five years. The scandal is the latest fallout stemming from a three-part investigation into the organized crime group by KrebsOnSecurity in 2015.

Read more »

How to Use Content Caching on macOS to Save Bandwidth
Content caching lets you use one Mac to store copies of installers, updaters, apps, and more that you download from Apple's servers. The post appeared first on The Mac Security Blog.

Read more »

A New Amazon Phishing Scam, Malvertizing, and Apple Activati...
A new Amazon phishing scam doesn't include links to click, but rather a telephone number to call: beware! Malvertizing takes advantage of a zero-day WebKit vulnerability to display deceptive ads, and serve malware. And Apple has set up a website for people to request the removal of activation lock on devices they own. The post A New Amazon Phishing Scam, Malvertizing, and Apple Activation Lock Removal – Intego Mac Podcast Episode 175 appeared first on The Mac Security Blog.

Read more »

U.S. Indicts North Korean Hackers in Theft of $200 Million
The U.S. Justice Department today unsealed indictments against three men accused of working with the North Korean regime to carry out some of the most damaging cybercrime attacks over the past decade, including the 2014 hack of Sony Pictures, the global WannaCry ransomware contagion of 2017, and the theft of roughly $200 million and attempted theft of more than $1.2 billion from banks and other victims worldwide.

Read more »

Roundup of latest Apple Education discounts on MacBook Pros ...
Apple’s Education discount yields savings of $100-$200 off standard MSRP when you purchase a new 13″ or 16″ MacBook Pro or a new 13″ MacBook Air. Students, teachers, and staff members at any educational institution with a .edu email address qualify for the discount. Education discounts are available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards as well Here are the latest MacBook Education discounts available at Apple: – 13″ M1 MacBook Air/512GB: $1149 $100 off – 13″ M1 MacBook Air/256GB: $899 $100 off – 13″ M1 MacBook Pro/512GB: $1399 $100 off – 13″ M1 MacBook Pro/256GB: $1199 $100 off – 16″ 2.3GHz 8-Core Touch Bar MacBook Pro: $2599 $200 off – 16″ 2.6GHz 6-Core Touch Bar MacBook Pro: $2199 $200 off – 13″ 2.0GHz/1TB 4-Core Intel MacBook Pro: $1899 $100 off – 13″ 2.0GHz/512GB 4-Core Intel MacBook Pro: $1699 $100 off Most models and configurations are in stock today with free shipping. Not in the US? Click for the Canada or the

Read more »

The Rise & Fall Of Computer SuperStores And How The Appl...
FEATURE: 02.27.21 – A popular chain of big box electronics stores on the West Coast which catered to technophiles, nerds, and computer geeks (and Apple fanboys alike) has shut down for good. After nearly 40 years in the business as a purveyor of all things related to technology, Fry’s Electronics — which officially (and, rather quietly) announced its abrupt closure via its website earlier this week — has sold its last Apple product in its stores (assuming they were even in stock). The closures of all 30 of the retailer’s remaining store locations means that there now is one less Apple Authorized Reseller in the retail landscape where consumers looking to purchase a desktop or laptop made by the Cupertino, California-based company can simply walk in to a brick and mortar establishment to buy (or, test drive before buying) a Mac. The logo of a Fry’s Electronics glows a bright red above the entrance to the store in Fremont, California as photographed by the author of this column during a visit to the location on the evening of January 24, 2011. (Photo: Joe Leo) However, while Apple customers today have their own go-to destination where they can easily, “Get a Mac” (to quote the marketing campaign used by the Cupertino, California-based company from 2006 to 2010)? Although Apple’s brick and mortar establishments have become a major player in the retail landscape — and, a cultural phenomenon as well — before there ever was an Apple Store location on the West Coast? Other than going to a CompUSA (Best Buy and Circuit City didn’t officially sell Macs until December 2006), Fry’s Electronics was where people went. **AD: Fry’s Electronics always told its customers, “Your Best Buy’s are always at Fry’s… guaranteed!” but now that they’ve gone out of business, where is one to go? Fear not and check out MacPrices to consult its exclusive and award winning Apple products price trackers where you’ll always → Read More...

Read more »

Roundup of Apple Canada’s current sales and deals on M1 Ma...
Apple Canada has new M1 MacBook Pros, MacBook Airs, and Mac minis available right now at prices ranging up to $290 (CAN) off MSRP for Education customers or if purchased Certified Refurbished. The following discount are available today for Canadian customers. All prices are in Canadian dollars: – 13″ M1 MacBook Pro/256GB SSD: Apple Canada MSRP: $1699 Education price: $1569 $130 off Certified Refurbished: $1439 $260 off – 13″ M1 MacBook Pro/512GB SSD: Apple Canada MSRP: $1949 Education price: $1819 $130 off Certified Refurbished: $1659 $290 off – 13″ M1 MacBook Air/8-Core CPU/7-Core GPU/256GB SSD: Apple Canada MSRP: $1299 Education price: $1169 $130 off Certified Refurbished: $1099 $200 off – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB SSD: Apple Canada MSRP: $1649 Education price: $1519 $130 off Certified Refurbished: $1369 $280 off – 13″ M1 Mac mini/256GB SSD: Apple Canada MSRP: $899 Education price: $869 $130 off Certified Refurbished: $759 $140 off – 13″ M1 Mac mini/512GB SSD: Apple Canada MSRP: $1149 Education price: $1119 $130 off Certified Refurbished: $979 $170 off For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, MacBook Air Price Tracker, and Mac mini Price Tracker, all → Read More...

Read more »

Apple now offering standard configuration M1 Mac minis start...
Apple has a full line of standard configuration M1 Mac minis available in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Note that stock of these models will likely come and go, so be sure to check Apple’s site for the latest stock status. The $589 model is the cheapest M1 Mac currently for sale anywhere. In addition to these standard-configuration models, Apple also released a series of custom-configured M1 Mac minis with more RAM and storage, Certified Refurbished, for up to $260 off MSRP. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

New at Apple: Custom M1 Mac minis for up to $260 off MSRP, C...
Apple is now offering several custom configurations of the new M1 Mac minis with up to 16GB of RAM (8GB is standard), and optional 512GB, 1TB, and 2TB SSDs, for up to $260 off MSRP, Certified Refurbished. Each mini comes with Apple’s standard one-year warranty: – Mac mini M1 16GB/256GB: $759 $140 off MSRP – Mac mini M1 16GB/512GB: $929 $170 off MSRP – Mac mini M1 8GB/1TB: $929 $170 off MSRP – Mac mini M1 16GB/1TB: → Read More...

Read more »

Clearance 2020 4-Core Mac mini now on sale for only $539, sa...
Other World Computing has clearance 2020 Intel-based 4-Core Mac minis on sale for $260 off Apple’s original MSRP, only $539. These are new, unopened, factory-sealed models: – 3.6GHz 4-core Mac mini: $539 $260 off original MSRP Their price is the lowest we’ve seen for a new Mac from any reseller. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

B&H has 27″ 5K Apple iMacs on sale for $120-$150 off M...
B&H Photo has Apple 27″ 5K 6 and 8-Core iMacs on sale today for up to $150 off MSRP with prices starting at $1679. Shipping is free. These are the same iMacs sold by Apple in their retail and online stores. B&H’s prices are among the lowest available for these models from any Apple reseller: – 27″ 3.1GHz 6-core iMac: $1679 $120 off MSRP – 27″ 3.3GHz 6-core iMac: $1849 $150 off MSRP – 27″ 3.8GHz 8-core iMac: $2169 $130 off MSRP For the latest prices and sales, see our iMac Price Tracker, → Read More...

Read more »

New Spring iPhone sales at Xfinity Mobile: $200 off any iPho...
New customers at Xfinity Mobile can get the 64GB Apple iPhone SE for free as part of their spring sales event, or take $200 off any other Apple device. Service plan required. The fine print for those wishing to get a new iPhone for $200 off: “Available to new customers and new line activations when you purchase an eligible iPhone and transfer your number within 30 days. Credits applied over 24 months of the device payment plan. Offer ends 4/5.” For the free iPhone SE, these are their terms: “Available to new customers and new line activations when you purchase an iPhone SE 64GB and transfer your number within 30 days. Credits applied over 24 months of the device payment plan. Offer ends 3/3.” These deals are live today at Xfinity Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

Apple offers 64GB iPhone 8 for $339, Certified Refurbished
Apple has the 64GB iPhone 8 in Space Gray available for $339, Certified Refurbished. Each phone is unlocked and comes with Apple’s standard 1-year warranty and free shipping. All manuals and cables are included, and each phone comes with a new outer shell and a → Read More...

Read more »

Apple’s Lead In Global Sales Of Smartphones Attributed To ...
NEWS: 02.24.21 – The galaxy has a new leader in the smartphone market but consumers might have not necessarily taken note. Apple, Inc. has surpassed its rival, Samsung Electronics, as the top vendor of smartphones globally with sales of its latest iPhone model: the iPhone 12. With the media’s coverage of the Cupertino, California-based company as of late centered on developments surrounding the “Apple Car” — primarily with regard to another Seoul, South Korea-based company’s deal to manufacture an Apple-branded autonomous electric vehicle (EV) — the news of Apple’s latest record breaking achievement may have been, to use an automobile related cliché, thrown under the bus (figuratively speaking). An employee at Apple’s distribution center in Carlisle, Pennsylvania prepares a shipment of the iPhone 12 which will be shipped to stores and customers across the East Coast and Canada. (Photo: Apple, Inc.) The website, Cult of Mac, reported earlier this week that this is the first time Apple has achieved this particular milestone since Q4 2016. No. 1: Smartphone Vendor According to market research firm, Gardner — as cited in the report by Cult of Mac — the success of last year’s iPhone models made Apple, once again, the world’s top smartphone vendor (in terms of sales figures, not units sold) for Q4 2020 and going into Q1 2021. Gardner noted that Apple sold 79.9 million iPhones versus Samsung which sold 62.1 million of its smartphones. Cult of Mac (doing its own calculations) reported that in Q4 2020, the Cupertino, California-based company carved out 20.8% of the global smartphone market while in comparison, the Seoul, South Korea-based company managed only 16.2%. However? Overall, Samsung outsold Apple in 2020, selling a total of 253 million of its smartphones compared to the estimated 199.8 million iPhones that were sold. Cult of Mac reported that Samsung’s global market share last year was, as a result, actually larger at 18.8% in comparison to Apple’s 14.8%. Additionally, Gardner noted that among the top → Read More...

Read more »

Apple offers several custom-configured 13″ M1 MacBook Airs...
Apple is now offering standard-configuration 13″ M1 MacBook Airs with 8-Core CPUs and 7-Core or 8-Core GPUs for $150-$190 off MSRP. Apple offers custom-configurations with 16GB of RAM plus optional 512GB, 1TB, and 2TB SSD upgrades on their online store. For the first time, Apple is offering Certified Refurbished 13″ M1 MacBook Airs featuring several of these custom options ranging up to $250 off the cost of new models. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 8-Core CPU/7-Core GPU/16GB RAM/256GB SSD/Gray: $1019 $190 off MSRP – 13″ M1 8-Core CPU/8-Core GPU/16GB RAM/512GB SSD/Gray: $1229 $220 off MSRP – 13″ M1 8-Core CPU/8-Core GPU/16GB RAM/512GB SSD/Gold: $1229 $220 off MSRP – 13″ M1 8-Core CPU/8-Core GPU/16GB RAM/1TB SSD/Gray: $1399 $250 off MSRP – 13″ M1 8-Core CPU/8-Core GPU/16GB RAM/1TB SSD/Gold: $1399 $250 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Air → Read More...

Read more »

Deal Alert! Apple now selling 13″ M1 MacBook Airs for as l...
Apple is now selling 2020 13″ M1 MacBook Airs, Certified Refurbished, starting at only $849 and up to $190 off original MSRP. These are the cheapest M1 MacBook Airs for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Space Gray: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Silver: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Gold: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Space Gray: not yet available – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Silver: $1059 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Gold: not yet available Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Air → Read More...

Read more »