Everything Apple announced at its ‘Unleashed’ event: New MacBook Pro, AirPods 3, more
Apple today officially announced its first major redesign for the MacBook Pro in over five years. During its “Unleashed” virtual event, Apple announced new 14-inch and 16-inch MacBook Pro models, new AirPods 3, and more. Head below as we round up all of today’s announcements… more… The post appeared first on 9to5Mac.

Read more »

Opinion: I wasn’t planning to buy a MacBook Pro, but today’s event exceeded my wildest expectations
We had known that Apple was working on an all-new MacBook Pro based on Apple Silicon for quite a long time. I hadn’t been particularly interested in the rumored machine because of the tremendously good M1 Macs that the company has been spinning out for about a year now. The new iMac is an incredible machine that’s matched by a gorgeous design. Even the first M1 machines introduced last November are still very good and very fast computers. So I had no intention of buying a MacBook Pro today. more… The post appeared first on 9to5Mac.

Read more »

9to5Mac Daily: October 18, 2021 – Apple ‘Unleashed’ event recap
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Incipio: Protect your iPhone 13 w/ Incipio’s new MagSafe collection. Available at Incipio and Verizon.com more… The post appeared first on 9to5Mac.

Read more »

Apple hints at Apple Music app for gaming consoles
More evidence of an impending Apple Music debut on Playstation, Xbox and other consoles surfaced on Monday when Apple updated promotional materials to reference compatibility with gaming hardware.As noted by The Verge's Tom Warren in a tweet, Apple recently updated its website with new information regarding Apple Music availability, saying the service can be accessed "on many popular streaming devices, smart TVs, and gaming consoles if they support the Apple Music app." Apple has in the past touted compatibility with Windows and Android devices, Sonos speakers, Amazon Echo, Google Nest and smart TVs, but the gaming console reference is a new addition.Last week, PlayStation 5 users began to report the appearance of an Apple Music option when setting up music streaming on their console. A dialog box inviting users to download the Apple Music app has been spotted by multiple people, but selecting the option results in an error message. Reports are sporadic and AppleInsider was unable to trigger the option, suggesting the feature is currently in development. Read more...

Read more »

iPhone 13 Giveaway: Enter to win Apple's new smartphone, plus Speck MagSafe cases
In celebration of the October Apple Event, AppleInsider is partnering with Speck to offer readers the chance to win an iPhone 13 and three MagSafe-compatible protective cases.iPhone 13 giveawayAppleInsider readers this week can enter for a chance to win a 128GB iPhone 13 in the gorgeous new Starlight color. Valued at $799, this device scored a solid 4.5 out of 5 in our hands-on review. Read more...

Read more »

macOS Monterey Is Finally Rolling Out On October 25th
Along with new MacBook Pro models, Apple announced during its Mac event today that macOS Monterey will be available on Monday, Oct. 25. Gizmodo reports: As with macOS Big Sur before it, Monterey represents a renewed effort by Apple to streamline its operating systems, with new Focus profiles for limiting notifications and helping you be more productive just like in iOS 15 and iPadOS 15. Shortcuts, Apple's automation app, is now available on desktop for the first time. Monterey also represents the first time users will be able to AirPlay content from a Mac, a function that iPhone users have long enjoyed. If you've already downloaded iOS 15, updating to Monterey just makes sense -- these devices are so much more functional when they work seamlessly with each other. But perhaps the most anticipated feature Monterey is supposed to bring us is Universal Control, which allows you to use a single mouse/trackpad and keyboard to control multiple Macs and iPads simultaneously. While the new feature wasn't initially included in the public beta rollout of Monterey, that omission has only allowed the hype to grow. It's unclear when Universal Control will come to macOS, only that it won't be available to use at launch. FaceTime's new SharePlay feature, which is also expected to arrive in iOS 15, will also not be ready to try at launch. That feature will allow you to share music or watch shows with folks over FaceTime. The devices that support macOS Monterey include: iMac (late 2015 and newer), iMac Pro (2017 and newer), Mac Pro (late 2013 and newer), Mac Mini (late 2014 and newer), MacBook Pro (early 2015 and newer), MacBook Air (early 2015 and newer), and MacBook (early 2016 and newer). Further reading: macOS Monterey Release Candidate Undoes Safari Changes, Reintroduces Old Tab Design Read more of this story at Slashdot.

Read more »

New 14-inch and 16-inch MacBook Pros Powered by M1 Pro and M1 Max Chips
Apple has redesigned the MacBook Pro, with 14-inch and 16-inch models powered by new M1 Pro and M1 Max chips, along with impressive new screens, improved battery life, and a welcome return to the era of ports, MagSafe charging, and F-keys. The only downsides? Weight and a camera notch that cuts the menu bar in half.

Read more »

Developers can choose to take advantage of the notch area on new MacBook Pro
Apple today unveiled the new 14-inch and 16-inch MacBook Pro. In addition to all the new features, the new MacBooks have a notch at the top of the screen that houses the 1080p front-facing camera. Now developers can choose whether they want to take advantage of the notch area on these new Macs, or whether the app should run with a black bar on top. more… The post appeared first on 9to5Mac.

Read more »

Apple Unveils Third-Generation AirPods, Tweaks HomePod mini and Apple Music
Apple used its “Unleashed” event partly to focus on music. It revealed third-generation AirPods with a host of improvements, unveiled new colors for its HomePod mini speaker, and announced a new Apple Music Voice Plan for access to the music service solely via Siri voice commands.

Read more »

Apple’s $19 Polishing Cloth will keep your screens clean and classy
Apple unveiled a bunch of new products at its “Unleashed” event, including new MacBook Pros, third-gen AirPods, and new HomePod mini colors, but there was one that didn’t make the keynote. Apple is now selling a Polishing Cloth for you screens that costs as much as a 20W USB-C power adapter. The cloth, which is made […]

Read more »

Some MacBook Pro wait times stretch nearly to Christmas
You might find yourself waiting months to get the just-announced MacBook Pro. Order one of the standard configurations and it’ll arrive in this month or November at the latest. But upgrade the configuration and the wait time slips back to mid-December. Anyone hoping to get a redesigned 14-inch or 16-inch MacBook Pro with the powerful […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple dumps anemic, inefficient Intel chips in massive MacBook Pro redesign
Apple today freed more Mac models from their Intel shackles, announcing significantly more powerful homegrown Apple Silicon… The post appeared first on MacDailyNews.

Read more »

Beats Fit Pro featuring Apple H1 chip to reportedly arrive in November
While not announced during Monday's "Unleashed" event, Apple is reportedly preparing to unveil a new set of Beats earbuds powered by the company's H1 chip.Dubbed Beats Fit Pro, the forthcoming device features a design similar to the recently released Beats Studio Buds wireless in-ear headphones, reports 9to5Mac.Geared toward users with active lifestyles, Beats Fit Pro boasts an extended ear tip for better stabilization during workouts and includes Apple's H1 chip for quick pairing and Siri control. Active Noise Cancellation and Adaptive EQ are also supported, with the device achieving 6 hours and 7 hours of run time in each mode, respectively, according to the report. Read more...

Read more »

Apple's 3rd-Generation AirPods Arrives Next Week With a New Design, Spatial Audio
At its Fall Mac event today, Apple announced the new third-generation AirPods, featuring a slightly revamped design with shorter stems and touch-based "force sensor" and support for spatial audio. Ars Technica reports: The new AirPods retain their usual hard plastic finish and do not have in-ear tips like the AirPods Pro, though Apple says they are now officially IPX4-rated for sweat and water resistance. Apple says the earbuds have six hours of battery life and up to 30 hours when including the charging case. (That's compared to five and 24 hours, respectively, on the second-gen model.) The included case supports MagSafe and wireless charging, though the earbuds do not feature active noise cancellation or a transparency mode like their pricier siblings. Though the second-gen AirPods were renowned more for their ease of use than their audio quality, Apple says it has updated them with a redesigned driver and an adaptive EQ feature that automatically tunes your music based on the AirPods' fit in your ear. The earbuds will also use Apple's spatial audio tech, which makes audio sound like it is coming from around the user's head. To help with that, the new AirPods support dynamic head tracking like the AirPods Pro and the over-ear AirPods Max. The third-gen AirPods cost $179 and are available to order online today, with in-store availability starting October 26. Notably, Apple will continue to sell the existing second-gen AirPods for $129 alongside the new pair. Read more of this story at Slashdot.

Read more »

How to Make (Almost) Any Case MagSafe Compatible
If you have been wanting to make the plunge to MagSafe, but you’ve been holding off because you didn't want to replace your iPhone case, here's something to know. There's nothing incredibly magical about MagSafe technology. In fact, you can turn almost any iPhone case into one that’s MagSafe-compatible easily and inexpensively. All It Takes Is a Metallic Ring The metallic ring you see on MagSafe cases isn't really anything special. It usually isn't magnetic in and of itself. All it does is provide additional material with magnetic properties to guide your MagSafe charger or power bank into place. So, if you could attach your own metallic ring to your case, wouldn't that make it a MagSafe-compatible one? In most cases, the answer is yes. Turning Your Existing iPhone Case Into a MagSafe Case If you search on Amazon for “MagSafe case converter,” you’ll find quite a few options. Even popular battery pack maker mophie offers a ring to add to your non-MagSafe smartphone to give it the magnetic grip. For your non-MagSafe iPhone case, though, there are plenty of choices. The best of these metallic rings feature 3M adhesive tape on one side, allowing a strong attachment to your case. Some come with an attachment template for placing your sticker. Others just advise you to place the metallic side on your MagSafe charger, remove the cover from the adhesive, and allow the MagSafe charger to do the placement for you. A couple of the ones I found are magnetic, making compatibility even better. For most purposes, if your case is thin enough, you probably don’t need that. The metallic coating on the rings offers enough conductivity to make MagSafe work. Which Cases Should These Rings Work With? Generally speaking, you’ll want your case to be less than 4mm thick for this conversion to work best. It’s also important that the 3M adhesive be able to stick to your case. So, most of the manufacturers say to use the rings with thermoplastic polyurethane (TPU) or polycarbonate (PC) cases. It’s also important to note that any sort of fingerprint-resistant coating will prevent the adhesive from sticking. So, while you can’t turn absolutely any iPhone case into a MagSafe-compatible one, most should convert to the magnetic charging technology just fine.

Read more »

Apple’s all-new M1 Pro/Max MacBook Pros see up to $295 off pre-order discounts
Today, Apple officially announced the latest iterations of MacBook Pros equipped with the all-new M1 Pro and M1 Max chips and now pre-order discounts are already live. With up to $295 off a series of different configurations on Apple’s latest machines, you can head below for all of the details. more… The post appeared first on 9to5Mac.

Read more »

Apple brings back standard Safari tab design in macOS release candidate
Apple's latest macOS Monterey beta reverts Safari's controversial "compact" tabs design tweak to a more traditional layout seen in existing macOS versions.Issued to developers on Monday, macOS Monterey's release candidate includes yet another Safari redesign that walks back user interface changes involving the web browser's tab design.Initial versions of the next-generation Safari 15 included with early macOS Monterey beta releases featured relocated tabs, navigation controls and bookmarks bar. Apple put an emphasis on space savings in its early releases, ditching the traditional format for a design that delineated tabs as individual buttons separated by small spaces. Read more...

Read more »

With no new Apple monitors, here are the best high-res screens for your Mac
Get monitors with the resolution, display capabilities, and/or ports to compete with the displays Apple didn't announce today.

Read more »

Compared: 2021 New 16-inch MacBook Pro versus 2019 16-inch MacBook Pro
Apple has continued its Apple Silicon march with the introduction of the new 16-inch MacBook Pro running the M1 Pro and M1 Max processors. Here's how it compares to the Intel-based model it replaces.The new 16-inch MacBook Pro should appeal to content creators. During Apple's "Unleashed" event on October 18, the company added another Apple Silicon model to its roster, continuing from the 13-inch MacBook Pro to the MacBook Air, Mac mini, and 24-inch iMac. The new 16-inch MacBook Pro furthers Apple's aim to shift away from Intel in favor of its own chip design as part of its two-year transition schedule, effectively finishing off the MacBook lineup's switch-over. Read more...

Read more »

Here are the only Intel Macs left in Apple’s lineup following today’s ‘Unleashed’ event
After today’s “Unleashed” event, Apple added even more M1 Macs to its lineup as it continues its two-year transition to Apple Silicon. Despite today’s expansion, there are a few Macs that still run Intel chips being sold by Apple. Here they are. more… The post appeared first on 9to5Mac.

Read more »

New MacBook Pro tidbits: size and weight, benchmarks, HDMI 2.0 limitations, more
The new 14-inch and 16-inch MacBook Pros are officially here. They pack an all-new design, higher-resolution displays, more ports, and the latest and greatest Apple Silicon on the inside. Head below as we round up some smaller tidbits about the new MacBook Pro lineup… more… The post appeared first on 9to5Mac.

Read more »

Apple walks back many contentious Safari for Mac changes
Apple threw in the towel on its efforts to change the way Mac users interact with the Safari web browser. Most of the design modifications unveiled at WWDC to emphasize tabs are now completely optional as a result of protests from beta testers. The latest revisions appear in the release candidates for macOS Monterey, which […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Compared: Apple Music Voice Plan versus Individual Plan versus Family Plan
With the introduction of the Voice Plan, there are now three different Apple Music subscription tiers. Here are the differences between them.Credit: AppleApple on Monday unveiled a new Apple Music Voice Plan for $4.99 a month. The cheaper subscription tier offers access to the full Apple Music catalog to anyone — with the one caveat being that the catalog can only be accessed via Siri voice commands Read more...

Read more »

This massive 24,000mAh power bank can charge all your Apple devices
One of the most convenient features of the iPhone 12 and 13 lineups is wireless, MagSafe charging. The magnetic system allows for intuitive, easy charging that’s device-friendly while also effective. This Scout Pro power bank lets you charge all your Apple devices — and you can use it while you’re on the go and far […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple's M1 Max is 1.5x faster than M1 in supposed benchmark
A supposed benchmark reveals the raw performance of Apple's new M1 Max processor, with the new chip beating out 2020's entry-level M1 processor by 150% in multi-core score testing.According to a Geekbench post on Monday, the 10-core M1 Max with 32GB of unified memory achieves a single-core score of 1749 and multi-core score 11542, the latter representing a sizable increase in performance when compared to last year's Apple Silicon designs.For example, averages for the most recent 13-inch MacBook Pro with an 8-core M1 chip show an aggregate single-core score of about 1750, while multi-core scores hover at around the 7600 mark. Read more...

Read more »

New 14-inch and 16-inch MacBook Pro models & AirPods 3 on the AppleInsider podcast
On a special episode of the AppleInsider podcast, we recap everything announced at Apple's "Unleashed" event, including AirPods 3, M1 Pro and M1 Max chips, and the redesigned 14-inch and 16-inch MacBook Pro models.Apple began its "Unleashed" event with a section dedicated to Apple Music. CEO Tim Cook passed off the presentation to Zane Lowe who introduced a new Apple Music Voice Plan.Now in addition to the $9.99 individual subscription and $14.99 for families, users can choose a $4.99 tier that allows Apple Music listening solely via Siri. While it can be accessed across devices, this Apple Music Voice Plan would be useful for those wanting a HomePod mini but has no other Apple devices. Read more...

Read more »

If You Want to Relax, Massage Your Eyes
If you've ever found yourself rubbing your eyes to try soothing a headache or just relax, this cool device might be for you. The Mintal iMassage eye massager brings you a dark environment, gentle warming, and massage to your eyes. The inventors performed advanced analysis of facial structures among 300 volunteers. It fits comfortably on your face, blocks out most light, and cradles your eyes. The eye massager operates in several modes including heat, massage, and music to aid your relaxation. It contains 6 airbags that warm up in about 5 seconds. The Mintal iMassage can massage your eyes and provide 107.6º F of warmth to sooth your mood, help relieve a headache, or just get you ready to sleep. The accessory even connects to your iPhone via Bluetooth, and can play your favorite music through its built-in speakers. The battery is rated to last up to 12 hours, and it folds 180 degrees for storage. I've begun testing the accessory myself, so look for a full review in the near future.

Read more »

‘The Morning Show’ Season Two, Episode Five Review
Episode five of The Morning Show season two is the weakest of the new season so far, which I've generally been enjoying. While other episodes have moved multiple storylines on or made a pertinent point, this one ties up a few loose ends but offers little else. The most notable thing about it is Billy Crudup's ongoing brilliant performance as a highly-conflicted Cory Ellison. 'The Morning Show' Season Two Book Battle The forthcoming book by Maggie Brenner (played by Marcia Gay Harden,) is making Alex increasingly frantic as the team head to Las Vegas for the debate. It culminates in a rather over-the-top hotel room confrontation during which Alex learns that her affair with Mitch is going to come to light. Talking of hotel rooms and affairs, Bradley and Laura's relationship continues in Las Vegas, although it feels rather forced that the latter is there. In the build-up to and throughout the trip, which is meant to reflect the trip during which Hannah and Mitch first were together, Alex is complaining about pain in her back. It is an, I assume deliberate, echo of Megyn Kelly being ill before and during a Republican primary debate in August 2015. Ms. Kelly, however, got through the broadcast. Alex does not and flies home alone. Bradley gets her wish and moderates. https://www.youtube.com/watch?v=9FPb4Q3OyxA Cory's Dilemma Cory isn't with his team at the debate. We learn that he came to an agreement with Fred and that he and Bradley clearly had feelings for one another. In one of the more powerful segments of this relatively weak The Morning Show season two episode, he travels to try and persuade Hannah's father to take the compensation he is being offered. Hannah will be smeared in the press via Fred if her father continues his legal campaign. With the father refusing to stop, Cory, who does not want the smears to come out, is faced with a dilemma - if he feeds another salacious story to an outlet they will not run the stories about Hannah. Having just learned about Bradley and Laura's relationship, he clearly thinks disclosing that might do the job, but can he do that to his friend and confidant? Racism Rows and Covid in 'The Morning Show' Season Two Back in New York, Stella is confronted by a racist, who decides that because she is an Asian woman she must be at fault for Covid. Yanko, still reeling from his own issues around racism, comes to her defense. However, this escalates into a full-blown physical fight in the street. Inevitably, it's caught on camera. An important point is being made - Asians from all parts of that continent (Stella is Korean,) are being subjected to abuse. However, it is handled in a rather trite, obvious, way. This is happening a bit too much in The Morning Show season two. Mitch, meanwhile, is also dealing with the fallout from Covid. He and his new Italian friend are isolating together in his palatial home. A practice interview gives us some more insight into the guilt he feels about what has happened, a decent attempt to make him a more complex character than the monster we would probably all rather simply dismiss him as. [The Morning Show’ Season Two, Episode Four Review: Collision Course]

Read more »

Compared: New 14-inch MacBook Pro versus 13-inch M1 MacBook Pro versus Intel 13-inch MacBook Pro
Apple has finally launched the much-wanted 14-inch MacBook Pro with Apple Silicon, but it's kept the 13-inch model in the lineup for a reason. Here's how the two compare, and how they compare to the last 13-inch Intel version.It's smaller than the 16-inch MacBook Pro, but the new 14-inch MacBook Pro could be the best buyApple's 13-inch MacBook Pro was the first of its Pro notebooks to transition to Apple Silicon, and it immediately replaced the previous Intel version. But while that November 2020 update was radical in its speed and performance improvements, it retained everything else about the older model — including its screen size. Read more...

Read more »

Apple Watch Series 7 Review: A Larger Display, but No Essential Changes
This minor upgrade to the Apple Watch will be a big upgrade for those with watches a few years old, but there's not enough difference with the Series 6 to recommend it. The post appeared first on The Mac Security Blog.

Read more »

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million, and vowed his administration would seek to prosecute and investigate the "hackers" and anyone who aided the publication in its "attempt to embarrass the state and sell headlines for their news outlet."

Read more »

What the heck is Apple doing?? – Intego Mac Podcast Episode 209
Apple has released a security update for an actively exploited vulnerability, but only for iOS 15, not iOS 14? What are they doing? We also discuss how Apple sometimes offers security updates for older versions of macOS, but not always. The post appeared first on The Mac Security Blog.

Read more »

How Coinbase Phishers Steal One-Time Passwords
A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. It also shows that phishers are attempting to sign up for new Coinbase accounts by the millions as part of an effort to identify email addresses that are already associated with active accounts.

Read more »

How to Delete Your Social Media Accounts: Facebook, Instagram, YouTube, Twitter, and More
If you want to delete social media accounts, here's how to do it on the 10 most popular social media services. The post appeared first on The Mac Security Blog.

Read more »

Patch Tuesday, October 2021 Edition
Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited in active attacks. This month's Patch Tuesday also includes security fixes for the newly released Windows 11 operating system.

Read more »

Vulnerability Summary for the Week of October 4, 2021
Original release date: October 11, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 7.5 CVE-2021-41553 MISC aviatorscript_project -- aviatorscript AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL). 2021-10-02 7.5 CVE-2021-41862 MISC commonwl -- cwlviewer cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch. 2021-10-01 7.5 CVE-2021-41110 MISC MISC CONFIRM corel -- pdf_fusion Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 9.3 CVE-2021-38096 MISC MISC corel -- pdf_fusion Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 9.3 CVE-2021-38097 MISC MISC corel -- photopaint_2020 CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38101. 2021-10-01 9.3 CVE-2021-38099 MISC MISC corel -- presentations_2020 IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 9.3 CVE-2021-38103 MISC MISC dell -- isilon_insightiq_firmware Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker to take complete control of InsightIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity. 2021-10-01 7.5 CVE-2021-36298 MISC galera -- galera_webtemplate Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. 2021-10-01 7.5 CVE-2021-40960 MISC MISC getcomposer -- composer Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. 2021-10-05 7.5 CVE-2021-41116 MISC CONFIRM hotel_and_lodge_booking_management_system_project -- hotel_and_lodge_booking_management_system Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. 2021-10-01 7.5 CVE-2020-21012 MISC lodging_reservation_management_system_project -- lodging_reservation_management_system The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication. 2021-10-04 7.5 CVE-2021-41511 MISC MISC MISC online-shopping-system-advanced_project -- online-shopping-system-advanced An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input. 2021-10-01 7.5 CVE-2021-41649 MISC ptcl -- hg150-ub_firmware An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path. 2021-10-04 7.5 CVE-2021-35296 MISC qnap -- qvr A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later 2021-10-01 7.5 CVE-2021-34352 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 3xlogic -- infinias_access_control An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software. 2021-10-01 6.5 CVE-2021-41847 MISC MISC MISC 53kf -- 53kf Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window. 2021-10-04 4.3 CVE-2020-28119 MISC afian -- filerun Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. 2021-10-05 4.3 CVE-2021-35503 MISC MISC afian -- filerun Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. 2021-10-05 4.3 CVE-2021-35506 MISC MISC alfred-spotify-mini-player -- alfred_spotify_mini_player Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter. 2021-10-01 4.3 CVE-2021-40927 MISC MISC archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 4.3 CVE-2021-41555 MISC archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 6.5 CVE-2021-41554 MISC bosch -- rexroth_indramotion_mlc_l20_firmware The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL. 2021-10-04 4.3 CVE-2021-23856 CONFIRM canonical -- apport An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3; 2021-10-01 4.7 CVE-2021-3710 MISC MISC MISC MISC canonical -- multipass The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation. 2021-10-01 4.6 CVE-2021-3626 MISC canonical -- multipass The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. 2021-10-01 4.6 CVE-2021-3747 MISC codesolz -- better_find_and_replace The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue 2021-10-04 4.3 CVE-2021-24676 MISC coinmarketstats -- woo-altcoin-payment-gateway The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue 2021-10-04 4.3 CVE-2021-24679 MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter. 2021-10-01 4.3 CVE-2021-41463 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter. 2021-10-01 4.3 CVE-2021-41465 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter. 2021-10-01 4.3 CVE-2021-41464 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter. 2021-10-01 4.3 CVE-2021-41462 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter. 2021-10-01 4.3 CVE-2021-41461 MISC MISC corel -- coreldraw_2020 CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file. 2021-10-02 4.3 CVE-2021-38107 MISC MISC corel -- coreldraw_2020 Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file. 2021-10-02 4.3 CVE-2021-38109 MISC MISC corel -- pdf_fusion Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 6.8 CVE-2021-38098 MISC MISC corel -- photopaint_2020 Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. 2021-10-01 6.8 CVE-2021-38100 MISC MISC corel -- photopaint_2020 CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38099. 2021-10-01 6.8 CVE-2021-38101 MISC MISC corel -- presentations_2020 IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38102. 2021-10-01 4.3 CVE-2021-38105 MISC MISC corel -- presentations_2020 IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 4.3 CVE-2021-38104 MISC MISC corel -- presentations_2020 UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 4.3 CVE-2021-38106 MISC MISC corel -- presentations_2020 IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38105. 2021-10-01 4.3 CVE-2021-38102 MISC MISC corel -- wordperfect_2020 Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file. 2021-10-02 4.3 CVE-2021-38108 MISC MISC corel -- wordperfect_2020 Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file. 2021-10-01 6.8 CVE-2021-38110 MISC MISC dell -- enterprise_sonic_os Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACSRadius credentials stored to read sensitive information and use it in further attacks. 2021-10-01 4 CVE-2021-36309 MISC detector_project -- detector Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or HTML via the cid parameter. 2021-10-01 4.3 CVE-2021-40921 MISC docker -- command_line_interface Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. 2021-10-04 5 CVE-2021-41092 MISC CONFIRM ecommerce-codeigniter-bootstrap_project -- ecommerce-codeigniter-bootstrap Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter. 2021-10-01 4.3 CVE-2021-40975 MISC emlog -- emlog emlog v6.0.0 contains a SQL injection via /admin/comment.php. 2021-10-01 6.5 CVE-2020-21013 MISC emlog -- emlog emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php. 2021-10-01 5.5 CVE-2020-21014 MISC esri -- portal_for_arcgis There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker to impersonate another account. 2021-10-01 6.5 CVE-2021-29108 CONFIRM esri -- portal_for_arcgis A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-10-01 4.3 CVE-2021-29109 CONFIRM faveohelpdesk -- faveo Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter. 2021-10-01 4.3 CVE-2021-40925 MISC MISC getid3 -- getid3 Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter. 2021-10-01 4.3 CVE-2021-40926 MISC MISC gitlab -- gitlab The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses 2021-10-05 4 CVE-2021-22258 CONFIRM MISC MISC gitlab -- gitlab A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. 2021-10-04 4 CVE-2021-22259 MISC CONFIRM gitlab -- gitlab In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure. 2021-10-05 4 CVE-2021-39891 MISC CONFIRM gitlab -- gitlab In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch. 2021-10-05 4 CVE-2021-39889 MISC MISC CONFIRM gitlab -- gitlab Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references. 2021-10-05 4 CVE-2021-39886 MISC CONFIRM gitlab -- gitlab A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware. 2021-10-05 4 CVE-2021-39880 CONFIRM MISC MISC gitlab -- gitlab In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call. 2021-10-05 4 CVE-2021-39870 MISC MISC CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances. 2021-10-05 5 CVE-2021-22257 MISC CONFIRM gitlab -- gitlab Missing access control in GitLab version 13.10 and above with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page 2021-10-05 5 CVE-2021-22262 CONFIRM MISC MISC gitlab -- gitlab A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. 2021-10-05 5 CVE-2021-39893 MISC CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted. 2021-10-05 4.3 CVE-2021-22264 CONFIRM MISC glimmrtv -- flextv Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF parameter. 2021-10-01 4.3 CVE-2021-40928 MISC MISC google -- android In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-179289753 2021-10-06 4.6 CVE-2021-0692 MISC google -- android In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048 2021-10-06 4.6 CVE-2021-0691 MISC google -- android When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion: Android-10Android ID: A-189392423 2021-10-06 6.8 CVE-2021-0636 MISC google -- android In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353 2021-10-06 4.6 CVE-2021-0685 MISC google -- android In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665 2021-10-06 4.6 CVE-2021-0684 MISC google -- android When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion:Android-10Android ID: A-189402477 2021-10-06 6.8 CVE-2021-0635 MISC google -- android In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-185398942 2021-10-06 4.6 CVE-2021-0683 MISC google -- android In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-182152757 2021-10-06 4.3 CVE-2021-0690 MISC google -- android In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096 2021-10-06 4.6 CVE-2021-0595 MISC google -- android In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180422108 2021-10-06 4.4 CVE-2021-0598 MISC google -- android In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-161149543 2021-10-06 4.4 CVE-2021-0688 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41459 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41456 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41457 MISC grafana -- grafana Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects. 2021-10-05 6.8 CVE-2021-39226 MISC MISC CONFIRM MISC MLIST hkurl -- i-panel_administration_system A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button. 2021-10-04 4.3 CVE-2021-41878 MISC MISC ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should not be able to access due to improper access controls. IBM X-Force ID: 202169. 2021-10-06 4 CVE-2021-29758 CONFIRM XF ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213. 2021-10-06 4 CVE-2021-29760 CONFIRM XF ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that they should not have access to. IBM X-Force ID: 202265. 2021-10-06 4 CVE-2021-29761 CONFIRM XF jizhicms -- jizhicms JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie. 2021-10-01 4.3 CVE-2020-21228 MISC MISC MISC justwriting_project -- justwriting Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter. 2021-10-01 4.3 CVE-2021-41467 MISC MISC linux -- linux_kernel prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. 2021-10-02 4.6 CVE-2021-41864 MISC MISC FEDORA maccms -- maccms A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. 2021-10-04 6.8 CVE-2020-21386 MISC maccms -- maccms A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. 2021-10-04 4.3 CVE-2020-21387 MISC mcafee -- drive_encryption Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer. 2021-10-01 4.6 CVE-2021-23893 CONFIRM meowapps -- media_file_renamer_-_auto_&_manual_rename Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions

Read more »

The Complete Guide to Apple MagSafe Chargers, Cases, and Accessories
Apple's MagSafe technology provides a great way to charge your iPhone, but also some interesting accessories. The post appeared first on The Mac Security Blog.

Read more »

iPad mini 6, Facebook’s Time-Out, and a Contactless iPhone Rip-Off – Intego Mac Podcast Episode 208
Facebook's downtime shows how risky it is to use social media services to log into other services. An interesting proof of concept can steal money from Visa cards on iPhones. And we discuss the new iPad mini 6, and the Apple Watch 7 that goes on sale Friday. The post appeared first on The Mac Security Blog.

Read more »

How to Use Multitasking on the iPad
Apple has improved multitasking on the iPad, in iPadOS 15, so you can view and work in two apps at a time. The post appeared first on The Mac Security Blog.

Read more »

What Happened to Facebook, Instagram, & WhatsApp?
Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don't yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to find these destinations online.

Read more »

Expercom is offering 14″ and 16″ M1 MacBook Pro preorder discounts ranging up to $305 off MSRP
Apple reseller Expercom is offering discounts on new M1 Pro and M1 Max 14″ and 16″ MacBook Pros ranging up to $305 off Apple’s MSRP. Preorders start today. Order now, and Expercom estimates free shipping in as little as three weeks for these new models. At the moment, Expercom’s prices are the lowest available from any Apple reseller. – 14″ M1 Pro/M1 Max MacBook Pros: […] The post first appeared on MacPrices.net.

Read more »

Expercom offers $50 AppleCare+ discount when purchased alongside new 14″ or 16″ M1 MacBook Pros
Apple reseller Expercom is offering a $50 discount on the purchase of an AppleCare+ Plan alongside a new 2021 14″ MacBook Pro or 16″ MacBook Pro with an Apple M1 Pro or M1 Max CPU. Their discount reduces the price of an AppleCare+ Plan for 14″ M1 MacBook Pros to $229 and new 16″ M1 MacBook Pros to $349. Expercom is currently offering preorders of […] The post first appeared on MacPrices.net.

Read more »

Expercom offers $50 AppleCare+ discount when purchased alongside new 14″ or 16″ M1 MacBook Pros
Apple reseller Expercom is offering a $50 discount on the purchase of an AppleCare+ Plan alongside a new 2021 14″ MacBook Pro or 16″ MacBook Pro with an Apple M1 Pro or M1 Max CPU. Their discount reduces the price of an AppleCare+ Plan for 14″ M1 MacBook Pros to $229 and new 16″ M1 MacBook Pros to $349. Expercom is currently offering preorders of […] The post first appeared on MacPrices.net.

Read more »

Apple drops prices on Certified Refurbished 16-inch MacBook Pros with models now available starting at only $1949
With the introduction of the 2021 M1 Pro and M1 Max 16″ MacBook Pros, Apple has dropped prices on Certified Refurbished 2020 16″ 6-Core & 8-Core MacBook Pros, with models now available for up to $510 off original MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently […] The post first appeared on MacPrices.net.

Read more »

Apple to introduce new Macs today, perhaps more
Apple is widely anticipated to introduce several new Macs at their special fall event today. Watch their presentation here, at 10am PT. We’re expecting new MacBooks and maybe some new desktops. It’s also possible that Apple releases updated accessories, such as AirPods. After the presentation, come back here and check out prices for the new Macs as well as discounts on previous-generation models. We’ll have […] The post first appeared on MacPrices.net.

Read more »

Apple to introduce new Macs today, perhaps more
Apple is widely anticipated to introduce several new Macs at their special fall event today. Watch their presentation here, at 10am PT. We’re expecting new MacBooks and maybe some new desktops. It’s also possible that Apple releases updated accessories, such as AirPods. After the presentation, come back here and check out prices for the new Macs as well as discounts on previous-generation models. We’ll have […] The post first appeared on MacPrices.net.

Read more »

Are The Days Upon Us When Apple (Inc., Not The Fruit) Keeps The Doctor Away?
FEATURE: 10.16.21 – Don’t be surprised if at your next doctor’s appointment, your physician tells you to take two AirPods and call them in the morning. Back in June — in a story from Macworld magazine — the publication reported on a new concept in healthcare from Apple that would create an AppleCare-like service for diagnosing and repairing (as it were) our ailments. According to […] The post first appeared on MacPrices.net.

Read more »

In stock today: Clearance 2020 13″ MacBook Airs starting at only $719 at Apple, Certified Refurbished
Apple has clearance, Certified Refurbished, 2020 13″ Intel-based MacBook Airs in stock today starting at only $719 and up to $370 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air […] The post first appeared on MacPrices.net.

Read more »

In stock: Clearance 2020 7.9″ iPad mini 5 models at Apple starting at $339, Certified Refurbished
Apple has Certified Refurbished 2020 7.9″ WiFi iPad mini 5 models in stock for up to $80 off original MSRP, starting at only $339. Each iPad comes with Apple’s standard one-year warranty and includes a new outer case. Shipping is free. Apple’s prices are the cheapest available for these models anywhere: – 7.9″ 64GB WiFi iPad mini: $339 $60 off MSRP – 7.9″ 256GB WiFi […] The post first appeared on MacPrices.net.

Read more »

Apple’s 11″ M1 iPad Pros are on sale for $100 off MSRP, prices start at $699
Amazon has all configurations of 11″ iPad Pros with Apple M1 processors on sale for $100 off MSRP shipped. Their prices are the lowest available for new M1 11″ iPad Pros and also represent the first substantial sale prices on thee models. Note that some sale prices may be restricted to either Space Gray or Silver colors, depending on configuration: – 11″ M1 128GB WiFi […] The post first appeared on MacPrices.net.

Read more »

Apple’s 11″ M1 iPad Pros are on sale for $100 off MSRP, prices start at $699
Amazon has all configurations of 11″ iPad Pros with Apple M1 processors on sale for $100 off MSRP shipped. Their prices are the lowest available for new M1 11″ iPad Pros and also represent the first substantial sale prices on thee models. Note that some sale prices may be restricted to either Space Gray or Silver colors, depending on configuration: – 11″ M1 128GB WiFi […] The post first appeared on MacPrices.net.

Read more »

Amazon offers $100 discount on many 12″ M1 iPad Pro configurations
Amazon has 12″ iPad Pros with Apple M1 processors on sale today for $100 off MSRP shipped. Their prices are the lowest available for new M1 12″ iPad Pros and also represent the first substantial sale prices on these models. Note that some sale prices may be restricted to either Space Gray or Silver colors, depending on configuration: – 12″ M1 128GB WiFi iPad Pro: […] The post first appeared on MacPrices.net.

Read more »