B&H launches early Black Friday sale: Up to $400 off new MacBooks, iPads, iMacs
B&H's early Black Friday Sale is live — and Apple products, including 2021 14-inch and 16-inch MacBook Pros, are up to $400 off instantly. Supplies are limited, and the deals may sell out ahead of the Thanksgiving weekend.New Apple deals at B&H Read more...

Read more »

Claris FileMaker Pro updated with Shortcuts support, more
Apple susbsidiary Claris this week issued an update for its flagship FileMaker Pro software with a slew of new features and enhancements, including Shortcuts for macOS Monterey.In macOS Monterey, FileMaker Pro 19.4.1 brings Shortcuts support to the Mac version of Claris' low-code software development tool for the first time. Using the Script Workspace, users can designate which FileMaker scripts within a FileMaker Pro file to hand over to Shortcuts, then use Siri or the Shortcuts app to open the file, run a script or pass in an optional parameter.Shortcuts has been available to FileMaker Go since version 19 launched on iOS in 2020. Read more...

Read more »

Third-party iPhone 13 screen repairs back on the table with iOS 15.2 beta
Apple appears to be making good on promises to remove barriers to third-party https://appleinsider.com/inside/iphone-13" >iPhone 13 screen repairs, with experts saying a parts swap can be performed on the latest iOS 15.2 beta with relative ease.Shortly after iPhone 13 launched, reports from repair specialists revealed that attempts to replace the handset's display would result in disabled Face ID modules. This was in spite of a design change that separated the Face ID array from its usual place on iPhone's screen.It was later learned that a microcontroller attached to the display pairs, or serializes, a screen with its host iPhone, hindering unauthorized repairs or replacements. Apple Authorized Service Providers are able to sync new displays with iPhone 13 bodies using specialized software, while third-party firms would need to move the original chip over to a new screen in a complex and risky process. Read more...

Read more »

Popular macOS file extractor ‘Pacifist’ gets major update with Apple Silicon support, Swift 5, more
Pacifist is a popular file extractor for macOS that lets users view and extract multiple file formats, including PKG, DMG, XAR, and TAR. The app recently received a major update with Pacifist 4.0, which brings Apple Silicon support, Swift 5 code, a redesigned interface, and more. more… The post appeared first on 9to5Mac.

Read more »

mSpy Mobile Phone Tracker with a lifetime subscription drops to $99
iLounge has a special deal on the mSpy Mobile Phone Tracker Lifetime Subscription, which allows you to track your family’s activity across the worldwide ... Read more The post appeared first on iLounge.

Read more »

Latest Apple Pay promo nets savings on cards from Snapfish
Apple aired its latest Apple Pay promotion on Tuesday, announcing a special discount and free lowest-price shipping on cards ordered from Snapfish.Detailed in an email to Apple Pay users, the deal nets customers 76% off all cards when applying the code APPLEPAY at checkout in the Snapfish app or on snapfish.com. Free lowest-price shipping is also included with the offer, which ends on Nov. 22.According to Apple, the offer applies to the lowest-price U.S. shipping option and cannot be used toward upgraded shipping methods. The promotion is further restricted to mail order purchases and is not applicable to in-store pickup. Read more...

Read more »

TP-Link’s Deco X90 Wi-Fi 6 Mesh System is Down to $360
WiFi 6 and mesh technology come together to provide a wide and expansive internet connection regardless of household size. Today, the TP-Link Deco Tri-Band ... Read more The post appeared first on iLounge.

Read more »

Apple Arcade to launch Disney Melee Mania in December
Apple’s gaming platform is set to receive a Disney mobile game next month. Disney Melee Mania is a MOBA, or multiplayer online battle arena ... Read more The post appeared first on iLounge.

Read more »

Prime Video native app for Mac gets released
Mac users will now be able to download a native app of Amazon Prime Video through the Mac App Store. Amazon already has a ... Read more The post appeared first on iLounge.

Read more »

Apple to extend 0% Apple Card financing amid purchase confusion
Apple has sent out emails to Apple Card customers who were expecting their purchases to be eligible for Apple Card Monthly Installments. Apple Card ... Read more The post appeared first on iLounge.

Read more »

Accompany Your AirTag with the Official AirTag Loop for Just $22
There’s nothing quite like a first-party accessory for an Apple product. For AirTag owners, there’s the official AirTag Loop which is priced at just ... Read more The post appeared first on iLounge.

Read more »

Meta and Apple set to compete in the AR, home and wearables market
Apple and competitor Meta are set to face off against each other in the smart home, wearables and augmented reality market. Mark Gurman of ... Read more The post appeared first on iLounge.

Read more »

Apple exercises strict control over Apple Wallet ID
Recent documents have revealed that Apple holds a tight leash on its Apple Wallet digital ID feature. Apple Wallet ID integration is set to ... Read more The post appeared first on iLounge.

Read more »

Apple the ‘Mystery Tenant’ in Boulder property listing
A report from Boulder Daily Camera suggests that Apple might be occupying a property in the Boulder, Colorado region. The Daily Camera notes how ... Read more The post appeared first on iLounge.

Read more »

Evidence of 'SportsKit' framework discovered in iOS and tvOS
Code in Apple's latest iOS beta versions reference a new framework called "SportsKit," suggesting the company is planning an earnest push into sports media and enhanced information delivery.Discovered by 9to5Mac in iOS releases dating back to iOS 15.2, "SportsKit" is a new framework for iOS and tvOS apps that currently connects to Siri, the Apple TV app and home screen widgets.Not much is known about "SportsKit" beyond its presence in developer betas, though the publication was able to suss out a capability that enables a home screen widget to display sports scores and updates in real time. Siri has for years supported box scores and the new framework could expand those interactions into new areas of iOS, the report said. Read more...

Read more »

Big Tech critic Jonathan Kanter to lead DOJ antitrust division
The U.S. Senate confirmed noted Big Tech critic and competition lawyer Jonathan Kanter to Assistant Attorney General of the Department of Justice's Antitrust Division, another win for progressives looking to push competition reform.Kanter was nominated for the role by President Joe Biden in July, with the Senate confirming the pick in a bipartisan 68-29 vote on Tuesday, reports The Wall Street Journal.After a start with the Federal Trade Commission, Kanter spent some 20 years representing corporate clients including Microsoft and Yelp, which both lodged anti-competition cases against Google. The search giant currently faces an antirust lawsuit from the Justice Department. Apple is also in the DOJ's crosshairs, and Kanter was hired as legal counsel by Apple Music competitor Spotify, reports CNBC. Read more...

Read more »

Craig Federighi’s Sideloading Keynote at Web Summit
If Apple stopped making it look like they’re running the App Store to maximize their own revenue from it, regulators and lawmakers might stop thinking that Apple is running the App Store to maximize their own revenue from it.

Read more »

Apple developing new ‘SportsKit’ framework as it invests in sports content for Apple TV
It’s no secret at this point that Apple is becoming more interested in the sports segment, as the company has been investing and hiring related professionals to work in its TV division. 9to5Mac has now found evidence to support these rumors, including a new “SportsKit” framework for iOS and tvOS apps. more… The post appeared first on 9to5Mac.

Read more »

Sleep Technology Meets the Smart Home with ReST
Sleep is one of the most important factors in overall health and well-being. We don’t get nearly enough of it, though. Sometimes we don’t even realize how poorly we’re sleeping until things are really out of hand. The tech industry has gone all-in to help, even developing sleep aid robots. Now, though, the ReST smart bed takes sleep technology and smart home ideas even further. A Smart Bed, You Ask? Yes, Indeed I was skeptical when I first heard about smart bed technology, even though I consider myself a tech advocate. When I looked at what’s involved in the ReST smart bed, though, I decided I had to try it for myself. This bed is part memory foam mattress, part air mattress. The ultimate model adds GelGrid technology for even more comfort. At its core, though, is the air mattress technology. ReST mattresses have either three or five air pockets, depending on the model you purchase. These air pockets correspond to different parts of your body: your shoulders, lumbar, and hips for three-zone mattresses. The five-zone mattresses are customizable for your head, shoulders, lumbar, hips, and legs. Medical-grade air pumps (two for mattresses queen-sized and larger) inflate and deflate these zones to keep you comfortable. A sensor mat delivers real-time body pressure mapping so the bed can automatically adjust firmness based on your position and individual pressure points. The “Anatomy” and Sleep Technology in a ReST Smart Bed For the record, the model the company provided me for review purposes is a queen-sized ReST Original Smart Bed with GelGrid. That’s the one I’ll be discussing, but other options are available that could be lighter or heavier on your wallet. To recap, this mattress has five adjustable body zones to customize your comfort. The air chambers are medical-grade polyurethane, and the seams are RF welded to prevent air leaks. Above the air chambers sits the sensor mat keeps track of how much pressure your body is experiencing. It reads 2,000 points of data across the surface of the bed, feeding that information to the air pumps. Atop the pressure mat, mine includes the ReST Gel Grid to eliminate pressure and promote air flow. Next, the “sleep skin” helps keep you cool and wicks away moisture. This component is removable and machine washable. The air pumps are also medical-grade, and can connect to your home’s WiFi. Note, they don’t have to, and can instead create their own WiFi hotspots. Inside the ReST app, sleep technology goes to work, connecting to the air pumps to set your comfort level. You can even choose to view and track information about your sleep performance. Yes, But Is It Comfortable? My ReST mattress is hands-down the most comfortable I’ve ever enjoyed. Depending on your comfort preferences, you can set each air chamber’s firmness manually or have the pumps automatically adjust based on your firmness preferences. A nearly-realtime heat map even shows how much pressure your body is experiencing. There’s also an option called Position. With this configuration, you can set different firmnesses for the five body zones, but not just a “one size fits all” setting. When you use Position mode, you set your body zones separately for side and back sleeping. During the night, as you switch from side to back, the mattress automatically adjusts to your position. Overall, sleeping on the ReST smart bed has to be the closest I can come to extreme comfort. I literally feel the bed molding itself to my body, whether I’m on my side or my back. The air pump does make some noise, which is interesting to listen to as I drift off. It’s never once awakened me, though, because it is extremely quiet. Experiencing Smart Sleep Technology Honestly, the app is the only weak point to this bed. It’s feature-rich, and offers more insight into your sleep health than anything I’ve seen before. The beta Night Vision portion of the app keeps track of your sleep cycles, sleep duration, and the efficiency of your sleep. It also tracks your restless movements and even your breathing, which is both cool and frightening at the same time. In the future, ReST plans on integrating this data with the Apple Health app, but that support isn’t available yet. Even without HealthKit, the sleep technology built into the app is definitely top-notch. However, it's not perfect. The downside to the app is that it’s occasionally glitchy. It will lose communication with the air pumps, and I’ve no choice but to force-quit the app and relaunch it. That’s a very minor issue, though, and one the developers are aware of and working to resolve. I think, in our privacy-minded times, it’s important to reiterate that the ReST Smart Bed does not have to be connected to the Internet. You can, instead, simply use the built-in WiFi networks the air pumps create on setup. Obviously, this will make adjusting your settings more work, but the option is definitely viable. Nitty-Gritty Post-Sales Details ReST offers very generous terms for evaluating the bed and keeping it in tip-top shape for the future. The company provides a 90-day money-back guarantee trial period. The bed is also covered by a 10-year non-prorated warranty. If any components of the bed fail under normal use, ReST will replace it at no cost (not even shipping) for 10 years. For a limited time, ReST is offering a Black Friday sale. You can get $500 off your bed, and a free Malouf adjustable base.

Read more »

Walkie Talkie and Wembley Fraggle – TMO Daily Observations 2021-11-16
Jeff Butts joins host Kelly Guimont to discuss a forgotten Apple Watch feature and look forward to new Apple TV content…down at Fraggle Rock.

Read more »

iOS 15 hidden features you’ll wish you tried sooner
Beneath the iOS 15 tentpoles, there are always hidden features that Apple doesn't talk about much or, sometimes, at all. Often, it's these… The post appeared first on MacDailyNews.

Read more »

Beats partners with Fragment Design on limited edition Beats Flex
Beats on Tuesday unveiled its latest limited edition headset in a black-on-black Beats Flex model created in partnership with Fragment Design.Teased by Apple's Beats arm in a post to Twitter, the all black Flex follows marks the brand's second collaboration with Fragment for 2021. The first, a similarly spartan black PowerBeats Pro design, debuted in January."The design inspiration is a continuation of our last collaboration, as I still believe nothing is as sophisticated and refined as the black-on-black colorway," Fragment founder Hiroshi Fujiwara said of the new Flex, according to Complex. "My personal headphone preference is Beats Flex, as I like the lightweight neckband for listening to music. I hope people can wear and use this on a daily basis." Read more...

Read more »

Beats announces special edition Flex earbuds in partnership with Hiroshi Fujiwara and SSENSE
Beats announced this week a new special edition of its Beats Flex earbuds in partnership with Japanese musician and designer Hiroshi Fujiwara and fashion retailer SSENSE. Based on the same hardware as the original Beats Flex, the special edition features a “minimalist, tonal black design.” more… The post appeared first on 9to5Mac.

Read more »

Say goodbye to snoring with this custom-molded mouthpiece
Your snoring doesn’t need to wake you, your partner or your roommates anymore. A custom-fit VitalSleep Anti-Snoring Mouthpiece can give you a snoreless slumber. And during our Pre-Black Friday Sale, it’s on sale for just $59.97 (regularly $99). That’s a fraction of what CPAP machines and other anti-snoring devices cost. How to stop snoring About […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Netflix to release weekly report detailing viewership, most popular content
Netflix has reversed course on its secrecy surrounding viewer metrics and will begin publishing a weekly report detailing its most popular TV shows and movies.Credit: NetflixThe updates will be published every Tuesday on a dedicated webpage. The stats will offer details on how many viewing hours specific titles have accumulated across the globe, as well as the overall most popular programming. Read more...

Read more »

Hands-on: Hyper Triple 4K Display Dock for MacBook Pro [Video]
The Hyper Triple 4K Display Dock is a brand new dock for MacBook users that allows your laptop to connect to up to three external displays at 4K 60Hz. The dock, which sits neatly underneath your MacBook Pro, features up to 15 ports. For a limited time, Hyper’s I/O-laden Triple 4K Display Dock can be purchased for 50% off. Watch our hands-on video walkthrough for the details. more… The post appeared first on 9to5Mac.

Read more »

A signal from an iPad saved missing dad and daughter after small plane crash in Pennsylvania
A man and his daughter were missing for hours, but investigators say they were able to locate them thanks to a signal from an iPad … The post appeared first on MacDailyNews.

Read more »

How to use the new password manager and 2FA features in macOS Monterey
9to5Mac is brought to you by CleanMyMac X. Find hidden junk, large old folders, unused apps, and heavy memory consumers. You can also use CleanMyMac X to remove malware, unwanted pop-ups, and virus extensions. Try it for free.  One of the subtle and valuable additions with macOS Monterey (and iOS 15) is an upgraded password manager in Safari. While there’s not a standalone app yet, a major improvement is the ability to generate and autofill two-factor authentication (2FA) codes. Let’s look at how to use the Safari password manager and 2FA features in macOS Monterey. more… The post appeared first on 9to5Mac.

Read more »

Father and daughter found via iPad cellular signal following plane crash
An iPad is credited with helping investigators track down a man and child who went missing following a plane crash in Pennsylvania on Sunday.The 58-year-old pilot and his 13-year-old daughter were in a Cessna 150, a small two-seat, single-engine plane, which they briefly flew from Wilkes-Barre Scranton International Airport in Pennsylvania. Shortly after takeoff, state police say the plane went off radar, triggering a search for the craft.The plane and both passengers were both found after a five-hour search, which included assistance from the U.S. Air Force Rescue Coordination Center, reports CNN. The plane crashed approximately seven miles southeast of the airport, in a heavily wooded area. Read more...

Read more »

Amazon’s new Prime Video app for Mac enables local downloads on desktop
Until now, downloading Prime Video shows and films was only possible on mobile.

Read more »

Vulnerability Summary for the Week of November 8, 2021
Original release date: November 15, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info airangel -- hsmx-app-25_firmware Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution. 2021-11-10 10 CVE-2021-40521 MISC MISC asgaros -- asgaros_forum The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue 2021-11-08 7.5 CVE-2021-24827 CONFIRM MISC azeotech -- daqfactory The affected application uses specific functions that could be abused through a crafted project file, which could lead to code execution, system reboot, and system shutdown. 2021-11-05 7.5 CVE-2021-42543 MISC cloudera -- cloudera_manager Cloudera Manager 7.2.4 has Incorrect Access Control, allowing Escalation of Privileges. 2021-11-08 7.5 CVE-2021-30132 MISC MISC dolibarr -- dolibarr The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked. 2021-11-10 7.5 CVE-2021-33816 MISC MISC FULLDISC engineers_online_portal_project -- engineers_online_portal A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "

Read more »

Hoax Email Blast Abused Poor Coding in FBI Website
The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing insecure code in an FBI online portal designed to share information with state and local law enforcement authorities.

Read more »

25 Things You Didn’t Know Siri Can Do
Siri can do a lot, but it's hard to know the many questions and commands it can respond to. Here are 25 that you may not know. The post appeared first on The Mac Security Blog.

Read more »

Is Apple Planning to Lock Down the Mac? – Intego Mac Podcast Episode 213
There is still new malware pretending to be Flash Player updates, even though Flash is dead; Facebook said they were ditching their facial recognition program, but has done an about face; and we discuss whether Apple is on a path to lock down the Mac to only allow apps to be installed from the Mac App Store. The post appeared first on The Mac Security Blog.

Read more »

Highlights of Recent Mac Malware: OSX/WizardUpdate and OSX/Bundlore
Mac malware researchers constantly encounter new malware samples and variants. In recent weeks, two notable malware families introduced new malware variants in their infection campaigns. Here’s what you should know regarding two recently updated Mac malware families: OSX/WizardUpdate and OSX/Bundlore. OSX/WizardUpdate It’s fairly rare that a piece of malware comes along just once and is […] The post appeared first on The Mac Security Blog.

Read more »

SMS About Bank Fraud as a Pretext for Voice Phishing
Most of us have probably heard the term "smishing" -- which is a portmanteau for traditional phishing scams sent through SMS text messages. Smishing messages usually include a link to a site that spoofs a popular bank and tries to siphon personal information. But increasingly, phishers are turning to a hybrid form of smishing -- blasting out linkless text messages about suspicious bank transfers as a pretext for immediately calling and scamming anyone who responds via text.

Read more »

Red Hat Security Advisory 2021-4358-03
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Issues addressed include a use-after-free vulnerability.

Read more »

Microsoft Patch Tuesday, November 2021 Edition
Microsoft Corp. today released updates to quash at least 55 security bugs in its Windows operating systems and other software. Two of the patches address vulnerabilities that are already being used in active attacks online, and four of the flaws were disclosed publicly before today -- potentially giving adversaries a head start in figuring out how to exploit them.

Read more »

REvil Ransom Arrest, $6M Seizure, and $10M Reward
The U.S. Department of Justice said today it arrested a Ukrainian man who deployed ransomware on behalf of the REvil ransomware gang, a Russian cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency sent to another REvil affiliate, and that the State Department is now offering up to $10 million for information leading to the arrest of any key leaders of REvil.

Read more »

Vulnerability Summary for the Week of November 1, 2021
Original release date: November 8, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aaptjs_project -- aaptjs An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36380 MISC aaptjs_project -- aaptjs An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36379 MISC aaptjs_project -- aaptjs An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36376 MISC aaptjs_project -- aaptjs An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36377 MISC aaptjs_project -- aaptjs An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36378 MISC aaptjs_project -- aaptjs An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters. 2021-10-31 7.5 CVE-2020-36381 MISC aaptjs_project -- aaptjs An issue was discovered in the add function in Shenzhim AAPTJS 1.3.1 which allows attackers to execute arbitrary code via the filePath parameter. 2021-10-31 7.5 CVE-2020-26707 MISC apache -- traffic_server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0. 2021-11-03 7.5 CVE-2021-43082 MISC beckhoff -- tf6100_firmware TwinCAT OPC UA Server in TF6100 and TS6100 in product versions before 4.3.48.0 or with TcOpcUaServer versions below 3.2.0.194 are prone to a relative path traversal that allow administrators to create or delete any files on the system. 2021-11-04 8.5 CVE-2021-34594 CONFIRM church_management_system_project -- church_management_system Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field. 2021-10-29 7.5 CVE-2021-41643 MISC cisco -- anyconnect_secure_mobility_client A vulnerability in the Network Access Manager (NAM) module of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to escalate privileges on an affected device. This vulnerability is due to incorrect privilege assignment to scripts executed before user logon. An attacker could exploit this vulnerability by configuring a script to be executed before logon. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges. 2021-11-04 7.2 CVE-2021-40124 CISCO cisco -- catalyst_pon_switch_cgp-ont-1p_firmware Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory. 2021-11-04 7.5 CVE-2021-34795 CISCO cisco -- catalyst_pon_switch_cgp-ont-1p_firmware Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities, see the Details section of this advisory. 2021-11-04 7.5 CVE-2021-40113 CISCO cisco -- ios_xr A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system and execute them using root-level privileges. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending malicious input to a specific field in the web-based management interface of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying Linux operating system as a user with root-level privileges. 2021-11-04 9 CVE-2021-40120 CISCO customer_relationship_management_system_project -- customer_relationship_management_system An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php. 2021-11-03 10 CVE-2021-43130 MISC dlink -- dir-823g_firmware An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors. 2021-11-04 8.5 CVE-2020-25366 MISC MISC MISC dlink -- dir-823g_firmware A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login. 2021-11-04 7.5 CVE-2020-25367 MISC MISC MISC dotty_project -- dotty This affects the package dotty before 0.1.2. A type confusion vulnerability can lead to a bypass of CVE-2021-25912 when the user-provided keys used in the path parameter are arrays. 2021-11-03 7.5 CVE-2021-23624 MISC MISC doyocms_project -- doyocms Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code. 2021-11-01 7.5 CVE-2021-26740 MISC doyocms_project -- doyocms SQL Injection vulnerability in pay.php in millken doyocms 2.3, allows attackers to execute arbitrary code, via the attribute parameter. 2021-11-01 7.5 CVE-2021-26739 MISC duraspace -- dspace DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings. 2021-10-29 9 CVE-2021-41189 MISC MISC CONFIRM MISC e-negosyo_system_project -- e-negosyo_system An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php. 2021-10-29 7.5 CVE-2021-41674 MISC MISC MISC eclipse -- paho_mqtt_c/c++_client In versions prior to 1.1 of the Eclipse Paho MQTT C Client, the client does not check rem_len size in readpacket. 2021-11-03 7.5 CVE-2021-41036 CONFIRM ed01-cms_project -- ed01-cms ED01-CMS v1.0 was discovered to contain a SQL injection in the component cposts.php via the cid parameter. 2021-11-03 7.5 CVE-2020-18262 MISC ed01-cms_project -- ed01-cms An arbitrary file upload vulnerability in the image upload function of ED01-CMS v1.0 allows attackers to execute arbitrary commands. 2021-11-03 7.5 CVE-2020-18261 MISC ericsson -- network_location_mps_gmpc21 In Ericsson Network Location MPS GMPC21, it is possible to inject commands via file_name in the export functionality. 2021-11-03 7.5 CVE-2021-43339 MISC MISC eyoucms -- eyoucms SQL Injection vulnerability in eyoucms cms v1.4.7, allows attackers to execute arbitrary code and disclose sensitive information, via the tid parameter to index.php. 2021-11-03 7.5 CVE-2020-24000 MISC fortinet -- forticlient An improper authorization vulnerability [CWE-285] in FortiClient for Windows versions 7.0.1 and below and 6.4.2 and below may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for Forticlient updates. 2021-11-02 7.2 CVE-2021-36183 CONFIRM fortinet -- fortiweb A stack-based buffer overflow in Fortinet FortiWeb version 6.4.0, version 6.3.15 and below, 6.2.5 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests 2021-11-02 7.5 CVE-2021-36186 CONFIRM hp -- futuresmart_3 Certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, HP PageWide Managed products may be vulnerable to potential buffer overflow. 2021-11-03 7.5 CVE-2021-39238 MISC hp -- ilo_amplifier_pack A remote unauthenticated directory traversal security vulnerability has been identified in HPE iLO Amplifier Pack versions 1.80, 1.81, 1.90 and 1.95. The vulnerability could be remotely exploited to allow an unauthenticated user to run arbitrary code leading complete impact to confidentiality, integrity, and availability of the iLO Amplifier Pack appliance. 2021-11-01 10 CVE-2021-29212 MISC MISC hp -- laserjet_pro_j8h60a_firmware Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow a Denial of Service on the device. 2021-11-01 7.8 CVE-2021-3704 MISC hp -- laserjet_pro_j8h61a_firmware Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigure, reset the device. 2021-11-01 10 CVE-2021-3705 MISC hpe -- proliant_microserver_gen10_plus_firmware A potential local bypass of security restrictions vulnerability has been identified in HPE ProLiant DL20 Gen10, HPE ProLiant ML30 Gen10, and HPE ProLiant MicroServer Gen10 Plus server's system ROMs prior to version 2.52. The vulnerability could be locally exploited to cause disclosure of sensitive information, denial of service (DoS), and/or compromise system integrity. 2021-11-01 7.2 CVE-2021-29213 MISC json-ptr_project -- json-ptr This affects the package json-ptr before 3.0.0. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays. 2021-11-03 7.5 CVE-2021-23509 MISC MISC MISC MISC MISC jsonpointer_project -- jsonpointer This affects all versions of package json-pointer. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays. 2021-11-03 7.5 CVE-2021-23820 MISC MISC MISC jsonpointer_project -- jsonpointer This affects the package jsonpointer before 5.0.0. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays. 2021-11-03 7.5 CVE-2021-23807 MISC MISC MISC MISC linux -- linux_kernel An issue was discovered in net/tipc/crypto.c in the Linux kernel before 5.14.16. The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type. 2021-11-02 7.5 CVE-2021-43267 MISC MISC FEDORA FEDORA linux_network_project -- linux_network_project Buffer overflow vulnerability in Renleilei1992 Linux_Network_Project 1.0, allows attackers to execute arbitrary code, via the password field. 2021-11-03 7.5 CVE-2020-23679 MISC mahara -- mahara In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges. 2021-11-03 7.5 CVE-2021-40849 MISC MISC online_food_ordering_system_project -- online_food_ordering_system Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters. 2021-10-29 7.5 CVE-2021-41644 MISC online_reviewer_system_project -- online_reviewer_system Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters.. 2021-10-29 7.5 CVE-2021-41646 MISC pharmacy_point_of_sale_system_project -- pharmacy_point_of_sale_system An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php. 2021-10-29 7.5 CVE-2021-41676 MISC MISC phone_shop_sales_management_system_project -- phone_shop_sales_management_system Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin. 2021-11-02 7.5 CVE-2021-36560 MISC MISC phpok -- phpok Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code. 2021-11-02 7.5 CVE-2020-18440 MISC simple_cashiering_system_project -- simple_cashiering_system Multiple SQL Injection vulnerabilities exist in Sourcecodester Simple Cashiering System (POS) 1.0 via the (1) Product Code in the pos page in cashiering. (2) id parameter in manage_products and the (3) t paramater in actions.php. 2021-11-03 7.5 CVE-2021-41492 MISC simple_subscription_website_project -- simple_subscription_website SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login. 2021-11-03 7.5 CVE-2021-43140 MISC spacewalk_project -- spacewalk Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1. 2021-11-01 9.3 CVE-2021-40348 MISC CONFIRM symonics -- libmysofa libmysofa is vulnerable to Heap-based Buffer Overflow 2021-10-29 7.5 CVE-2021-3756 MISC CONFIRM tendacn -- ac10u_firmware Stack-based buffer overflow in Tenda AC-10U AC1200 Router US_AC10UV1.0RTL_V15.03.06.48_multi_TDE01 allows remote attackers to execute arbitrary code via the timeZone parameter to goform/SetSysTimeCfg. 2021-10-29 7.5 CVE-2020-22079 MISC MISC thunderdome -- planning_poker Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection vulnerability which affects instances with LDAP authentication enabled. The provided username is not properly escaped. This issue has been patched in version 1.16.3. If users are unable to update they should disable the LDAP feature if in use. 2021-11-02 7.5 CVE-2021-41232 CONFIRM MISC MISC unicode -- unicode An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. 2021-11-01 7.5 CVE-2021-42574 MISC MISC MLIST MLIST MLIST MLIST MLIST FEDORA FEDORA unicode -- unicode An issue was discovered in the character definitions of the Unicode Specification through 14.0. The specification allows an adversary to produce source code identifiers such as function names using homoglyphs that render visually identical to a target identifier. Adversaries can leverage this to inject code via adversarial identifier definitions in upstream software dependencies invoked deceptively in downstream software. 2021-11-01 7.5 CVE-2021-42694 MISC MISC MLIST MLIST vtimecn -- 188jianzhan SQL Injection vulnerability in 188Jianzhan v2.1.0, allows attackers to execute arbitrary code and gain escalated privileges, via the username parameter to login.php. 2021-11-02 7.5 CVE-2020-23685 MISC zohocorp -- manageengine_applications_manager An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resourceid parameter. 2021-11-03 7.5 CVE-2020-24743 MISC zohocorp -- manageengine_log360 ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup. 2021-11-01 7.5 CVE-2021-20136 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info akka -- http_server Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. 2021-11-02 5 CVE-2021-42697 MISC MISC MISC alibaba -- druid In Druid 1.2.3, visiting the path with parameter in a certain function can lead to directory traversal. 2021-11-03 5 CVE-2021-33800 MISC antennahouse -- office_server_document_converter Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition by processing a specially crafted XML document. 2021-11-01 5 CVE-2021-20838 MISC MISC antennahouse -- office_server_document_converter Office Server Document Converter V7.2MR4 and earlier and V7.1MR7 and earlier allows a remote unauthenticated attacker to conduct an XML External Entity (XXE) attack to cause a denial of service (DoS) condition to the other servers by processing a specially crafted XML document. 2021-11-01 4.3 CVE-2021-20839 MISC MISC apache -- dolphinscheduler In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password) 2021-11-01 6 CVE-2021-27644 MISC MLIST MLIST apache -- mina In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater. 2021-11-01 4.3 CVE-2021-41973 MISC MLIST MLIST apache -- traffic_server Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.0.1. 2021-11-03 5 CVE-2021-37148 MISC apache -- traffic_server Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0. 2021-11-03 5 CVE-2021-37147 MISC apache -- traffic_server Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0. 2021-11-03 5 CVE-2021-37149 MISC apache -- traffic_server Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0. 2021-11-03 5 CVE-2021-41585 MISC apache -- traffic_server Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8. 2021-11-03 6.8 CVE-2021-38161 MISC artica -- pandora_fms With an admin account, the .htaccess file in Artica Pandora FMS

Read more »

‘Tis the Season for the Wayward Package Phish
The holiday shopping season always means big business for phishers, who tend to find increased success this time of year with a time-honored lure about a wayward package that needs redelivery. Here's a look at a fairly elaborate SMS-based phishing scam that spoofs FedEx in a bid to extract personal and financial information from unwary recipients.

Read more »

Sale! Order a Silver 13″ M1 MacBook Pro for only $1099 today, $200 off Apple’s MSRP
Amazon has the Silver 13″ M1 MacBook Pro (8GB RAM/256GB SSD) available for order today for $1099.99 including free shipping. Their price is $200 off Apple’s MSRP, and it’s the lowest price available for a new 13″ M1 MacBook Pro from any Apple reseller. Amazon’s price reflects a $100 sale price plus a $99.01 instant coupon automatically applied during the checkout process. Be sure to […] The post first appeared on MacPrices.net.

Read more »

Stock Alert! 14″ M1 Pro MacBook Pros in stock today with a $50 discount
Amazon is reporting stock of Space Gray 14″ MacBook Pros with M1 Pro CPUs today with a $50 discount. Shipping is free. These are the only two 14″ MacBook Pros in stock today at an Apple reseller at a discounted price. The 8-Core model is being sold at a discount by Adorama, one of Amazon’s Certified Apple Partners. The 10-Core model is being sold by […] The post first appeared on MacPrices.net.

Read more »

Early Black Friday sale prices on M1 Mac minis with models available from $599
Amazon has new Apple M1 Mac minis on early Black Friday sale for $100-$150 off Apple’s MSRP, with prices starting at only $599: – Mac mini M1 CPU/256GB SSD: $599.99 $100 off MSRP – Mac mini M1 CPU/512GB SSD: $749.99 $150 off MSRP The 256GB mini is in stock today, while the 512GB model is available for order and estimated to ship by December 1st. […] The post first appeared on MacPrices.net.

Read more »

Stock Alert! 14″ 10-Core M1 Pro MacBook Pros available at Apple resellers today
Apple’s new 14″ MacBook Pros with M1 Pro CPUs are still in and out of stock at resellers, and Apple itself is quoting 2-3 week shipping times. However, the 16GB/512GB 10-Core M1 Pro model is in stock today at several Apple resellers with shipping available right away: Space Gray model: – 14″ MacBook Pro M1 Pro/10-Core CPU/16GB RAM/512GB SSD: $2499 at Abt in stock – […] The post first appeared on MacPrices.net.

Read more »

Use our exclusive Apple MacBook Price Trackers to find the best deal on a new MacBook Pro or MacBook Air this Holiday season
In the market for a new 13″ MacBook Air, 13″ MacBook Pro, 14″ MacBook Pro, or 16″ MacBook Pro with M1, M1 Pro, or M1 Max Apple Silicon? Use our Apple award-winning and exclusive price trackers to find the best deal or lowest price on one of Apple’s Silicon MacBooks, as well as the rest of their lineup of Macs, iPads, iPhones, and accessories. Our […] The post first appeared on MacPrices.net.

Read more »

Previous-generation 16″ MacBook Pros on clearance sale for only $1779, up to $720 off original MSRP
Other World Computing is offering refurbished, like-new, previous-generation Intel-based 16″ MacBook Pros for $620-$720 off original MSRP with prices starting at only $1779: – 16″ 2.6GHz 6-Core MacBook Pro: $1779 $620 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro: $2079 $720 off MSRP Discounts are also available on build-to-order extras such as graphics updates, larger SSDs, and CPU upgrades. According to OWC, “Refurbished items are […] The post first appeared on MacPrices.net.

Read more »

Use your Education discount to get an M1-powered MacBook for $100 off MSRP
Apple’s Education discount yields savings of $100 off standard MSRP when you purchase a new 13″ MacBook Pro or a new 13″ MacBook Air with an Apple M1 processor. Students, teachers, and staff members at any educational institution with a .edu email address qualify for the discount. Education discounts are available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards as well […] The post first appeared on MacPrices.net.

Read more »

Use your Education discount to get an M1-powered MacBook for $100 off MSRP
Apple’s Education discount yields savings of $100 off standard MSRP when you purchase a new 13″ MacBook Pro or a new 13″ MacBook Air with an Apple M1 processor. Students, teachers, and staff members at any educational institution with a .edu email address qualify for the discount. Education discounts are available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards as well […] The post first appeared on MacPrices.net.

Read more »

Apple Pencils on sale for $20-$30 off MSRP
Amazon has Apple Pencils on sale right now for $20-$30 off MSRP with prices starting at $79. These are the cheapest Apple Pencils currently available at any Apple reseller: – Apple Pencil 2: $99.99 $30 off MSRP – Apple Pencil: $79.99 $20 off MSRP For the latest prices and sales, keep an eye on our Apple Pencil Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Visible offers discounted iPhone 13 models, free $100-$200 gift cards, and free overnight shipping
Verizon’s low-cost wireless cell service, Visible, is offering slight discounts on iPhone 13 Pro/Max models when you switch and open a new line of service. Visible will include a free $200 gift card with the purchase of any iPhone 13 Pro or Pro Max and a free $100 gift card with the purchase of any iPhone 13 or 13 mini. Switch to Visible and bring […] The post first appeared on MacPrices.net.

Read more »

Pre Black Friday prices available on Apple AirPods with models on sale for up to $70 off MSRP
Amazon dropped prices on Apple AirPods to some of the lowest prices we’ve ever seen as part of their early Black Friday 2021 sale. Models are available for up to $70 off Apple’s MSRP with prices starting at only $89. Shipping is free, and maybe mostly importantly, all models are in stock today: – AirPods Max headphones: $479 $70 off MSRP – AirPods Pro (2021): […] The post first appeared on MacPrices.net.

Read more »

Apple has restocked a wide range of 24-inch M1 iMacs starting at only $1099, up to $260 off MSRP, Certified Refurbished
Apple has restocked a wide array of 24-inch M1 iMacs in their Certified Refurbished store. Models are available starting at only $1099 and range up to $260 off original MSRP. Each iMac is in like-new condition and comes with Apple’s standard one-year warranty: – 24-inch M1 iMac 8-Core CPU/7-Core GPU (all colors): $1099 $200 off MSRP – 24-inch M1 iMac 8-Core CPU/8-Core GPU/256GB SSD (all […] The post first appeared on MacPrices.net.

Read more »