Mural Painted Over Boarded-Up Apple Storefront in Portland
Kelly’s “local” Apple Store has been boarded up due to damage, and it has now been painted with a mural. Kelly spoke with the artist to find out more.

Read more »

What that Wi-Fi label at the top of your iPhone means
In a recent column, I explained how to troubleshot Wi-Fi Calling, an option for placing calls over your home or office Wi-Fi network instead of relying on the cellular network. But there’s a confusing part that one reader asked for clarification about.With Wi-Fi Calling enabled and working, a “Wi-Fi” label appears in the upper-left corner of an iPhone or iPad’s status bar. On phones with a notch, it appears when you swipe down to reveal the Control Center.However, the label appears after the name of your cellular carrier. One Canadian reader who has cellular with one company (Telus) and pays for hotspot access with another (Shaw), was concerned that because his phone displayed “Telus Wi-Fi,” he was using the wrong network for his calls.To read this article in full, please click here

Read more »

Instagram copyright just got complicated following a surpris...
A surprise lawsuit ruling means that Instagram copyright matters just got a whole lot more complicated. The case was between Newsweek and a photographer whose work was displayed on Instagram, and the ruling contradicts an earlier one involving Mashable versus another photographer … more… The post Instagram copyright just got complicated following a surprise lawsuit ruling appeared first on 9to5Mac.

Read more »

Dropbox password manager here, but invite-only; uses zero-kn...
A Dropbox password manager has been quietly added to the App Store, but it is currently listed as ‘by invite.’ This means that you can download it, but can’t yet activate it. An Android version is also available on the Play store, subject to the same restriction … more… The post Dropbox password manager here, but invite-only; uses zero-knowledge encryption appeared first on 9to5Mac.

Read more »

Extra! Extra! Read all about it later: How to save web artic...
Even in an always-connected world, we may not be always ready to read something interesting that comes its way. The FOMORS (fear of missing out reading something) once led to a profusion of “read it later” services. These let you easily store an article for later review at your leisure. An article might be a formal piece of journalism, a blog entry, a recipe, or anything page oriented, no matter how long or short.Many services have come and gone, but the two earliest, Pocket and Instapaper, have remained under development and are up to date. Evernote is an alternative, although it’s more of a “junk drawer” service in letting you collect all kinds of things, including clipping web articles, and then offers robust options to search later.To read this article in full, please click here

Read more »

Apple patent filing involves ‘group reading environments�...
Apple has filed for a patent (number 20200175890) for a “device, method, and graphical user interface for a group reading environment.” It involves the use of devices such as the iPad in educational settings.

Read more »

Apple TV+ review: ‘Dear…’ a surprisingly s...
The series, premiering June 5, explores, with limited depth, how famous people like Spike Lee, Oprah and Lin-Manuel Miranda inspired others.

Read more »

Bag bargain Apple Watch refurbs for as little as $129.99 tod...
There couldn’t be a better time to treat yourself to Apple Watch, with Woot now offering refurbished models for as little as $129.99. Series 2 and Series 3 units are available, but this sale is good for today only! We don’t need to tell you how awesome Apple Watch is. But we will say it’s […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Fluance Ai60 Bluetooth speaker review: Large and in charge!
This pair of powered Bluetooth speakers has the look, feel, and sound of a high-end product without a high-end price.

Read more »

Apple TV+ series Dear… looks at ‘game-changing icons’ ...
Dear…, a 10-episode docuseries profiling the likes of Oprah Winfrey, Gloria Steinem, Spike Lee, Lin-Manuel Miranda, Big Bird (!), and others, has debuted on Apple TV+. The show focuses on telling the story of “game-changing icons” and how they have inspired individuals around the world. All 10 episodes are available to watch today, rather than […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

2021 iPhones could take advantage of power-saving Apple Watc...
The iPhone 12 isn’t out yet, but already the supply chain is working to develop new OLED screens for next year’s premium iPhones, claims a report from Digitimes, published Friday. The report notes that these new screens will be made with a special low temperature polycrystalline oxide (LTPO) backplane technology. This could allow Apple to […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

These are the changes Apple Park is making as employees retu...
Just as it has with reopening Apple Stores, Apple is putting protective measures in place to keep employees safe as they return to Apple Park after lockdown. These measures include optional COVID-19 swab testing, temperature checks, closed kitchens, social distancing measures, and an insistence on face masks. Employees began returning to Apple Park from lockdown […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Major Apple component maker Broadcom hints at iPhone 12 dela...
The CEO of chipmaker Broadcom said on Thursday an unnamed “North American mobile phone customer” won‘t be introducing a “next-generation phone” in the third quarter of this year, as it normally does. The release will occur in the fourth quarter instead. This statement from Hock Tan is being widely interpreted to mean this iPhone component […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple supplier Broadcom hints at delayed ‘iPhone 12...
The CEO of Apple supplier Broadcom on Thursday said he expects a revenue bump in wireless sector revenue to arrive one quarter later than usual this year, suggesting 2020's iPhone launch will see a similar delay.

Read more »

iPhone 12 launch delayed to Q4 per major Apple supplier
The CEO of Broadcom, one of Apple’s major suppliers for hardware like iPhone Wi-Fi chips has shared today that it expects Apple’s iPhone 12 lineup to see a delay from the traditional September timeframe to Q4, adding more weight to the idea that it will be October before Apple launches this year’s iPhones. more… The post appeared first on 9to5Mac.

Read more »

Latest Apple Pay deal sees $1 Crispy Chicken Sandwiches at B...
Apple and Burger King are offering customers a unique Apple Pay promo. For a limited time, you can get a Crispy Chicken Sandwich for just $1 when ordering ahead in the Burger King iOS app. more… The post Latest Apple Pay deal sees $1 Crispy Chicken Sandwiches at Burger King appeared first on 9to5Mac.

Read more »

Apple enforces new COVID-19 safety protocols, offers testing...
Apple is taking necessary precautions to protect its workforce as employees slowly return to Apple Park in Cupertino, according to a report on Thursday that outlined the company's plans to avoid the spread of COVID-19.

Read more »

Bloomberg details how Apple Park staff will return during CO...
Apple has been planning a gradual return to work since last month, as the company shut down its corporate operations temporarily due to the COVID-19 pandemic. Now, according to a new Bloomberg report, staff members are now gradually returning to their offices with the company taking measures to prevent the virus from spreading. more… The post Bloomberg details how Apple Park staff will return during COVID-19: elevator limit, masks required, more appeared first on 9to5Mac.

Read more »

Keyboard shortcuts could replicate function keys in upcoming...
Apple is working to add new keyboard shortcuts to an upcoming version of iPadOS, functionality that would allow users to control certain system functions without digging into Control Center or settings.

Read more »

Tripsy lets you organize everything you need to plan a great...
Traveling requires us to think about several details, such as which places we will go first, where those places are located, and what we need to take with us. And if you’re planning a great trip for when this pandemic ends, the Tripsy app for iOS is getting a big update today to make that process easier and more intuitive. more… The post Tripsy lets you organize everything you need to plan a great trip appeared first on 9to5Mac.

Read more »

iPhone Slide Pro concept makes moves Apple never will
A concept artist proposes Apple make a sliding iPhone, not a folding one. The iPhone Slide Pro boasts a second touchscreen that hides behind the primary one. Watch a video of the concept device in action: iPhone Slide Pro was created by iOS Beta News for ConceptsiPhone. The demo video doesn’t show many of the potential […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple testing new shortcuts to change keyboard brightness on...
One of the main complaints about Apple keyboards designed for iPad is that they don’t have function keys, so users need to access the Settings app or the Control Center to adjust things like screen brightness. However, this may change soon, as 9to5Mac has found references in iPadOS 13.5.5 beta code that points to new keyboard shortcuts that replace some of the function keys. more… The post Apple testing new shortcuts to change keyboard brightness on iPad, iPadOS code reveals appeared first on 9to5Mac.

Read more »

Reduce the size of Pages documents for quicker, easier shari...
Worried your hefty Pages document is too big to send? There’s a helpful tool baked right into Pages that can help you make it smaller. Here’s how to use it to make sharing documents quicker and easier. Over the years, Pages has become a fancy, do-it-all word processor that can create almost any document you […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Woz: It’s up to people, not tech, to solve problems like r...
Apple co-founder Steve "Woz" Wozniak told CNBC today that the problems of racism and discrimination cannot be solved by technology… The post Woz: It’s up to people, not tech, to solve problems like racism and discrimination appeared first on MacDailyNews.

Read more »

New Notchless iPhone 13 Mockup Emerges
A new 3D-printed iPhone mockup has emerged, showing the notch may be nixed, It came from Japanese site Macotakara. It also has a USB-C port. Cult of Mac has a good rundown in English and notes that if such a design does become reality, we may not see it until 2021 i.e. it’s the iPhone 13.

Read more »

Linuxfx 10: A Smart, Easy Way to Transition From Windows
Linuxfx 10 could provide businesses and consumers with a Windows 7-like experience that puts users on a smooth downhill path to Linux adoption. Distributions that tweak styles and desktop environment settings to create a Windows-clone type of familiar experience are now numerous, but they often fail to entice reluctant users to stay the course and remain with Linux.

Read more »

Kids in U.S. UK, and Spain Spending Nearly as Much Time on T...
Children in the U.S., UK, and Spain are now spending nearly as much time watching TikTok videos as they are watching clips on YouTube. That’s according to new data from Qustodio, reported on by Techcrunch. Kids ages 4 to 15 now spend an average of 85 minutes per day watching YouTube videos, compared with 80 minutes per day spent on TikTok. The latter app also drove growth in kids’ social app use by 100% in 2019 and 200% in 2020, the report found. The data in the annual report by digital safety app maker Qustodio was provided by 60,000 families with children ages 4 to 14 in the U.S., U.K., and Spain, so it’s data isn’t representative of global trends. The research encompasses children’s online habits from February 2019 to April 2020, takes into account the COVID-19 crisis, and specifically focused on four main categories of mobile applications: online video, social media, video games, and education.

Read more »

Apple TV+ could be in for a surge in subscribers
Apple‘s streaming video service hasn’t taken the world by storm. But an analyst predicts strong growth in coming years will push Apple TV+ to over 100 million paid subscribers by 2025. Samik Chatterjee from J.P. Morgan points out the service’s catalogue keeps getting bigger, with Apple willing to invest plenty of money to continue that […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple patent reveals ‘head-mounted display device with vis...
Apple has been granted a U.S. patent for a "head-mounted display device with vision correction" that suggests work on "Apple Glass" smartglassest… The post Apple patent reveals ‘head-mounted display device with vision correction’ appeared first on MacDailyNews.

Read more »

Elon Musk: ‘Time to Break up Amazon’
Elon Musk doesn’t like monopolies. He also appears to not like Amazon, if his latest tweets, reported on by Bloomberg News, are anything to go by. They included his declaration that it’s “time to break up Amazon.” “Monopolies are wrong,” Musk tweeted while tagging Bezos, the world’s wealthiest man. Musk’s post came in response to a tweet from a writer who said his book titled “Unreported Truths About COVID-19 and The Lockdown” was being removed from Amazon’s Kindle publishing division for violating unspecified guidelines. With more than 35 million followers, Musk is a prolific tweeter. He has been criticized in the past for his posts on various subjects ranging from the coronavirus outbreak to Tesla stock. Amazon didn’t immediately respond to requests for comment.

Read more »

Understanding the System Information App
The System Information app on your Mac is a great tool to tell you about its innards, and can be a big help when troubleshooting.

Read more »

Polymorphic Viruses – Intego Mac Podcast Episode 138
We begin by learning how Josh got interesting in computer security. We then discuss Apple patches and flaws, end-to-end encryption, coronavirus scams, a Google lawsuit, and a photo that can crash Android phones.

Read more »

Romanian Skimmer Gang in Mexico Outed by KrebsOnSecurity Sto...
An exhaustive inquiry published today by a consortium of investigative journalists says a three-part series KrebsOnSecurity published in 2015 on a Romanian ATM skimming gang operating in Mexico's top tourist destinations disrupted their highly profitable business, which raked in an estimated $20 million a month and enjoyed the protection of top Mexican authorities.

Read more »

REvil Ransomware Gang Starts Auctioning Victim Data
The criminal group behind the REvil ransomware enterprise has begun auctioning off sensitive data stolen from companies hit by its malicious software. The move marks an escalation in tactics aimed at coercing victims to pay up -- and publicly shaming those don't. But it may also signal that ransomware purveyors are searching for new ways to profit from their crimes as victim businesses struggle just to keep the lights on during the unprecedented economic slowdown caused by the COVID-19 pandemic.

Read more »

How to find what software has been automatically updated on ...
It's not easy to see a log of all the software updated on your Mac. We explain where this log is hiding, and how to view it.

Read more »

Vulnerability Summary for the Week of May 25, 2020
Original release date: June 1, 2020  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adminpanel -- adminplanel   Jason2605 AdminPanel 4.0 allows SQL Injection via the editPlayer.php hidden parameter. 2020-05-24 7.5 CVE-2020-13433MISCMISC apache -- kylin   Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation. 2020-05-22 9 CVE-2020-1956MISC aviatrix -- vpn_client   An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters. 2020-05-22 7.5 CVE-2020-13417MISC bosch -- recording_station   Improper Access Control in the Kiosk Mode functionality of Bosch Recording Station allows a local unauthenticated attacker to escape from the Kiosk Mode and access the underlying operating system. 2020-05-27 7.2 CVE-2020-6774MISC cisco -- prime_network_registrar   A vulnerability in the DHCP server of Cisco Prime Network Registrar could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation of incoming DHCP traffic. An attacker could exploit this vulnerability by sending a crafted DHCP request to an affected device. A successful exploit could allow the attacker to cause a restart of the DHCP server process, causing a DoS condition. 2020-05-22 7.8 CVE-2020-3272CISCO cisco -- unified_contact_center_express   A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device. 2020-05-22 10 CVE-2020-3280CISCO cybozu -- cybozu_desktop_for_windows   Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors. 2020-05-25 7.5 CVE-2020-5537JVNMISCMISC dext5 -- dext5_upload A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/. 2020-05-25 7.5 CVE-2020-13442MISC dns-sync -- dns-sync   node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1. 2020-05-28 7.5 CVE-2020-11079MISCCONFIRM kaoni -- ezhttptrans Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download and execute arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution. 2020-05-22 7.5 CVE-2020-7813MISCMISC kaoni -- ezhttptrans   Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC. 2020-05-28 7.5 CVE-2020-7812MISCMISC lenovo -- lj4010dn_devices   A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, preventing subsequent print jobs until the printer is rebooted. 2020-05-28 7.8 CVE-2020-8330CONFIRM lenovo -- lj4010dn_devices   A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted. 2020-05-28 7.8 CVE-2020-8329CONFIRM mozilla -- firefox Incorrect origin serialization of URLs with IPv6 addresses could lead to incorrect security checks. This vulnerability affects Firefox < 76. 2020-05-26 7.5 CVE-2020-12390MISCMISC mozilla -- firefox   Mozilla developers and community members reported memory safety bugs present in Firefox 75. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 76. 2020-05-26 7.5 CVE-2020-12396MISCMISC mozilla -- firefox_and_firefox_esr   The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. 2020-05-26 7.5 CVE-2020-12389MISCMISCMISC mozilla -- firefox_and_firefox_esr   The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 and Firefox < 76. 2020-05-26 7.5 CVE-2020-12388MISCMISCMISCMISC mozilla -- firefox_and_firefox_esr_and_thunderbird   Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. 2020-05-26 10 CVE-2020-12395MISCMISCMISCMISC mozilla -- firefox_and_firefox_esr_and_thunderbird   A buffer overflow could occur when parsing and validating SCTP chunks in WebRTC. This could have led to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. 2020-05-26 7.5 CVE-2020-6831MISCMISCMISCMISC python -- python   An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used. 2020-05-22 7.5 CVE-2020-13388MISCMISCCONFIRM sqlite -- sqlite   ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. 2020-05-27 7.5 CVE-2020-13630MISCMISC sympa -- sympa   Sympa before 6.2.56 allows privilege escalation. 2020-05-27 7.2 CVE-2020-10936MISCMISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/setcfm funcpara1 parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13392MISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetNetControlList list parameter for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13394MISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/saveParentControlInfo deviceId and time parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13393MISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/SetSpeedWan speed_dir parameter for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13391MISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/addressNat entrys and mitInterface parameters for a POST request, a value is directly used in a sprintf to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13390MISCMISC tenda -- multiple_routers   An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi_TD01, AC9 V1.0 V15.03.05.19(6318)_CN, AC9 V3.0 V15.03.06.42_multi, AC15 V1.0 V15.03.05.19_multi_TD01, and AC18 V15.03.05.19(6318_)_CN devices. There is a buffer overflow vulnerability in the router's web server -- httpd. While processing the /goform/openSchedWifi schedStartTime and schedEndTime parameters for a POST request, a value is directly used in a strcpy to a local variable placed on the stack, which overwrites the return address of a function. An attacker can construct a payload to carry out arbitrary code execution attacks. 2020-05-22 7.5 CVE-2020-13389MISCMISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance. 2020-05-27 7.5 CVE-2020-8606MISCMISC ubiquiti -- airmax_xm_and_xw_and_ti_series_devices We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page. 2020-05-26 7.5 CVE-2020-8171MISCMISCMISC vim -- vim   In Vim before 8.1.0881, users can circumvent the rvim restricted mode and execute arbitrary OS commands via scripting interfaces (e.g., Python, Ruby, or Lua). 2020-05-28 10 CVE-2019-20807MISCMISC wordpress -- wordpress   An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled. 2020-05-29 7.5 CVE-2020-13693MISCMISCMISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aviatrix -- controller   An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping. 2020-05-22 5 CVE-2020-13415MISC aviatrix -- controller   An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF. 2020-05-22 6.8 CVE-2020-13412MISC aviatrix -- controller   An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software. 2020-05-22 5 CVE-2020-13414MISC aviatrix -- controller   An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force. 2020-05-22 5 CVE-2020-13413MISC aviatrix -- controller   An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets. 2020-05-22 4.3 CVE-2020-13416MISC axel -- axel An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification. 2020-05-26 4.3 CVE-2020-13614MISCMISC centreon -- centreon   Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the page parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. 2020-05-27 4.3 CVE-2020-10946MISC centreon -- centreon   Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-monitoring/src/toolbar.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. 2020-05-27 4.3 CVE-2020-13628MISC centreon -- centreon   Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to service-monitoring/src/index.php. This vulnerability is fixed in versions 1.6.4, 18.10.3, 19.04.3, and 19.0.1 of the Centreon host-monitoring widget; 1.6.4, 18.10.5, 19.04.3, 19.10.2 of the Centreon service-monitoring widget; and 1.0.3, 18.10.1, 19.04.1, 19.10.1 of the Centreon tactical-overview widget. 2020-05-27 4.3 CVE-2020-13627MISC cisco -- amp_for_endpoints_mac_connector   A vulnerability in the file scan process of Cisco AMP for Endpoints Mac Connector Software could cause the scan engine to crash during the scan of local files, resulting in a restart of the AMP Connector and a denial of service (DoS) condition of the Cisco AMP for Endpoints service. The vulnerability is due to insufficient input validation of specific file attributes. An attacker could exploit this vulnerability by providing a crafted file to a user of an affected system. A successful exploit could allow the attacker to cause the Cisco AMP for Endpoints service to crash, resulting in missed detection and logging of the potentially malicious file. Continued attempts to scan the file could result in a DoS condition of the Cisco AMP for Endpoints service. 2020-05-22 5.8 CVE-2020-3314CISCO cisco -- prime_collaboration_provisioning_software   A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates user input for specific SQL queries. An attacker could exploit this vulnerability by authenticating to the application with valid administrative credentials and sending malicious requests to an affected system. A successful exploit could allow the attacker to view information that they are not authorized to view, make changes to the system that they are not authorized to make, or delete information from the database that they are not authorized to delete. 2020-05-22 6.5 CVE-2020-3184CISCO drupal -- drupal   An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. 2020-05-28 6.8 CVE-2019-6342CONFIRM em-http_request -- em-http-request   EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified. 2020-05-25 6.8 CVE-2020-13482MISC epson -- eb-1470ui_devices An exploitable authentication bypass vulnerability exists in the ESPON Web Control functionality of Epson EB-1470Ui MAIN: 98009273ESWWV107 MAIN2: 8X7325WWV303. A specially crafted series of HTTP requests can cause authentication bypass resulting in information disclosure. An attacker can send an HTTP request to trigger this vulnerability. 2020-05-22 6.4 CVE-2020-6091MISC ffipeg -- ffipeg ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c. 2020-05-24 4.3 CVE-2020-13439MISC ffipeg -- ffipeg ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c. 2020-05-24 4.3 CVE-2020-13438MISC ffipeg -- ffipeg ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c. 2020-05-24 4.3 CVE-2020-13440MISC fork -- fork_cms   Fork before 5.8.3 allows XSS via navigation_title or title. 2020-05-27 4.3 CVE-2020-13633MISC freerdp -- freerdp In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out of bound reads causing memory allocation with random size. This has been fixed in 2.1.0. 2020-05-29 4 CVE-2020-11018CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the server. This is fixed in version 2.1.0. 2020-05-29 5 CVE-2020-11017CONFIRM gnome -- glib-networking In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. 2020-05-28 6.4 CVE-2020-13645MISCMISC grafana_labs -- grafana   Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource. 2020-05-24 4.3 CVE-2020-13430MISCMISCCONFIRM ibm -- business_automation_workflow   IBM Business Automation Workflow 18 and 19, and IBM Business Process Manager 8.0, 8.5, and 8.6 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a vitcim to a phishing site. IBM X-Force ID: 181989 2020-05-29 5.8 CVE-2020-4490XFCONFIRM ibm -- mobilefirst_platform_foundation   IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207. 2020-05-27 5 CVE-2020-4226XFCONFIRM ibm -- mq_for_hpe_nonstop   IBM MQ on HPE NonStop 8.0.4 and 8.1.0 is vulnerable to a privilege escalation attack when running in restricted mode. IBM X-Force ID: 178427. 2020-05-29 4.4 CVE-2020-4352XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect authorization. IBM X-Force ID: 175485. 2020-05-28 4 CVE-2020-4249XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484. 2020-05-28 4 CVE-2020-4248XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. IBM X-Force ID: 175335. 2020-05-28 4 CVE-2020-4231XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 175360. 2020-05-28 5 CVE-2020-4233XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422. 2020-05-28 5 CVE-2020-4244XFCONFIRM ibm -- security_identity_governance_and_intelligence IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 175423. 2020-05-28 5 CVE-2020-4245XFCONFIRM ibm -- security_identity_governance_and_intelligence   IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system. IBM X-Force ID: 175336. 2020-05-28 5 CVE-2020-4232XFCONFIRM ibm -- security_identity_governance_and_intelligence   IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 175481. 2020-05-28 5.5 CVE-2020-4246XFCONFIRM ibm -- spectrum_scale IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178424. 2020-05-27 5 CVE-2020-4350XFCONFIRM ibm -- spectrum_scale IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a privileged authenticated user to perform unauthorized actions using a specially crated HTTP POST command. IBM X-Force ID: 179157. 2020-05-27 4 CVE-2020-4378XFCONFIRM ibm -- spectrum_scale   IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 178423. 2020-05-27 5 CVE-2020-4349XFCONFIRM ibm -- spectrum_scale   IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761. 2020-05-27 4 CVE-2020-4357XFCONFIRM ibm -- spectrum_scale   IBM Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.4 could allow an authenticated GUI user to perform unauthorized actions due to missing function level access control. IBM X-Force ID: 178414 2020-05-27 4 CVE-2020-4348XFCONFIRM ibm -- spectrum_scale   IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 179158. 2020-05-27 5 CVE-2020-4379XFCONFIRM jerryscript -- jerryscript JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation. 2020-05-27 5 CVE-2020-13623MISC jerryscript -- jerryscript   parser/js/js-scanner.c in JerryScript 2.2.0 mishandles errors during certain out-of-memory conditions, as demonstrated by a scanner_reverse_info_list NULL pointer dereference and a scanner_scan_all assertion failure. 2020-05-28 5 CVE-2020-13649MISCMISCMISC jerryscript -- jerryscript   JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data. 2020-05-27 5 CVE-2020-13622MISCMISC joomla! -- joomla!   The XCloner component before 3.5.4 for Joomla! allows Authenticated Local File Disclosure. 2020-05-23 4 CVE-2020-13424MISC kaminari -- kaminari In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1. 2020-05-28 4.3 CVE-2020-11082MISCMISCCONFIRM linux -- linux_kernel   An issue was discovered in the Linux kernel before 5.2. There is a NULL pointer dereference in tw5864_handle_frame() in drivers/media/pci/tw5864/tw5864-video.c, which may cause denial of service, aka CID-2e7682ebfc75. 2020-05-27 5 CVE-2019-20806MISCMISCMISC linux -- linux_kernel   A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP Security Option (CIPSO) protocol's category bitmap into the SELinux extensible bitmap via the' ebitmap_netlbl_import' routine. While processing the CIPSO restricted bitmap tag in the 'cipso_v4_parsetag_rbm' routine, it sets the security attribute to indicate that the category bitmap is present, even if it has not been allocated. This issue leads to a NULL pointer dereference issue while importing the same category bitmap into SELinux. This flaw allows a remote network user to crash the system kernel, resulting in a denial of service. 2020-05-22 5 CVE-2020-10711CONFIRMCONFIRM meinheld -- meinheld meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. 2020-05-22 4.3 CVE-2020-7658MISCMISC monstra -- monstra_cms Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048. 2020-05-22 6.5 CVE-2020-13384MISC mozilla -- firefox   Documents formed using data: URLs in an OBJECT element failed to inherit the CSP of the creating context. This allowed the execution of scripts that should have been blocked, albeit with a unique opaque origin. This vulnerability affects Firefox < 76. 2020-05-26 5 CVE-2020-12391MISCMISC mozilla -- firefox_and_firefox_esr_and_thunderbird   A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. 2020-05-26 6.8 CVE-2020-12387MISCMISCMISCMISC mozilla -- firefox_and_firefox_esr_and_thunderbird   The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. 2020-05-26 4.6 CVE-2020-12393MISCMISCMISCMISC mozilla -- firefox_for_ios   For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25. 2020-05-26 5 CVE-2020-6830MISCMISC mozilla -- thunderbird   By encoding Unicode whitespace characters within the From email header, an attacker can spoof the sender email address that Thunderbird displays. This vulnerability affects Thunderbird < 68.8.0. 2020-05-22 4.3 CVE-2020-12397MISCMISC netgear -- multiple_devices   Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P. 2020-05-28 4.3 CVE-2020-13245MISCMISC netqmail -- netqmail   qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability. 2020-05-26 5 CVE-2020-3811CONFIRMMISCCONFIRM pi-hole -- pi-hole   Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease. 2020-05-29 6.5 CVE-2020-8816CONFIRMMISC pichi -- pichi   The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification. 2020-05-26 4.3 CVE-2020-13616MISCMISC pixel_&_tonic -- craft_cms The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. 2020-05-25 5.8 CVE-2020-13486MISC pixel_&_tonic -- craft_cms   The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. 2020-05-25 6.4 CVE-2020-13485MISCMISC pixel_&_tonic -- craft_cms   An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action. 2020-05-25 6.8 CVE-2020-13458MISC protocol_labs -- aegir   In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1. 2020-05-27 5 CVE-2020-11059CONFIRM puma_gem_for_ruby_on_rails -- puma_gem_for_ruby_on_rails In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This is a similar but different vulnerability from CVE-2020-11076. The problem has been fixed in Puma 3.12.6 and Puma 4.3.5. 2020-05-22 5 CVE-2020-11077MISCCONFIRM puma_gem_for_ruby_on_rails -- puma_gem_for_ruby_on_rails   In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4. 2020-05-22 5 CVE-2020-11076MISCMISCCONFIRM qore -- qore   lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates. 2020-05-26 4.3 CVE-2020-13615MISCMISC red_hat -- undertow A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling. 2020-05-26 6.4 CVE-2020-10719CONFIRM sqlite -- sqlite   SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c. 2020-05-24 5 CVE-2020-13435CONFIRMMISC sqlite -- sqlite   SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c. 2020-05-24 5 CVE-2020-13434MLISTCONFIRMMISCMISC sqlite -- sqlite   SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c. 2020-05-27 5 CVE-2020-13631MISCMISC sqlite -- sqlite   ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query. 2020-05-27 5 CVE-2020-13632MISCMISC teradici -- pcoip_standard_agent_for_windows_and_pcoip_graphics_agent_for_windows Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing an application which acquires that named pipe. 2020-05-28 4.6 CVE-2020-13173CONFIRM trackr -- multiple_devices   TrackR devices through 2020-05-06 allow attackers to trigger the Beep (aka alarm) feature, which will eventually cause a denial of service when battery capacity is exhausted. 2020-05-23 6.8 CVE-2020-13425MISC trend_micro -- interscan_web_security_virtual_appliance A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability. 2020-05-27 6.5 CVE-2020-8605MISCMISC trend_micro -- interscan_web_security_virtual_appliance A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations. 2020-05-27 5 CVE-2020-8604MISCMISC trend_micro -- interscan_web_security_virtual_appliance   A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. 2020-05-27 4.3 CVE-2020-8603MISCMISC ubiquiti -- airmax_xm_and_xw_and_ti_series_devices   We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page. 2020-05-26 4.3 CVE-2020-8170MISCMISCMISC ubiquiti -- airmax_xm_and_xw_and_ti_series_devices   We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device's firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page. 2020-05-26 6.8 CVE-2020-8168MISCMISCMISCMISCMISC wordpress -- wordpress An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The action_builder_content function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser. 2020-05-28 6.8 CVE-2020-13642MISCMISC wordpress -- wordpress   An issue was discovered in the SiteOrigin Page Builder plugin before 2.10.16 for WordPress. The live editor feature did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The live_editor_panels_data $_POST variable allows for malicious JavaScript to be executed in the victim's browser. 2020-05-28 6.8 CVE-2020-13643MISCMISC wordpress -- wordpress   An issue was discovered in the Real-Time Find and Replace plugin before 4.0.2 for WordPress. The far_options_page function did not do any nonce verification, allowing for requests to be forged on behalf of an administrator. The find and replace rules could be updated with malicious JavaScript, allowing for that be executed later in the victims browser. 2020-05-28 6.8 CVE-2020-13641MISCMISC wordpress -- wordpress   The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files, leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077. 2020-05-29 6.5 CVE-2020-12675MISCMISC youhua -- windows_master   In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of service (BSOD) or possibly have unspecified other impact because of not validating input values from IOCtl 0xF1002558 2020-05-29 6.1 CVE-2020-13634MISCMISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info centreon -- centreon   Centreon before 19.10.7 exposes Session IDs in server responses. 2020-05-27 3.3 CVE-2020-10945MISC cisco -- endpoints_linux_connector_software_and_endpoints_mac_connector_software   A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted packet to an affected device. A successful exploit could allow the attacker to cause the Cisco AMP for Endpoints service to crash and restart. 2020-05-22 2.1 CVE-2020-3344CISCO cisco -- endpoints_linux_connector_software_and_endpoints_mac_connector_software   A vulnerability in Cisco AMP for Endpoints Linux Connector Software and Cisco AMP for Endpoints Mac Connector Software could allow an authenticated, local attacker to cause a buffer overflow on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted packet to an affected device. A successful exploit could allow the attacker to cause the Cisco AMP for Endpoints service to crash and restart. 2020-05-22 2.1 CVE-2020-3343CISCO cmsmadesimple -- cms_made_simple   CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name. 2020-05-28 3.5 CVE-2020-13660MISCMISC cybozu -- kinton_mobile_for_android   Android App 'kintone mobile for Android' 1.0.0 to 2.5 allows an attacker to obtain credential information registered in the product via unspecified vectors. 2020-05-29 2.1 CVE-2020-5573MISCMISC cybozu -- mailwise_for_android   Android App 'Mailwise for Android' 1.0.0 to 1.0.1 allows an attacker to obtain credential information registered in the product via unspecified vectors. 2020-05-29 2.1 CVE-2020-5572MISCMISC dell -- client_consumer_and_commercial_docking_stations   Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers. 2020-05-28 2.6 CVE-2020-5357MISC freerdp -- freerdp   An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in ntlm_read_ChallengeMessage in winpr/libwinpr/sspi/NTLM/ntlm_message.c. 2020-05-22 2.1 CVE-2020-13396MISCMISCMISC freerdp -- freerdp   An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) write vulnerability has been detected in crypto_rsa_common in libfreerdp/crypto/crypto.c. 2020-05-22 2.1 CVE-2020-13398MISCMISCMISC freerdp -- freerdp   An issue was discovered in FreeRDP before 2.1.1. An out-of-bounds (OOB) read vulnerability has been detected in security_fips_decrypt in libfreerdp/core/security.c due to an uninitialized value. 2020-05-22 2.1 CVE-2020-13397MISCMISCMISC grafana_labs -- grafana   legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) option. 2020-05-24 3.5 CVE-2020-13429MISCMISC huawei -- p30_smartphones   HUAWEI P30 smartphones with versions earlier than 10.1.0.135(C00E135R2P11) have an improper authentication vulnerability. A logic error occurs when handling NFC work, an attacker should establish a NFC connection to the target phone, and then do a series of operations on the target phone. Successful exploit could allow a guest user do certain operation which is beyond the guest user's privilege. 2020-05-29 2.1 CVE-2020-1798CONFIRM ibm -- jazz_reporting_service   IBM Jazz Reporting Service 6.0.6, 6.0.6.1, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 180071. 2020-05-28 3.5 CVE-2020-4419XFCONFIRM ibm -- planning_analytics_local   IBM Planning Analytics Local 2.0.0 through 2.0.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 176735. 2020-05-29 3.5 CVE-2020-4306XFCONFIRM ibm -- spectrum_scale   IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178762. 2020-05-27 3.5 CVE-2020-4358XFCONFIRM mozilla -- firefox   A logic flaw in our location bar implementation could have allowed a local attacker to spoof the current location by selecting a different origin and removing focus from the input element. This vulnerability affects Firefox < 76. 2020-05-26 2.1 CVE-2020-12394MISCMISC mozilla -- firefox_and_firefox_esr_and_thunderbird   The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP POST data of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in the disclosure of local files. This vulnerability affects Firefox ESR < 68.8, Firefox < 76, and Thunderbird < 68.8.0. 2020-05-26 2.1 CVE-2020-12392MISCMISCMISCMISC netqmail -- netqmail   qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first. 2020-05-26 2.1 CVE-2020-3812CONFIRMMISCCONFIRM ocproducts -- composr   Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration. 2020-05-22 3.5 CVE-2020-8789MISCFULLDISC pixel_&_tonic -- craft_cms An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action. 2020-05-25 3.5 CVE-2020-13459MISC qemu -- qemu   sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process. 2020-05-27 2.1 CVE-2020-13253CONFIRMCONFIRMMISC qemu -- qemu   In QEMU 4.2.0, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation. 2020-05-28 2.1 CVE-2020-13361CONFIRMMISC qemu -- qemu   In QEMU 4.2.0, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user. 2020-05-28 2.1 CVE-2020-13362CONFIRMMISCMISC wordpress -- wordpress The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section, resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI. 2020-05-26 3.5 CVE-2020-13487MISCMISCMISCMISC wordpress -- wordpress   An issue was discovered in the Accordion plugin before 2.2.9 for WordPress. The unprotected AJAX wp_ajax_accordions_ajax_import_json action allowed any authenticated user with Subscriber or higher permissions the ability to import a new accordion and inject malicious JavaScript as part of the accordion. 2020-05-28 3.5 CVE-2020-13644MISCMISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info abb -- device_library_wizard   Insecure storage of sensitive information in ABB Device Library Wizard versions 6.0.X, 6.0.3.1 and 6.0.3.2 allows unauthenticated low privilege user to read file that contains confidential data 2020-05-29 not yet calculated CVE-2020-8482CONFIRM anchore -- engine   In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a valid API request to anchore engine, or if an already added image that anchore is monitoring has its manifest altered to exploit the same flaw. A successful attack can be used to execute commands that run in the analyzer environment, with the same permissions as the user that anchore engine is run as - including access to the credentials that Engine uses to access its own database which have read-write ability, as well as access to the running engien analyzer service environment. By default Anchore Engine is released and deployed as a container where the user is non-root, but if users run Engine directly or explicitly set the user to 'root' then that level of access may be gained in the execution environment where Engine runs. This issue is fixed in version 0.7.1. 2020-05-27 not yet calculated CVE-2020-11075MISCMISCMISCCONFIRM freerdp -- freerdp   In FreeRDP before 2.1.0, there is an out-of-bound read in irp functions (parallel_process_irp_create, serial_process_irp_create, drive_process_irp_write, printer_process_irp_write, rdpei_recv_pdu, serial_process_irp_write). This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11089MISCMISCCONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_NegotiateMessage. This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11088MISCCONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_ntlm_v2_client_challenge that reads up to 28 bytes out-of-bound to an internal structure. This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11086MISCCONFIRM freerdp -- freerdp   In FreeRDP before 2.1.0, there is an out-of-bounds read in cliprdr_read_format_list. Clipboard format data read (by client or server) might read data out-of-bounds. This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11085MISCCONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, there is an out-of-bounds read in rfx_process_message_tileset. Invalid data fed to RFX decoder results in garbage on screen (as colors). This has been patched in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11043CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, an outside controlled array index is used unchecked for data used as configuration for sound backend (alsa, oss, pulse, ...). The most likely outcome is a crash of the client instance followed by no or distorted sound or a session disconnect. If a user cannot upgrade to the patched version, a workaround is to disable sound for the session. This has been patched in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11041CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11040CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, when using a manipulated server with USB redirection enabled (nearly) arbitrary memory can be read and written due to integer overflows in length checks. This has been patched in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11039CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11038CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a read of an invalid array index. Data could be printed as string to local terminal. This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11019CONFIRM freerdp -- freerdp   In FreeRDP less than or equal to 2.0.0, there is an out-of-bound read in ntlm_read_AuthenticateMessage. This has been fixed in 2.1.0. 2020-05-29 not yet calculated CVE-2020-11087MISCCONFIRM huawei -- cloudengine_12800_products   CloudEngine 12800 products with versions of V200R019C00, V200R019C10SPC800, V200R019C00SPC600, V200R019C10; and CloudEngine 6800 products with versions of V200R019C00SPC800 have a denial of service vulnerability. Due to improper memory management, memory leakage may occur in some special cases. Attackers can perform a series of operations to exploit this vulnerability. Successful exploit may cause a denial of service. 2020-05-29 not yet calculated CVE-2020-1870CONFIRM huawei -- e6878-370_products   E6878-370 products with versions of 10.0.3.1(H557SP27C233) and 10.0.3.1(H563SP1C00) have a stack buffer overflow vulnerability. The program copies an input buffer to an output buffer without verification. An attacker in the adjacent network could send a crafted message, successful exploit could lead to stack buffer overflow which may cause malicious code execution. 2020-05-29 not yet calculated CVE-2020-1832CONFIRM huawei -- honor_9x_smartphones   Honor 9X smartphones with versions earlier than 9.1.1.172(C00E170R8P1) have an improper authentication vulnerability. A logic error occurs when handling clock function, an attacker should do a series of crafted operations quickly before the phone is unlocked, successful exploit could allow the attacker to access clock information without unlock the phone. 2020-05-29 not yet calculated CVE-2020-1833CONFIRM huawei -- mate_10_smartphones   HUAWEI Mate 10 smartphones with versions earlier than 10.0.0.143(C00E143R2P4) have an information disclosure vulnerability. The attacker could wake up voice assistant then do a series of crafted voice operation, successful exploit could allow the attacker read certain files without unlock the phone leading to information disclosure. 2020-05-29 not yet calculated CVE-2020-1809CONFIRM huawei -- mate_20_smartphones   HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.195(SP31C00E74R3P8) have an improper authorization vulnerability. The digital balance function does not sufficiently restrict the using time of certain user, successful exploit could allow the user break the limit of digital balance function after a series of operations with a PC. 2020-05-29 not yet calculated CVE-2020-1831CONFIRM huawei -- mate_20_smartphones   HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.185(C00E74R3P8) have an improper authorization vulnerability. The system does not properly restrict certain operation in ADB mode, successful exploit could allow certain user break the limit of digital balance function. 2020-05-29 not yet calculated CVE-2020-1797CONFIRM kantech -- entrapass_editions   A vulnerability in all versions of Kantech EntraPass Editions could potentially allow an authorized low-privileged user to gain full system-level privileges by replacing critical files with specifically crafted files. 2020-05-26 not yet calculated CVE-2020-9046CONFIRMCERT linux -- linux_kernel   A flaw was found in the Linux kernels SELinux LSM hook implementation before version 5.7, where it incorrectly assumed that an skb would only contain a single netlink message. The hook would incorrectly only validate the first netlink message in the skb and allow or deny the rest of the messages within the skb with the granted permission without further processing. 2020-05-26 not yet calculated CVE-2020-10751MLISTCONFIRMCONFIRMCONFIRMCONFIRM micro_focus -- service_management_automation   There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation. 2020-05-29 not yet calculated CVE-2020-11844CONFIRM mulesoft -- mule_ce/ee   A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion. 2020-05-29 not yet calculated CVE-2020-6937CONFIRM oddjob-mkhomedir -- oddjob-mkhomedir   A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein, during the home creation, mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder, which then has its ownership transferred to the new home directory's unprivileged user. 2020-05-27 not yet calculated CVE-2020-10737CONFIRMCONFIRM smartdraw -- smartdraw_2020   In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additionally, when the product is installed, two scheduled tasks are created on the machine, SDMsgUpdate (Local) and SDMsgUpdate (TE). The scheduled tasks run in the context of the user who installed the product. Both scheduled tasks attempt to run the same binary, C:SmartDraw 2020MessagesSDNotify.exe. The folder Messages doesn't exist by default and (by extension) neither does SDNotify.exe. Due to the weak folder permissions, these can be created by any user. A malicious actor can therefore create a malicious SDNotify.exe binary, and have it automatically run, whenever the user who installed the product logs on to the machine. The malicious SDNotify.exe could, for example, create a new local administrator account on the machine. 2020-05-27 not yet calculated CVE-2020-13386MISC swarcos -- cpu_ls4000_series_devices   An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without access control via network. A malicious user could use this vulnerability to get access to the device and disturb operations with connected devices. 2020-05-29 not yet calculated CVE-2020-12493CONFIRM synk-broker -- synk-broker   All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths. 2020-05-29 not yet calculated CVE-2020-7653MISCMISC synk-broker -- synk-broker   All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. 2020-05-29 not yet calculated CVE-2020-7654MISCMISC synk-broker -- synk-broker   All versions of snyk-broker before 4.79.0 are vulnerable to Arbitrary File Read. It allows partial file reads for users who have access to Snyk's internal network via patch history from GitHub Commits API. 2020-05-29 not yet calculated CVE-2020-7651MISCMISC synk-broker -- synk-broker   All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal. 2020-05-29 not yet calculated CVE-2020-7652MISCMISC synk-broker -- synk-broker   All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json. 2020-05-29 not yet calculated CVE-2020-7650MISCMISC synk-broker -- synk-broker   All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json` 2020-05-29 not yet calculated CVE-2020-7648MISCMISC vivotek -- network_cameras   VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to upload and execute a script (with resultant execution of OS commands). For example, this affects IT9388-HT devices. 2020-05-28 not yet calculated CVE-2020-11950CONFIRM vivotek -- network_cameras   testserver.cgi of the web service on VIVOTEK Network Cameras before XXXXX-VVTK-2.2002.xx.01x (and before XXXXX-VVTK-0XXXX_Beta2) allows an authenticated user to obtain arbitrary files from a camera's local filesystem. For example, this affects IT9388-HT devices. 2020-05-28 not yet calculated CVE-2020-11949CONFIRM vmware -- multiple_products   VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed. 2020-05-29 not yet calculated CVE-2020-3957CONFIRM vmware -- multiple_products   VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.5.2) and VMware Fusion (11.x before 11.5.2) contain a denial-of-service vulnerability in the shader functionality. Successful exploitation of this issue may allow attackers with non-administrative access to a virtual machine to crash the virtual machine's vmx process leading to a denial of service condition. 2020-05-29 not yet calculated CVE-2020-3958CONFIRM vmware -- multiple_products   VMware ESXi (6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG), VMware Workstation (15.x before 15.1.0) and VMware Fusion (11.x before 11.1.0) contain a memory leak vulnerability in the VMCI module. A malicious actor with local non-administrative access to a virtual machine may be able to crash the virtual machine's vmx process leading to a partial denial of service. 2020-05-29 not yet calculated CVE-2020-3959CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Career Choice Tip: Cybercrime is Mostly Boring
When law enforcement agencies tout their latest cybercriminal arrest, the defendant is often cast as a bravado outlaw engaged in sophisticated, lucrative, even exciting activity. But new research suggests that as cybercrime has become dominated by pay-for-service offerings, the vast majority of day-to-day activity needed to support these enterprises is in fact mind-numbingly boring and tedious, and that highlighting this reality may be a far more effective way combat cybercrime and steer offenders toward a better path.

Read more »

Learn How to Use the Secret Features of the iPad and iPhone ...
Control Center is a practical feature in iOS. But did you know that behind many of the buttons and sliders are hidden features?

Read more »

Apple operating system updates, iPhone & iPad storage, a...
Apple updated all its operating systems again this week, but a jailbreak vulnerability was found quickly. We discuss the new contact tracing feature in iOS, how to free up storage on an iOS device, and give some tips on shooting video on an iPhone. You’re saying it wrong: How to say oft-mispronounced tech terms Jailbreak […]

Read more »

UK Ad Campaign Seeks to Deter Cybercrime
The United Kingdom's anti-cybercrime agency is running online ads aimed at young people who search the Web for services that enable computer crimes, specifically trojan horse programs and DDoS-for-hire services. The ad campaign follows a similar initiative launched in late 2017 that academics say measurably dampened demand for such services by explaining that their use to harm others is illegal and can land potential customers in jail.

Read more »

Free up space on your iPhone or iPad by offloading apps
Increasingly, Apple devices have fixed internal storage you cannot expand. With Macs, this can be an inconvenience, but it’s usually possible to offload data to external drives. On iOS, that’s not the case. And although you can make use of cloud storage for documents, you’re stuck when apps and games are taking up precious space. […]

Read more »

Apple restocks 27″ iMacs, Certified Refurbished, for up to...
Apple has restocked Certified Refurbished 2019 27″ iMacs starting at $1529 and up to $350 off the cost of new models. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are available: – 27″ 6-Core 3.7GHz iMac (MRR12LL/A): $1949 $350 off MSRP – 27″ 6-Core 3.6GHz iMac (MRR02LL/A): $1699 $300 off MSRP – 27″ 6-Core 3.0GHz iMac (MRQY2LL/A): $1529 $270 off MSRP Their prices are the cheapest available for 2019 27″ iMacs anywhere. For more information, see our iMac Price Tracker, → Read More...

Read more »

Apple’s new 2020 13″ 4-Core MacBook Airs on sale today f...
B&H Photo has Apple’s new 2020 13″ 4-Core MacBook Airs on sale today for $100 off Apple’s MSRP, only $1199. Expedited shipping is free to many addresses in the US. The MacBook Airs are the same models sold by Apple in their retail and online stores: – 13″ 4-Core Space Gray MacBook Air: $1199 $100 off MSRP – 13″ 4-Core Silver MacBook Air: $1199 $100 off MSRP – 13″ 4-Core Gold MacBook Air: $1199 $100 off MSRP Amazon has these models on sale for $100 off Apple’s MSRP as well. Note that Amazon’s stock (and prices) can vary: – 13″ 4-Core Space Gray MacBook Air: $1199 $100 off MSRP – 13″ 4-Core Silver MacBook Air: $1199 $100 off MSRP – 13″ 4-Core Gold MacBook Air: $1199 $100 off MSRP Keep an eye on our 13″ MacBook Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

New Verizon promo: $150 off any Apple Watch with purchase of...
Verizon is offering $150 off any Apple Watch when purchased alongside an iPhone through June 10, 2020. They’re also offering up to $100 on any Apple Watch trade-in. Here are the details: “Get $150 off Apple Watch when you buy with an Apple iPhone. (1) Add an Apple Watch and Apple iPhone with monthly device payments to your cart. (2) Activate the watch or smartphone on a new line of service. (3) Your promo credit will be applied to your account over 24 mos. w/in 1-2 cycles. Up to $799.99 device payment watch purchase and smartphone device payment purchase req’d. Less $150 promo credit + $100 trade-in/promo credit applied over 24 mos.; promo credit ends if eligibility requirements are no longer met; 0% APR. Trade-in conditions apply. For 1st month after activation, monthly line access fee promo credit on single connected devices on Shared Plans (or plan access fee for Unlimited plans) will be applied as bill credit w/in 1-2 cycles.” Verizon’s deal is live on their → Read More...

Read more »

Last year’s 13″ 2.4GHz MacBook Pros are available today ...
Apple has Certified Refurbished 2019 13″ 2.4GHz/256GB 4-Core Touch Bar MacBook Pros available for $1359, $440 off original MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 2.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1359 $440 off original MSRP – 13″ 2.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1359 $440 off original MSRP Apple refurbished prices are the cheapest available for these MacBook Pros anywhere. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Apple’s new 2020 13″ MacBook Pros on sale for up to $140...
Apple reseller Abt Electronics has new 2020 13″ MacBook Pros on sale today for up to $140 off MSRP, starting at $1208. Shipping is free, and most configurations are in stock today. Note that Abt’s prices are dynamic, and they change from the sale price listed below to full MSRP twice a day. For the most part, the sale price is active during the afternoon and evening hours in the US: – 2020 13″ 1.4GHz/256GB MacBook Pro Space Gray: $1299 – 2020 13″ 1.4GHz/256GB MacBook Pro Silver: $1208 $91 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Space Gray: $1394 $105 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Silver: $1394 $105 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1673 $126 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1679 $120 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1859 $140 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1859 $140 off MSRP These are the same MacBook Pros sold by Apple in their retail and online stores. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple CEO Reacts To Nationwide Protests Over Racial Injustic...
NEWS: 06.03.20 – With the recent death of a black man in the custody of a white police officer igniting outrage among Americans from all walks of life, which resulted in protests and civil unrest across the country over the weekend, Apple was quick to react in solidarity to the events lending support to the demonstrations despite suffering property damage and loss in a number of its U.S. retail store locations at the hands of looters whose actions, in most cases, were unrelated to the message being sent calling for change. On Sunday, CNBC published on its website a full transcript of an email addressed to the team from Apple CEO, Tim Cook, in regard to the death of George Floyd which was sent out to employees that same day. In its report, the business news oriented cable news channel — which obtained a copy of the electronic correspondence (its source was not cited) — detailed how the chief executive officer condemned the killing and called for the creation of a more just world for everyone. Apple Walnut Street in Philadelphia, Pennsylvania, seen here in this undated photograph with visitors milling about in and out of the store, was looted during nationwide protests which ramped up over the weekend in response to the death of George Floyd while in the custody of a Minnesota, Minneapolis police officer. (Photo: Sar A. / Yelp) “Right now, there is a pain deeply etched in the soul of our nation and in the hearts of millions,” wrote Cook. “To stand together, we must stand up for one another, and recognize the fear, hurt, and outrage rightly provoked by the senseless killing of George Floyd and a much longer history of racism. That painful past is still present today. Not only in the form of violence, but in the everyday experience of deeply rooted discrimination. We see it in our criminal justice system… While our laws have changed, the reality → Read More...

Read more »

At up to $420 off MSRP, these Certified Refurbished models a...
Apple has Certified Refurbished 2019 16″ MacBook Pros available for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple restocks refurbished 3rd generation 12.9″ iPad Pros ...
Apple restocked select 3rd generation 12.9″ WiFi iPad Pros starting at only $699 and up to $330 off original MSRP. Each iPad comes with a standard Apple one-year warranty, outer cases are new, and shipping is free. The following configurations are available: – 12.9″ 64GB WiFi iPad Pro: $699 $300 off original MSRP – 12.9″ 512GB WiFi iPad Pro: $999 $300 off original MSRP – 12.9″ 1TB WiFi iPad Pro: $1169 $330 off original MSRP Apple’s refurbished prices are the cheapest available for these models anywhere. Note that stock may change at any time. Keep an eye on our 11″ iPad Pro Price Tracker and 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

These wireless carriers are offering Apple’s new 2020 iPho...
Looking for a deal on Apple’s new iPhone SE? Apple itself offers the unlocked 64GB iPhone SE for $399 or $16.62/month. If you’re willing to try a new carrier, two of Apple’s wireless carriers are offering the iPhone SE for only $5 per month, with service contract. Here are the details: (1) Sprint is offering Apple’s new 2020 64GB iPhone SE for $5 per month for 18 months. New line of service required, but there is no trade-in requirement. As a bonus, Sprint will include free overnight shipping. The fine print: “Get the all-new iPhone SE for just $5/mo. and enjoy free next-day shipping on your order. iPhone SE $5/mo. after $11.67/mo. credit, applied within two bills. With approved credit, 18-month lease & new line of service. If you cancel early, remaining balance due. Offer ends 5/14/2020. Order by 1 p.m. ET Mon-Fri, get it the next business day.” This deal is live at Sprint today. (2) AT&T is offering the new 2020 Apple 64GB iPhone SE for as low as $5 per month for new lines of service. Payments are spread monthly over a 30 month contract. Upgrades are available for $10/month. The fine print: “iPhone SE 64GB for $5/mo. offer: Get the all new iPhone SE 64GB for $5/mo., 128GB for $10/mo. or 256GB for $15/mo. for 30 mos. when you buy it on a qualifying installment agreement with eligible wireless. You’ll need to: – Purchase an iPhone SE 64GB, 128GB or 256GB on a qualifying installment agreement. – Add a line to a new or existing account. – Pay taxes on the full retail price up front. – Activate postpaid unlimited wireless service (min. $75/mo. for new unlimited customers before discounts. Existing customers can add to eligible existing unlimited plans, which may be less). AT&T may temporarily slow data speeds if the network is busy. – Pay a $30 activation fee. Note: Requires a qualifying 0% APR installment agreement (30-mo. term at up to $18.34/mo.) Other installment options may be available and vary by location. If buying on the AT&T Installment Plan with Next Up, customer is responsible and → Read More...

Read more »

Save $80 on the 64GB 10.5″ iPad Air with this $419 Certifi...
Apple has 10.5″ 64GB WiFi iPad Airs models available for $80 off MSRP, Certified Refurbished. Each iPad comes with Apple’s standard one-year warranty and includes a new outer case. Shipping is free: – 10.5″ 64GB WiFi iPad Air: $419 $80 off MSRP Their price is the cheapest available for an iPad Air from any Apple reseller. For the latest prices and sales, see our 10.5″ iPad Air Price Tracker, → Read More...

Read more »

Apple offers wide range of refurbished custom Mac Pros with ...
Save up to $7740 on a custom-configured Mac Pro with these Certified Refurbished models available at Apple. Each Mac Pro features a new outer case, free shipping, and includes Apple’s standard 1-year warranty. You won’t find cheaper custom configurations anywhere else. Stock is likely to come and go, so check their site for current availability. See our Mac Pro Price Tracker for the latest prices & deals from Apple’s resellers, updated daily: – 3.5GHz 8-Core, 48GB RAM, 256GB SSD, Radeon Pro 580X/8GB:$5349 Apple Certified Refurbished $950 off MSRP – 3.5GHz 8-Core, 48GB RAM, 1TB SSD, Radeon Pro 580X/8GB:$5689 Apple Certified Refurbished $1010 off MSRP → Read More...

Read more »

Sale! $200 off on select 2020 13″ MacBook Pros
Amazon has select 2020 13″ MacBook Pro configurations on sale today for $200 off Apple’s MSRP. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 1.4GHz/512GB MacBook Pro Space Gray: $1299.99 $200 off MSRP – 2020 13″ 1.4GHz/512GB MacBook Pro Silver: $1299.99 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1799.99 $200 off MSRP For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »