Best Apple Watch Prime Day deals: Series 6 now $279 ($120 off) at Amazon
Amazon just launched killer Prime Day Apple Watch deals, dropping the Series 6 to $279 ($120 off). Target has the Series 3 on sale for $169 as well.Apple Watch Prime Day dealsThe standout markdown in the latest round of deals to go live ahead of Prime Day is a $120 discount on the 40mm Apple Watch Series 6 (GPS) with a Red Aluminum Case and Red Sport Band. Read more...

Read more »

Hands-on: macOS Monterey brings new Shortcuts app
One of the top features introduced with macOS Monterey is the Shortcuts app. Previewed during the WWDC21 keynote, the operating system is set to launch this fall. This marks the first time the Shortcuts app has been available on the Mac. more… The post appeared first on 9to5Mac.

Read more »

Today in Apple history: Apple’s eWorld online service goes live
June 20, 1994: Apple launches eWorld, a subscription service for Mac owners that’s designed to compete with America Online and other nascent online properties. Part messaging service and part news aggregator, Apple envisions eWorld competing with heavy hitters like AOL, Delphi, CompuServe and Prodigy. Unfortunately, Apple’s online service is doomed from the start. eWorld is […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Texas homes heat up as power companies alter smart thermostats
Texas homeowners have discovered their homes are getting warmer despite the use of air conditioning, with the discovery that energy companies are remotely adjusting the thermostat to higher temperatures with minimal warning.Residents in Houston and surrounding areas have complained that their thermostats have been increasing in temperature, seemingly on their own. Rather than keeping the house cool, the thermostats have been remotely tampered with to operate at a warmer temperature.In one example aired by WFAA, the English family of Deer Park discovered such a situation on Wednesday. Brandon English returned home that day to discover his wife and daughters had lowered the temperature at 2:30pm, but it had been changed while they had a nap. Read more...

Read more »

The next Apple Watch looks great, but $120 off the Series 6 is even greater
We’re just a few months away from the launch of the Apple Watch Series 7 and it’s shaping up to be a monumental release, with a new design, better screen, and even more health and fitness features. But this early Prime Day deal on the Series 6 is the perfect reason not to wait. Amazon […]

Read more »

Unlock the full potential of your device with these amazing deals on top-rated apps you won’t find on Amazon
Whether you want to be more productive in your work, get your startup off the ground, or unleash the full potential of your Mac, all of these incredible tools will do just that. They have a couple more things in common, too: they’re all incredibly highly rated, with rave reviews across the internet – and […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

The next MacBook Pro: It’s looking like a long wait
With the continuation of the Apple silicon rollout, the MacBook Pro is in line for some major changes. The company will likely take the opportunity of the new models based on Apple silicon to introduce new designs, features, and refinements. This article keeps track of the most creditable reports of the upcoming MacBook Pro, so […]

Read more »

The best early Prime Day Apple deals: MacBooks, iPads, AirPods, and more
Amazon Prime Day is just around the corner and there are sure to be some great deals to be had on Apple products. But if you need a new Mac or iPad now, you don’t need to wait. Here are the best deals we can find and be sure to check back once Prime Day […]

Read more »

Russia votes to force U.S. tech giants to open local offices
Major tech companies like Apple must open offices in Russia by January 2022, lawmakers in the country have decided, in what could be a move to crack down on dissent and banned commentary online.The vote on Thursday saw members of the Russian parliament pass legislation requiring foreign companies to either set up a local branch or open a Russian legal entity. Affected firms are those that serve more than half a million daily users from the country via their website, which would include Apple and most social networks and search engines.While the legislation has passed through the lower house of parliament, it still has to be approved by the upper house and signed by President Vladimir Putin to be turned into a law. Reuters reports it is widely expected to pass through the upper house unscathed, and to be signed by Putin with no issues raised. Read more...

Read more »

macOS Monterey: Here’s everything new with AirPlay to Mac
macOS 12 Monterey was previewed during the WWDC21 keynote. The new Mac operating system will bring a refined experience from its predecessor macOS Big Sur. One of the top features of Monterey is the ability to AirPlay to Mac. Here’s how it’s going to work. more… The post appeared first on 9to5Mac.

Read more »

Apple Watch Series 7: New design, better display, more speed on the way
It’s been six years since the first Apple Watch hit the market, and the device has seen some important changes in its time with cellular, larger displays, and more powerful sensors. Lately, however, it seems as if we’ve hit the part in a product’s life where the upgrades are incremental, but that could change this […]

Read more »

Nude photo texts and iPhones switched for fruit in the Apple Crime Blotter
iPhone evidence catches a mail fraud conspiracy, a police department recommends AirTags in cars, and Apple device orders replaced with fruit.The latest in an occasional AppleInsider series, looking at the world of Apple-related crime.Ex-trooper pleads guilty texting himself woman's nude photos Read more...

Read more »

Amazon reduces app store fee; free AWS credits
Amazon has reduced the fee it charges developers on its Fire OS app store. The company is following in the footsteps of other tech ... Read more The post appeared first on iLounge.

Read more »

Apple’s VP of Technology talks about Health features
Apple held its annual developers conference WWDC’s keynote on June 8. As part of that, the company introduced the next generation of software for ... Read more The post appeared first on iLounge.

Read more »

Google plans Android version of Apple's Find My network
Google may be working on its own version of Apple's Find My network, with a beta release of Google Play Services for Android suggesting the smartphones could be used to track other devices in a similar way to Apple's major feature.The Find My network first appeared on iOS, but Google is seemingly making its own version. The Find My network is designed to make it possible for lost items to be found, by leveraging the high number of iPhones being used. It seems that Google may be coming up with its own alternative to the same system. Read more...

Read more »

7 great travel gadgets at better prices than on Amazon right now
Having the perfect portable gadgets by your side makes traveling simpler, more efficient and more fun. From Bluetooth accessories that take your smartphone to the next level, to super-cool gift ideas and the best wireless headphones for any trip, we found all these products on sale for a limited time — at prices that are even […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

A specific network name can completely disable Wi-Fi on your iPhone
Here’s a funny bug: a security researcher has found that a carefully crafted network name causes a bug in the networking stack of iOS and can completely disable your iPhone’s ability to connect to Wi-Fi. On Twitter, Carl Schou showed that after joining a Wi-Fi network with a specific name (“%p%s%s%s%s%n”), all Wi-Fi functionality on the iPhone was disabled from that point on. more… The post appeared first on 9to5Mac.

Read more »

Lawmakers weren't 'creative or enthusiastic' enough to fix big tech antitrust laws
The CEOs of big tech companies like Apple have been "allowed to do whatever they want," according to Representative David Cicilline in an interview over a series of antitrust bills taking aim at the tech giants.In early June, a collection of five bills were introduced by U.S. House lawmakers, aimed at introducing changes to antitrust legislation. The bills cover a range of topics that have received antitrust attention, including affecting how Apple could operate the App Store and even what apps it bundles with iPhones in iOS.During an interview for the New York Times' "Sway" podcast Congressman David Cicilline (Dem-RI) outlined the aims of each bill, as well as why the U.S. government is moving to make major changes in antitrust law. The bills are set to start being reviewed by late June. Read more...

Read more »

Best Prime Day 2021 deals on Apple AirPods
Prime Day 2021 deals are heating up and Apple AirPods are at some of the season's best prices on Amazon.AirPods Prime Day dealsThe best AirPods deals include $40 to $52 off AirPods 2, AirPods Pro and even AirPods Max. Many of the discounts are available at Amazon, with the exception of this $489 AirPods Max deal, which beats Amazon's prices by $10 to $60, depending on the color. Read more...

Read more »

Bug in iOS can break iPhone Wi-Fi using rogue hotspot name
A bug has been discovered in iOS that can disable an iPhone's ability to connect to Wi-Fi hotspots, if it attempts to initially connect to a hotspot with a specific name that breaks the function.Security researcher Carl Schou gave a personal Wi-Fi hotspot a name of "%p%s%s%s%s%n." On trying to connect to the hotspot, Schou discovered the iPhone simply couldn't connect to it at all, and later discovered that it disabled Wi-Fi connectivity completely on the device.Attempts to connect to other hotspots failed, with the issue continuing to mainifest after changing the hotspot's SSID and rebooting the iPhone, according to BleepingComputer. The issue was also confirmed by others testing out the same SSID name separately. Read more...

Read more »

5-in-1 MagSafe Wireless & Wired Charging Station is 31% Off
iLounge has a special deal on the 5-in-1 MagSafe Wireless & Wired Charging Station, which allows you to dump all your current cables and ... Read more The post 5-in-1 MagSafe Wireless & Wired Charging Station is 31% Off appeared first on iLounge.

Read more »

Save 23% on Amazon Basics Mid-Back Office Chair
Achieve optimal productivity and comfort with a well-made mid-back office desk chair. Today, the Amazon Basics Mesh Office Chair is down to just $48.17 ... Read more The post appeared first on iLounge.

Read more »

Apple TV+ ‘The Shrink Next Door’ trailer revealed
Apple has recently uploaded a new trailer video for its upcoming comedy series ‘The Shrink Next Door’. ‘The Shrink Next Door’ tells the story ... Read more The post appeared first on iLounge.

Read more »

2021 back to school Apple promo arrives
Apple has officially launched its back to school sale in Canada and the United States. Students who purchase select iPad and Macs can get ... Read more The post appeared first on iLounge.

Read more »

M1 MacBook Pro and MacBook Air get lower AppleCare+ prices
Apple has recently lowered its AppleCare+ plan prices for the new M1-powered MacBook Pro and the MacBook Air. Coverage and accidental damage fees were ... Read more The post appeared first on iLounge.

Read more »

Fox Now app ends third-generation Apple TV support
The Fox Now app is now no longer supported by the third-generation Apple TV, with the streaming app now only accessible on the fourth-generation Apple TV and newer models.In May, Fox said it was dropping support for the Fox Now app on the third-generation Apple TV from June 17. It appears that Fox has followed through with its announced change.First reported on Saturday by Appleosophy, the Fox Now app is no longer accessible on the third-generation Apple TV. It also appears that previously-installed versions of the app are removed from view on the set-top box. Read more...

Read more »

iOS 15 is boring … and that’s a good thing [Cult of Mac Magazine 406]
Sweeping change is overrated, especially when it comes to something you use every day — like your iPhone. It’s true that this year’s iOS update doesn’t bring a ton of mind-blowing new features. But when you’re trying to execute a simple task, sometimes you don’t want your mind blown. You want “it just works” … […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Today in Apple history: New Power Mac is faster and more expandable
June 19, 1995: Apple releases the Power Macintosh 9500, a high-end Mac that boasts a second-generation PowerPC chip that’s much faster than its predecessor. The Power Mac 9500 is also significant for coming with six Peripheral Component Interconnect, or PCI, slots. They allow owners to attach hardware using Intel’s industry-standard connection. Along with seven bays […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

FOX NOW app no longer available on the third-gen Apple TV
The third-generation Apple TV just lost another app with FOX NOW dropping support for the set-top box. Only this year, YouTube, CBS All Access, and MLB apps removed their apps from this Apple TV model. more… The post appeared first on 9to5Mac.

Read more »

Paintstorm Studio: Lifetime Subscription is 21% Off
iLounge has a special deal on the PaintStorm Studi lifetime subscription, which allows you to produce superb works of art as you would a ... Read more The post appeared first on iLounge.

Read more »

First American Financial Pays Farcical $500K Fine
In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. [NYSE:FAF] was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back more than 16 years. This week, the U.S. Securities and Exchange Commission settled its investigation into the matter after the Fortune 500 company agreed to pay a paltry penalty of less than $500,000.

Read more »

New Features Coming in macOS Monterey, iOS 15, and iPadOS 15 – Intego Mac Podcast Episode 192
Apple issued a security update for iOS 12, and we wonder why. Google backtracks on a Chrome address bar change. New stats show an increasing in phishing sites. And we discuss the new features in Apple's next operating systems, due out in the fall. The post appeared first on The Mac Security Blog.

Read more »

Ukrainian Police Nab Six Tied to CLOP Ransomware
Authorities in Ukraine this week charged six people alleged to have been part of the CLOP ransomware group, a cybercriminal gang said to have extorted more than half a billion dollars from victims. Some of CLOP's victims this year alone include Stanford University Medical School, the University of California, and University of Maryland.

Read more »

How Does One Get Hired by a Top Cybercrime Gang?
The U.S. Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot, a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware. Just how did a self-employed web site designer and mother of two come to work for one of the world’s most rapacious cybercriminal groups and then leave such an obvious trail of clues indicating her involvement with the gang? This post explores answers to those questions, as well as some of the ways Trickbot and other organized cybercrime gangs gradually recruit, groom and trust new programmers.

Read more »

Vulnerability Summary for the Week of June 7, 2021
Original release date: June 14, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aomedia -- aomedia aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. 2021-06-04 7.5 CVE-2021-30475 MISC MISC broadcom -- sannav Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF). 2021-06-09 7.5 CVE-2020-15377 MISC chiyu-tech -- bf-430_firmware An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated. 2021-06-04 7.5 CVE-2021-31251 CONFIRM MISC MISC linux -- linux_kernel The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). 2021-06-04 7.2 CVE-2021-3489 MISC UBUNTU UBUNTU MISC MLIST linux -- linux_kernel The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). 2021-06-04 7.2 CVE-2021-3490 UBUNTU MISC MISC UBUNTU MLIST linux -- linux_kernel The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1). 2021-06-04 7.2 CVE-2021-3491 UBUNTU UBUNTU MISC MISC MLIST microsoft -- intune_management_extension Microsoft Intune Management Extension Remote Code Execution Vulnerability 2021-06-08 7.5 CVE-2021-31980 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31976. 2021-06-08 7.8 CVE-2021-31975 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31975. 2021-06-08 7.8 CVE-2021-31976 MISC microsoft -- windows_10 Kerberos AppContainer Security Feature Bypass Vulnerability 2021-06-08 7.5 CVE-2021-31962 MISC qualcomm -- apq8009_firmware Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking 2021-06-09 7.8 CVE-2020-11241 CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accela -- civic_platform In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. 2021-06-07 4.3 CVE-2021-33904 MISC MISC adiscon -- loganalyzer Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. 2021-06-08 4.3 CVE-2021-31738 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. 2021-06-04 4 CVE-2020-36142 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. 2021-06-04 6.5 CVE-2020-36141 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely). 2021-06-04 4.3 CVE-2020-36140 MISC broadcom -- sannav Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header. 2021-06-09 5 CVE-2020-15384 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. 2021-06-09 5 CVE-2020-15380 MISC broadcom -- sannav The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface. 2021-06-09 5 CVE-2020-15378 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission. 2021-06-09 5.5 CVE-2020-15385 MISC chiyu-tech -- bf-430_firmware An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it. 2021-06-04 5.8 CVE-2021-31252 CONFIRM MISC MISC chiyu-tech -- bf-430_firmware A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components. 2021-06-04 6.4 CVE-2021-31249 MISC MISC MISC cisco -- webex_meetings_desktop A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system, which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account. 2021-06-04 6.9 CVE-2021-1536 CISCO ckeditor -- ckeditor A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! > is mishandled. 2021-06-09 4.3 CVE-2021-33829 MISC cloverdx -- cloverdx A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10. 2021-06-09 4.3 CVE-2021-30133 CONFIRM MISC dino -- dino Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. 2021-06-07 5 CVE-2021-33896 CONFIRM MISC MLIST dlink -- dir-868l_firmware The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29321 MISC dlink -- dir-880l_firmware The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29322 MISC dlink -- dir-885l-mfc_firmware The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29323 MISC dlink -- dir-895l_mfc_firmware The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29324 MISC entrouvert -- lasso Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. 2021-06-04 5 CVE-2021-28091 MISC MISC MISC DEBIAN MLIST FEDORA FEDORA esri -- arcgis_server A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue. 2021-06-07 5 CVE-2021-29099 CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. 2021-06-08 4.3 CVE-2021-22220 CONFIRM MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30517 MISC MISC google -- chrome Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. 2021-06-07 4.3 CVE-2021-30533 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30532 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30531 MISC MISC google -- chrome Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30514 MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30513 MISC MISC google -- chrome Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page. 2021-06-04 5.8 CVE-2021-30511 MISC MISC google -- chrome Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30512 MISC MISC google -- chrome Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30537 MISC MISC google -- chrome Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30536 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30539 MISC MISC google -- chrome Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30510 MISC MISC google -- chrome Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension. 2021-06-04 6.8 CVE-2021-30509 MISC MISC google -- chrome Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30508 MISC MISC google -- chrome Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30507 MISC MISC google -- chrome Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30506 MISC MISC google -- chrome Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30534 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30538 MISC MISC google -- chrome Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30518 MISC MISC google -- chrome Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30527 MISC MISC google -- chrome Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30519 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30520 MISC MISC google -- chrome Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30521 MISC MISC google -- chrome Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30522 MISC MISC MISC google -- chrome Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. 2021-06-07 6.8 CVE-2021-30523 MISC MISC google -- chrome Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30524 MISC MISC google -- chrome Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30525 MISC MISC google -- chrome Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30526 MISC MISC google -- chrome Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30528 MISC MISC google -- chrome Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30515 MISC MISC google -- chrome Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30529 MISC MISC google -- chrome Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30535 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30542 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30543 MISC MISC google -- chrome Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30540 MISC MISC google -- chrome Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30516 MISC MISC google -- chrome Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30530 MISC MISC ibm -- datapower_gateway IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033. 2021-06-07 5 CVE-2020-5008 CONFIRM XF ibm -- websphere_application_server_nd IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435. 2021-06-07 6.5 CVE-2021-20517 CONFIRM XF inverse -- sogo SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.) 2021-06-04 5 CVE-2021-33054 MISC MISC MISC jnews -- jnews The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. 2021-06-07 4.3 CVE-2021-24342 CONFIRM luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration. 2021-06-04 5 CVE-2021-33838 MISC MISC MISC MISC luca-app -- luca The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature. 2021-06-04 5 CVE-2021-33840 MISC MISC luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting. 2021-06-04 5 CVE-2021-33839 MISC MISC MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31940. 2021-06-08 6.8 CVE-2021-31941 MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31941. 2021-06-08 6.8 CVE-2021-31940 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31942. 2021-06-08 6.8 CVE-2021-31943 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31943. 2021-06-08 6.8 CVE-2021-31942 MISC microsoft -- 3d_viewer 3D Viewer Information Disclosure Vulnerability 2021-06-08 4.3 CVE-2021-31944 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 2021-06-08 5.1 CVE-2021-33741 MISC microsoft -- kubernetes_tools Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-31938 MISC microsoft -- malware_protection_engine Microsoft Defender Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31985 MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31945, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31946 MISC MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31946, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31945 MISC MISC microsoft -- sharepoint_enterprise_server Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31963, CVE-2021-31966. 2021-06-08 6.5 CVE-2021-26420 MISC microsoft -- vp9_video_extensions VP9 Video Extensions Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31967 MISC microsoft -- windows_10 Windows Remote Desktop Services Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31968 MISC microsoft -- windows_10 Server for NFS Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31974 MISC microsoft -- windows_10 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31969 MISC microsoft -- windows_10 Windows GPSVC Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31973 MISC microsoft -- windows_10 Windows HTML Platform Security Feature Bypass Vulnerability 2021-06-08 6.8 CVE-2021-31971 MISC microsoft -- windows_server_2008 Windows DCOM Server Security Feature Bypass 2021-06-08 4.3 CVE-2021-26414 MISC microsoft -- windows_server_2008 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31199. 2021-06-08 4.6 CVE-2021-31201 MISC microsoft -- windows_server_2008 Windows Print Spooler Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-1675 MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-23215 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215. 2021-06-08 4.3 CVE-2021-26260 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-26945 MISC openexr -- openexr A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR. 2021-06-08 6.8 CVE-2021-23169 FEDORA MISC FEDORA openvpn -- openvpn_access_server OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service. 2021-06-04 5 CVE-2020-36382 MISC MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. 2021-06-07 4.3 CVE-2020-36383 MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via color settings. 2021-06-07 4.3 CVE-2020-36384 MISC qualcomm -- apq8009_firmware Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 6.9 CVE-2020-11233 CONFIRM qualcomm -- apq8009w_firmware Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking 2021-06-09 6.9 CVE-2020-11250 CONFIRM qualcomm -- apq8096au_firmware Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 4.6 CVE-2020-11160 CONFIRM refined-github_project -- refined-github The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns. 2021-06-09 4.3 CVE-2021-34364 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33661 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33660 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33659 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27641 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27638 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27639 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27640 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27642 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27643 MISC MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member". 2021-06-07 6.8 CVE-2020-18265 MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member". 2021-06-07 6.8 CVE-2020-18264 MISC tracefinanacial -- crestbridge Trace Financial CRESTBridge V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions), SIMATIC RF615R (All versions > V3.0), SIMATIC RF680R (All versions > V3.0), SIMATIC RF685R (All versions > V3.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation. 2021-06-08 not yet calculated CVE-2021-31340 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819) 2021-06-08 not yet calculated CVE-2021-27387 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820) 2021-06-08 not yet calculated CVE-2021-27399 MISC smartstream -- transaction_lifecycle_management_reconciliation_premium   SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23320 CONFIRM ubuntu -- ubuntu   Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25949 MISC MISC ubuntu -- ubuntu   Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25948 MISC MISC ubuntu -- ubuntu   It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. 2021-06-11 not yet calculated CVE-2021-25684 MISC ubuntu -- ubuntu   There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23321 CONFIRM ubuntu -- ubuntu   There is an Assertion in '(flags > > CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags > > CBC_STACK_ADJUST_SHIFT)) stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23319 CONFIRM ubuntu -- ubuntu   There is an Assertion in 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23322 CONFIRM ubuntu -- ubuntu   There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23314 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23310 CONFIRM ubuntu -- ubuntu   There is an Assertion 'scope_stack_p > context_p- >scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23313 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_depth == context_p- >context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23309 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23308 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23311 CONFIRM ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32553 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32552 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32551 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32550 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32554 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32555 MISC ubuntu -- ubuntu   It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. 2021-06-12 not yet calculated CVE-2021-32556 MISC ubuntu -- ubuntu   It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. 2021-06-12 not yet calculated CVE-2021-32557 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32549 MISC ubuntu -- ubuntu   It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. 2021-06-11 not yet calculated CVE-2021-25682 MISC ubuntu -- ubuntu   It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. 2021-06-11 not yet calculated CVE-2021-25683 MISC ubuntu -- ubuntu   There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23302 CONFIRM ubuntu -- ubuntu   There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23303 CONFIRM unix -- symbolic_link   A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1. 2021-06-10 not yet calculated CVE-2021-25322 CONFIRM vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 2 of 2). 2021-06-08 not yet calculated CVE-2021-26472 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 1 of 2). 2021-06-08 not yet calculated CVE-2021-26471 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated file write via a GET request that specifies a file's name and content. 2021-06-08 not yet calculated CVE-2021-26473 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated SSRF via a GET request that specifies a hostname and port number. 2021-06-08 not yet calculated CVE-2021-26474 MISC MISC MISC MISC MISC vernemq_mqtt_broker -- vernemq_mqtt_broker   VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system. 2021-06-08 not yet calculated CVE-2021-33176 MISC welch_allyn -- multiple_devices   The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27408 MISC welch_allyn -- multiple_products   The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27410 MISC werkzeug -- werkzeug   This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. 2021-06-11 not yet calculated CVE-2021-23393 MISC MISC western_digital -- edgerover   Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials. 2021-06-11 not yet calculated CVE-2021-33205 CONFIRM whatsapp -- business   A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files. 2021-06-11 not yet calculated CVE-2021-24035 CONFIRM windows -- mshtml_platform   Windows MSHTML Platform Remote Code Execution Vulnerability 2021-06-08 not yet calculated CVE-2021-33742 MISC wordpress -- wordpress   The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users 2021-06-07 not yet calculated CVE-2021-24336 MISC CONFIRM wordpress -- wordpress   The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues 2021-06-07 not yet calculated CVE-2021-24344 CONFIRM wordpress -- wordpress   The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones. 2021-06-07 not yet calculated CVE-2021-24340 CONFIRM MISC wordpress -- wordpress   The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. 2021-06-07 not yet calculated CVE-2021-24337 MISC CONFIRM wowonder -- wowonder   In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day. 2021-06-11 not yet calculated CVE-2021-27200 MISC MISC MISC wp-cli -- wp-cli   WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLIUtilshttp_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLIUtilshttp_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLIUtilshttp_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior. 2021-06-07 not yet calculated CVE-2021-29504 MISC MISC MISC MISC MISC MISC CONFIRM xen -- xen   HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. 2021-06-11 not yet calculated CVE-2021-28687 MISC xen -- xen   x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. 2021-06-11 not yet calculated CVE-2021-28689 MISC xscreensaver -- xscreensaver   XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. 2021-06-10 not yet calculated CVE-2021-34557 MISC MISC MISC MISC MLIST z-blogphp -- z-blogphp   Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." 2021-06-07 not yet calculated CVE-2020-18268 MISC MISC zoho_manageengine -- key_manager_plus   Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. 2021-06-07 not yet calculated CVE-2021-28382 MISC MISC zope_foundation -- zope   Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.21 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only. 2021-06-08 not yet calculated CVE-2021-32674 CONFIRM MISC MISC MISC zte -- zte   A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE. 2021-06-10 not yet calculated CVE-2021-21735 MISC zte -- zte   A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E 2021-06-10 not yet calculated CVE-2021-21736 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Is Apple’s iCloud Private Relay a VPN? Not Even Close—Here’s Why
Apple's iCloud Private Relay is not a VPN, but Intego Privacy Protection is. Compare the two, and learn why Intego Privacy Protection is the best VPN for Mac. The post appeared first on The Mac Security Blog.

Read more »

New Privacy Features in iOS 15 and macOS Monterey – Intego Mac Podcast Episode 191
Apple introduced its new operating systems this week, and there are plenty of privacy features to help users better control their data. We discuss these new features, and especially a number of important features that Apple didn't discuss at the keynote. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patches Six Zero-Day Security Holes
Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks.

Read more »

Apple Announces New Features in iOS 15, iPadOS 15, and macOS Monterey
Apple announced new features for all its operating systems, to be released this fall. Here's an overview of what to look forward to. The post appeared first on The Mac Security Blog.

Read more »

Apple’s New Privacy Features for iOS 15, iPadOS 15, and macOS Monterey
Apple's forthcoming operating systems - iOS 15, iPadOS 15, and macOS Monterey - feature a number of powerful new privacy features. The post appeared first on The Mac Security Blog.

Read more »

Justice Dept. Claws Back $2.3M Paid by Colonial Pipeline to Ransomware Gang
The U.S. Department of Justice said today it has recovered $2.3 million worth of Bitcoin that Colonial Pipeline paid to ransomware extortionists last month. The funds had been sent to DarkSide, a ransomware-as-a-service syndicate that disbanded after a May 14 farewell message to affiliates saying its Internet servers and cryptocurrency stash were seized by unknown law enforcement entities.

Read more »

Amazon Prime Day Sale: 27″ 5K 6-Core Apple iMacs for $200-$300 off MSRP
Amazon has Apple’s 2020 27″ 5K 6-Core iMacs on sale for $200-$300 off MSRP as part of their Prime Day 2021 sales. Their prices are the lowest available for these 27″ iMacs from any Apple reseller. Shipping is free: – 27″ 5K 3.1GHz 6-Core iMac: $1599.99 $200 off MSRP – 27″ 5K 3.3GHz 6-Core iMac: $1699.99 $300 off MSRP For the latest prices and sales, keep an eye on our iMac Price Tracker, → Read More...

Read more »

Amazon Prime Day 2021 Deal: Get one of Apple’s 10.9″ iPad Airs for up to $90 off
Amazon has Apple 10.9″ iPad Airs on sale for up to $90 off MSRP as part of their Prime Day 2021 deals, each including free shipping. Sale price varies by color, as indicated below: – 10.9″ 64GB WiFi iPad Air Space Gray: $559 $40 off MSRP – 10.9″ 64GB WiFi iPad Air Green: $549.98 $50 off MSRP – 10.9″ 64GB WiFi iPad Air Rose Gold: $539 $60 off MSRP – 10.9″ 64GB WiFi iPad Air Blue: $539 $60 off MSRP – 10.9″ 64GB WiFi iPad Air Silver: $539 $60 off MSRP – 10.9″ 256GB WiFi iPad Air Space Gray: $699 $50 off MSRP – 10.9″ 256GB WiFi iPad Air Green: $669.99 $80 off MSRP – 10.9″ 256GB WiFi iPad Air Rose Gold: $659.99 $90 off MSRP – 10.9″ 256GB WiFi iPad Air Blue: $669.99 $80 off MSRP – 10.9″ 256GB WiFi iPad Air Silver: $669 $80 off MSRP 64GB Cellular-based models are available for as low as $699 ($30 off), while 256GB models are on sale for as low as $829 ($50 off). For the latest prices and sales, keep an eye on our iPad Air Price Tracker, → Read More...

Read more »

Apple launches 2021 Back to School promotion: Free AirPods with select Macs and iPads, plus up to $400 off Macs, $100 off iPads
Apple has launched their Back to School promotion for 2021. As part of this promotion, Apple will include one free pair AirPods (with charging case) with the purchase of a MacBook Air, MacBook Pro, iMac, Mac mini, or Mac Pro. Apple will also include a free pair of Apple AirPods (with charging case) with the purchase of any new iPad Air or iPad Pro (iPad mini and 8th-gen iPad excluded). You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Promotion runs through September 27, 2021. In addition to the free AirPods, purchase a new Mac using Apple’s Education discount, and take up to $400 off MSRP. Purchase an iPad, and take up to $100 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. Parents may also purchase on behalf of a child who is currently in school. Apple’s discount applies to the new Macs & iPads with M1 Apple Silicon CPUs as well as models containing Intel processors. Education discounts are also available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards: – 16″ 2.3GHz 8-Core MacBook Pro: $2599 $200 off – 16″ 2.6GHz 6-Core MacBook Pro: $2199 $200 off – 13″ 2.0GHz/1TB 4-Core MacBook Pro: $1899 $100 off – 13″ 2.0GHz/512GB 4-Core MacBook Pro: $1699 $100 off – 13″ M1 MacBook Pro/512GB: $1399 $100 off – 13″ M1 MacBook Pro/256GB: $1199 $100 off – 13″ M1 MacBook Air/8-Core CPU/7-Core GPU/256GB: $899 $100 off – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB: $1149 $100 off – 8-Core Mac Pro: $5599 $400 off – Pro Display XDR (standard): $4599 $400 off – Pro Display XDR (nano glass): $5599 $400 off – Pro Stand: $5599 $100 off – 24″ 8-Core CPU/8-Core GPU/512GB iMac: $1599

Read more »

Apple’s new 11″ M1 iPad Pros are on sale for up to $100 off MSRP at Sams Club
Sams Club has new 11″ iPad Pros with Apple M1 processors on sale today for $50-$100 off MSRP. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): – 11″ M1 128GB WiFi iPad Pro: $749 $50 off – 11″ M1 256GB WiFi iPad Pro: $849 $50 off – 11″ M1 512GB WiFi iPad Pro: $1049 $50 off – 11″ M1 1TB WiFi iPad Pro: $1429 $70 off – 11″ M1 2TB WiFi iPad Pro: $1799 $100 off – 11″ M1 128GB WiFi + Cellular iPad Pro: $949 $50 off – 11″ M1 256GB WiFi + Cellular iPad Pro: $1049 $50 off – 11″ M1 512GB WiFi + Cellular iPad Pro: $1249 $50 off – 11″ M1 1TB WiFi + Cellular iPad Pro: $1629 $70 off – 11″ M1 2TB WiFi + Cellular iPad Pro: $1999 $100 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Get a pair of Apple AirPods today for $52 off Apple’s MSRP
Amazon has Apple AirPods on sale today for up to $52 off MSRP, starting at $119. Shipping is free: – AirPods Pro: $197 $52 off MSRP – AirPods with Wireless Charging Case: $149.99 $50 off MSRP – AirPods with Charging Case: $119 $40 off MSRP – AirPods Max headphones: As low as $499 $50 off MSRP Their prices are the lowest available for new AirPods anywhere. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Apple restocks M1 Mac minis for as low as $589, Certified Refurbished
Apple has restocked a full line of standard configuration M1 Mac minis in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Note that stock of these models will likely come and go, so be sure to check Apple’s site for the latest stock status. The $589 model is the cheapest M1 Mac currently for sale anywhere. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Apple 13″ M1 MacBook Pros are on sale today for $150-$200 off MSRP, prices start at $1149
Amazon has Apple’s 13″ MacBook Pros with M1 Apple Silicon CPUs on sale for $150-$200 off MSRP today, starting at $1149. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1149.99 $150 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1299.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1149.99 $150 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1299.99 $200 off MSRP Amazon’s prices are currently the lowest available for these models from any Apple reseller. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Amazon is blowing out clearance 2020 21″ 4K iMacs for $400 off Apple’s original MSRPs, starting at $899
Amazon has clearance 2020 21″ 4K 4-Core & 6-Core iMacs on sale today for $400 off Apple’s original MSRP. These are the same iMacs sold by Apple in their retail and online stores. Be sure to make your purchase from Amazon rather than a third-party seller, and note that Amazon’s prices can change at any moment. See their site for the latest stock status: – 21″ 4K 3.6GHz 4-Core iMac: $899.99 $400 off MSRP – 21″ 4K 3.0GHz 6-Core iMac: $1099.99 $400 off MSRP Amazon’s prices are the lowest we’ve ever seen for these models. For the latest prices and sales, see our iMac Price Tracker, → Read More...

Read more »

How iOS 15 Will Help Those Without Sight Interact With And ‘See’ More Details In Photos
FEATURE: 06.14.21 – Seeing the writing on the wall is never a good thing… unless you’re a visually impaired individual looking at a photograph of just that. iOS — Apple’s mobile operating system — will be getting a number of new features which will use, as the company described it, “on-device intelligence” (a.k.a., the Apple Neural Engine) to enhance the user experience while on an Apple smartphone. Announced and previewed by Apple senior Vice President of software engineering, Craig Federighi, at the Cupertino, California-based company’s annual worldwide developers conference, WWDC 2021, the updates are just one of many software-specific upgrades that users of the iPhone can expect to see when the next version, iOS 15, is released later this year. Live Text, which uses “on-device intelligence” to identify text contained within images, is a new feature coming later this year to iOS 15 designed to enhance the user experience while viewing photographs in the Photos app on an iPhone. (Photo: Apple, Inc.) While the new features coming later this year to iOS 15 were not classified by Federighi as being accessibility-oriented in nature, the software upgrades will equally enhance the user experience for sighted users of the iPhone as well as those without sight who also use an Apple smartphone to assist them in their daily lives. **AD: For the lowest prices, best deals, and latest discounts on all Apple products and accessories from Apple and Apple Authorized Resellers? Check out our exclusive and award winning price trackers at MacPrices.net . Pricing updated daily, seven days a week! See What’s In Your Photos These are the new features in iOS 15 that will allow users of the iPhone to interact with the information contained within the images in their camera roll while viewing photographs in the Photos app on their Apple smartphone: Live Text- users will be able to recognize words in photographs (e.g., capturing the phone number from a photograph of a business’s storefront → Read More...

Read more »

Sunday Sale: Clearance 2020 Intel-based Mac mini available for only $499
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $499. These are new, unopened, factory-sealed minis, and they are the cheapest new Mac we could find anywhere: – 3.6GHz 4-core Mac mini: $499 $300 off original MSRP For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Sunday Sale: Clearance 2020 Intel-based Mac mini available for only $499
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $499. These are new, unopened, factory-sealed minis, and they are the cheapest new Mac we could find anywhere: – 3.6GHz 4-core Mac mini: $499 $300 off original MSRP For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Apple’s 24″ M1 iMacs on sale for $50 off MSRP
Amazon has Apple’s new 24″ M1 iMacs on sale this weekend for $50 off MSRP with prices starting at $1249 shipped. At the moment, the $50 discount is restricted to certain colors & configurations, but we’ll update this post if their discount spreads to other colors: – 24″ M1 iMac 8-Core CPU/7-Core GPU Silver: $1249.99 $50 off MSRP – 24″ M1 iMac 8-Core CPU/7-Core GPU Blue: $1249.99 $50 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU Silver: $1449.99 $50 off MSRP For the latest prices & sales, see our iMac Price Tracker, → Read More...

Read more »