Netflix password sharing rules hit new countries; how to check who has access to your account
Netflix has announced an update on its efforts to crack down on password sharing. In a blog post published today, Netflix explained that “over 100 million households are sharing accounts,” which impacts its “ability to invest in great new TV and films.” With that in mind, Netflix says that it is expanding its restrictions on password and account sharing to new countries. There’s also a new way to easily manage who has access to your account via the Netflix website… more… The post appeared first on 9to5Mac.

Read more »

Twitter Blue now available in three more countries following relaunch last year
Twitter last December relaunched its Twitter Blue subscription after Elon Musk decided to suspend it due to the whole blue checkmarks controversy. Now that Twitter Blue is back, the company is now expanding its subscription to three more countries: Brazil, India, and Indonesia. more… The post appeared first on 9to5Mac.

Read more »

‘Apple Watch Series X’ said to launch in 2024 with larger display
Apple is said to be prepping a new "Apple Watch Series X" with a larger display, slated to launch in 2024 alongside the Apple Watch SE 3… The post appeared first on MacDailyNews.

Read more »

Get $18 off Ugreen’s new multiport wall charger with international plugs
Ugreen unveiled its new 65W Nexode GaN USB-C three-port wall charger with US, UK and EU plugs on Wednesday. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

HomePod 2 review: A great smart speaker that struggles to stand out
What's old is new again as Apple's original HomePod has returned with revamped internals and big sound — but an unchanged high price.The new HomePod second-generationThe HomePod launched as a product without an actual home. It was generally received well — including by us — on factors other than price. By any measure, though, it didn't sell well at launch. Read more...

Read more »

Halide adds ’Neural Telephoto’ to give enhanced zoom for non-Pro iPhone users
The popular camera app Halide introduced support for the new virtual 2x zoom for the iPhone 14 Pro last year. Now with its first update of 2023, Halide is rolling out a new feature called “Neural Telephoto,” which enhances zoomed photos for non-Pro iPhone users. more… The post appeared first on 9to5Mac.

Read more »

Mac is less popular among Apple customers than iPhone, iPad, Apple Watch
While the iPhone continues to be Apple's most popular product, the Mac sits in fourth place, after both iPad and Apple Watch.The iPhone is popular with Apple customersThe latest analysis from Consumer Intelligence Research Partners (CIRP) examines product ownership among Apple customers and which categories are dominant. For example, almost 90% of Apple customers own an iPhone, while the iPad follows at 73% in second place. Read more...

Read more »

Microsoft Bing rockets to the top of the App Store after announcing ChatGPT integration
Just one day after Microsoft announced its new Edge browser and updated Bing search engine that integrates a ChatGPT experience via OpenAI, Microsoft has seen a huge burst of demand. The Bing app and Edge browser for iOS have shot to the top of the App Store charts. more… The post appeared first on 9to5Mac.

Read more »

UnitedHealthcare unveils rewards program with up to $1,000/yr. incentives for Apple Watch users
UnitedHealthcare has introduced UnitedHealthcare Rewards, a new rewards program in which members, including spouses, can use Apple Watches… The post appeared first on MacDailyNews.

Read more »

Today in Apple history: Steve Jobs flips out over iPad tweet
February 8, 2010: Steve Jobs reportedly flips out over a tweet sent from an iPad by an editor at The Wall Street Journal. The reason? Apple showed the iPad to top staffers at the news outlet months ahead of its official release. While Jobs already had unveiled the device to the public a couple of weeks […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Find irresistible mix of Apple Watch bands and cases for 15% off
The Cult of Mac Store has another sale going — through Saturday you can take 15% off a variety of cool accessories from Mifa and Elkson. Mifa is known for its assortment of high-quality Apple Watch bands. Elkson does great bands too, but also rugged cases for Apple Watch, AirPods Pro and AirTags. Get 15% […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Super Bowl LVII: How to watch Chiefs vs Eagles free on Apple TV, iPhone, or any device
Super Bowl LVII is set for Sunday, February 12 with the Kansas City Chiefs up against the Philadelphia Eagles. Follow along for several ways to watch the Super Bowl including free on Apple TV, iPhone, or any device. We’ll also cover the Apple Music halftime show details. more… The post appeared first on 9to5Mac.

Read more »

UnitedHealthcare offers cash for your Apple Watch health data
A new rewards program from UnitedHealthcare lets people earn money by completing various health goals using an Apple Watch or other wearable — with a giant catch.New UnitedHealthcare rewards programUnitedHealthcare Rewards offers up to $1,000 per for eligible members, including spouses, by completing various daily health goals and one-time activities. Members can also use a smartphone capable of tracking health, such as an iPhone and Apple's Health app. Read more...

Read more »

9to5Mac Daily: February 8, 2023 – Apple Pay Later, new browsers for iPhone
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Enjoy the podcast? Shop to support 9to5Mac Daily! more… The post appeared first on 9to5Mac.

Read more »

Apple Pay Later service is getting ready for its public release
Apple Pay is one of the most successful services for the company and a “buy now, pay later” option may be coming to users soon. According to Bloomberg, Apple is now expanding its testing of the service to its retail employees, indicating that a release to the general public is impeding. Apple Pay Later allows customers to split a purchase made using Apple Pay into four installments that is paid over six weeks without interest or fees. Apple Pay Later is backed by a new Apple subsidiary called Apple Financing LLC, which means Apple handles the lending on its own. Apple’s decision to create its own financing subsidiary is interesting because it falls in line with Apple’s evolving business practice of developing its own processes, parts, and services instead of relying on partners. The biggest example of this is with its processors, using its own silicon in its devices instead of relying on Intel or Samsung. Apple is also working on its own Wi-Fi chip and cellular modem, but development on those have hit several roadblocks. Apple introduced Apple Pay Later at WWDC last year and was going to release it with iOS 16 last September. Apple delayed the service to work out “technical challenges” with its new in-house financial platform, according to Bloomberg. Bloomberg also reported that an Apple Pay Monthly plan is in the works, which has installments over several months with interest. Apple Pay Monthly has yet to be officially announced and is being developed with Goldman Sachs, the firm that partners with for the Apple Card. It’s unclear if the Goldman Sachs partnership will be in place if and when Apple Pay Monthly launches, or if Apple will switch to its Apple Financing subsidiary. Apple, iOS

Read more »

Custom USB-C case for AirPods Pro highlights repairability problem
The guy who made headlines in 2021 for replacing an iPhone X’s Lighting port with a USB-C port — and then selling the handset for big bucks on eBay — is back. Engineer Ken Pillonel, who went on to similarly alter AirPods charging cases, has now modded an AirPods Pro case with USB-C. These days […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Microsoft Ups Ante for Online Search With New AI-Powered Bing Engine, Edge Browser
Microsoft may have ushered in a paradigm shift with the release of new versions of its search engine, Bing, and web browser, Edge -- both now powered by artificial intelligence. The post appeared first on TechNewsWorld.

Read more »

UnitedHealthcare debuts new rewards program with $1,000 in incentives for Apple Watch users
UnitedHealthcare has announced a new program that it hopes will entice its members to use wearables like Apple Watch to stay active and focus on their health. Through the new UnitedHealthcare Rewards program, “eligible members” can earn up to $1,000 per year in incentives when they complete certain one-time and ongoing activities with their Apple Watch or other devices. more… The post appeared first on 9to5Mac.

Read more »

M2 MacBook Air with 16GB RAM now $200 off in today’s best deals, Apple Watch Series 8, more
We’ve made it halfway through the work week, and today’s edition of the best deals have delivered some notable Apple offers. For Wednesday, we’re tracking a $200 discount on Apple’s upgraded M2 MacBook Air with 16GB of RAM. That’s alongside a chance to save on the more premium stainless steel Apple Watch Series 8 with Milanese Loop at $109 off, as well as some in-house Sport Bands at $35 each in several colors. Hit the jump for all of the best deals and more in the latest 9to5Toys Lunch Break. more… The post appeared first on 9to5Mac.

Read more »

Apple's M2 MacBook Air gets a $200 price drop at B&H Photo
Upgrade your MacBook experience with the latest M2 MacBook Air, now available through B&H Photo for $200 off retail, plus free expedited shipping.Save $200 on the M2 MacBook Air.The $200 off deal is exceptionally generous to your wallet because of the upgraded specs. Under the hood are 16GB of RAM, 256GB of SSD storage, and a 10-core M2 chip, all for only $1,299 when you shop at B&H Photo. Read more...

Read more »

Help Build a List of Apple-Related Conferences in 2023
Looking for an Apple-related conference to attend in 2023? Check out our community-driven conference list, and if you know of any that don’t currently appear, please submit them.

Read more »

Apple TV+ unveils trailer for new thriller ‘Liaison,’ starring Eva Green and Vincent Cassel
Apple’s first French and English original series, “Liaison,” starring BAFTA Award winner Eva Green and César Award winner Vincent Cassel… The post appeared first on MacDailyNews.

Read more »

Apple releases a MagSafe Duo firmware update that won’t fix any of its problems
If you own a MagSafe Duo, there’s a new firmware version for your device. Unfortunately, it’s not going to fix any of the things that are wrong with it. As spotted by MacRumors, the new version is 256.1067.0 (10M3063). To check, attach your iPhone to the MagSafe Duo charger, open the Settings app, tap General, then About, and Carrier Lock. Then select the “Apple MagSafe Charger” name and you’ll see the firmware version number. The previous firmware number was 186.0.0.0. Unfortunately, the new firmware won’t fix any of the MagSafe Duo’s actual issues. When it launched in 2020, we called it “nearly impossible to recommend” in our 2-star review, complaining about slow speeds and a janky design, and it’s only gotten worse over the years. The iPhone 14 Pro and Pro Max have a hard time resting on the charger, and Apple recommends laying the Apple Watch Ultra flat and removing its band to get it to charge properly as it doesn’t fit properly on the connector when upright. There’s no way to physically update the MagSafe Duo firmware, but if it’s plugged in and charging an Apple device it should automatically download and install the update. iPhone

Read more »

Google Maps adds AR views & more Live Activities
Google has announced multiple new features for its mapping service, including use of iOS 16's Live Activities feature to show "glanceable directions."Following its introduction of Live Activities to launch the frequent trips element of Google Maps, Google is now adding more informative elements. Instead of tapping to launch Google Maps, users will be able to see details of a current walking or driving trip."You'll see updated ETAs and where to make your next turn — information that was previously only visible by unlocking your phone, opening the app and using comprehensive navigation mode," says Google in a blog post. "And if you decide to take another path, we'll update your trip automatically." Read more...

Read more »

Triple-display MacBook Pro rig perches in attic ‘closet’ [Setups]
A room is what you make of it, and today’s featured computer setup finds a home in a room only a computer science student could make. He may have to live in a windowless attic, but he brings a lot of computing power and light to it, making it look and feel larger than it […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Baffling Apple Watch rumor expects expensive new lineup in 2024
A highly suspect report suggests that a 2.13-inch micro LED Apple Watch Ultra, bigger so-called Apple Watch Series X, and Apple Watch SE 3 with Series 8 design will launch in 2024.Rumor suggests major overhaul to Apple Watch lineup in 2024There has been a lot of back and forth about the future of Apple Watch and Apple's implementation of micro LED. Some less reliable reports suggested 2024 while a stronger rumor aimed at 2025. Read more...

Read more »

Apple TV+ announces season three renewal for ‘Tehran,’ with Emmy Award nominee Hugh Laurie set to join award-winning series
The Apple TV+ series “Tehran” has been renewed for a third season, and that multi-Emmy Award nominee Hugh Laurie is set to join the cast… The post appeared first on MacDailyNews.

Read more »

Apple Pencil 2 is more affordable than ever after a $40 discount
The Apple Pencil 2 is again down to its lowest price of $89, a sweet $40 off its retail price of $129. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Chat AI tech will eventually make Siri smarter, but not anytime soon [Opinion]
Chat AI tech is without a doubt the most exciting thing to have happened in the world of technology for quite some time – providing answers to questions, writing essays, generating working code, or even passing an MBA exam through a conversational UI. Microsoft announced that a version of ChatGPT will power a conversational search feature within its Bing search engine. Google has been quick to announce that it, too, will use its own AI chatbot, Bard, for searches. Does all this mean that Apple too will climb aboard this next-generation chat AI tech to finally make Siri smarter … ? more… The post appeared first on 9to5Mac.

Read more »

Why ‘Apple Watch Series X’ rumors should be treated with skepticism (for now)
A pair of recent rumors (with contradicting timelines) have suggested that Apple could overhaul the Apple Watch lineup with the introduction of a so-called “Apple Watch Series X.” Here’s why we’d treat these rumors with a major dose of skepticism, even though it’s totally possible Apple releases an “Apple Watch Series X” at some point down the line. more… The post appeared first on 9to5Mac.

Read more »

Vulnerability Summary for the Week of January 30, 2023
Original release date: February 7, 2023  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info qnap -- qts A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QuTS hero, QTS: QuTS hero h5.0.1.2248 build 20221215 and later QTS 5.0.1.2234 build 20221201 and later 2023-01-30 9.8 CVE-2022-27596 MISC changingtec -- megaservisignadapter ChangingTech MegaServiSignAdapter component has a vulnerability of improper input validation. An unauthenticated remote attacker can exploit this vulnerability to access and modify HKEY_CURRENT_USER subkey (ex: AutoRUN) in Registry where malicious scripts can be executed to take control of the system or to terminate the service. 2023-01-31 9.8 CVE-2022-39060 MISC sscms -- siteserver_cms SiteServer CMS 7.1.3 is vulnerable to SQL Injection. 2023-01-27 9.8 CVE-2022-44298 MISC limesurvey -- limesurvey An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file. 2023-01-27 9.8 CVE-2022-48008 MISC opencats -- opencats Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. 2023-01-27 9.8 CVE-2022-48011 MISC MISC bank_locker_management_system_project -- bank_locker_management_system A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219716. 2023-01-28 9.8 CVE-2023-0562 MISC MISC MISC thinking_software_technology -- efence Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database. 2023-01-31 9.8 CVE-2023-22900 MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file /user/s.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-219702 is the identifier assigned to this vulnerability. 2023-01-28 8.8 CVE-2023-0561 MISC MISC MISC phicomm -- k2_firmware Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. 2023-01-27 7.8 CVE-2022-48070 MISC phicomm -- k2_firmware Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. 2023-01-27 7.8 CVE-2022-48072 MISC changingtec -- megaservisignadapter   ChangingTech MegaServiSignAdapter component has a path traversal vulnerability within its file reading function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files. 2023-01-31 7.5 CVE-2022-39059 MISC phicomm -- k2_firmware Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. 2023-01-27 7.5 CVE-2022-48071 MISC phicomm -- k2_firmware Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. 2023-01-27 7.5 CVE-2022-48073 MISC froxlor -- froxlor Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10. 2023-01-29 7.5 CVE-2023-0564 CONFIRM MISC openmage -- magento OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue. 2023-01-27 7.2 CVE-2021-39217 MISC MISC MISC MISC ayacms_project -- ayacms AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php. 2023-01-27 7.2 CVE-2022-48116 MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. This issue affects some unknown processing of the file admin/practice_pdf.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219701 was assigned to this vulnerability. 2023-01-28 7.2 CVE-2023-0560 MISC MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info changingtec -- megaservisignadapter ChangingTech MegaServiSignAdapter component has a vulnerability of Out-of-bounds Read due to insufficient validation for parameter length. An unauthenticated remote attacker can exploit this vulnerability to access partial sensitive content in memory and disrupts partial services. 2023-01-31 6.5 CVE-2022-39061 MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. This affects an unknown part of the file admin/abc.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219597 was assigned to this vulnerability. 2023-01-27 6.3 CVE-2023-0528 MISC MISC MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file admin/add_payment.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-219598 is the identifier assigned to this vulnerability. 2023-01-27 6.3 CVE-2023-0529 MISC MISC MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 1 of 6. 2023-01-27 6.1 CVE-2022-44024 MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6. 2023-01-27 6.1 CVE-2022-44025 MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6. 2023-01-27 6.1 CVE-2022-44026 MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6. 2023-01-27 6.1 CVE-2022-44027 MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6. 2023-01-27 6.1 CVE-2022-44028 MISC netscout -- ngeniusone An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6. 2023-01-27 6.1 CVE-2022-44029 MISC opencats -- opencats Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. 2023-01-27 6.1 CVE-2022-48012 MISC MISC jorani_project -- jorani Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. 2023-01-27 6.1 CVE-2022-48118 MISC piwigo -- piwigo A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent. 2023-01-27 5.4 CVE-2022-48007 MISC limesurvey -- limesurvey LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. 2023-01-27 5.4 CVE-2022-48010 MISC opencats -- opencats Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields. 2023-01-27 5.4 CVE-2022-48013 MISC MISC bank_locker_management_system_project -- bank_locker_management_system A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability. 2023-01-28 4.8 CVE-2023-0563 MISC MISC MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability classified as critical has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/booking_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-219600. 2023-01-27 4.7 CVE-2023-0531 MISC MISC MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability. 2023-01-27 4.7 CVE-2023-0532 MISC MISC MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability, which was classified as critical, has been found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this issue is some unknown functionality of the file admin/expense_report.php. The manipulation of the argument from_date leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-219602 is the identifier assigned to this vulnerability. 2023-01-27 4.7 CVE-2023-0533 MISC MISC MISC online_tours_&_travels_management_system_project -- online_tours_&_travels_management_system A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects an unknown part of the file admin/expense_report.php. The manipulation of the argument to_date leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-219603. 2023-01-27 4.7 CVE-2023-0534 MISC MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no low vulnerabilities recorded this week. Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info wordcraft -- wordcraft   A vulnerability was found in capnsquarepants wordcraft up to 0.6. It has been classified as problematic. Affected is an unknown function of the file tag.php. The manipulation of the argument tag leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 0.7 is able to address this issue. The name of the patch is be23028633e8105de92f387036871c03f34d3124. It is recommended to upgrade the affected component. VDB-219714 is the identifier assigned to this vulnerability. 2023-01-29 not yet calculated CVE-2009-10003 MISC MISC MISC MISC fanzila -- webfinance A vulnerability has been found in fanzila WebFinance 0.5 and classified as critical. This vulnerability affects unknown code of the file htdocs/admin/save_Contract_Signer_Role.php. The manipulation of the argument n/v leads to sql injection. The name of the patch is abad81af614a9ceef3f29ab22ca6bae517619e06. It is recommended to apply a patch to fix this issue. VDB-220054 is the identifier assigned to this vulnerability. 2023-02-03 not yet calculated CVE-2013-10015 MISC MISC MISC fanzila -- webfinance A vulnerability was found in fanzila WebFinance 0.5 and classified as critical. This issue affects some unknown processing of the file htdocs/admin/save_taxes.php. The manipulation of the argument id leads to sql injection. The name of the patch is 306f170ca2a8203ae3d8f51fb219ba9e05b945e1. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-220055. 2023-02-03 not yet calculated CVE-2013-10016 MISC MISC MISC fanzila -- webfinance A vulnerability was found in fanzila WebFinance 0.5. It has been classified as critical. Affected is an unknown function of the file htdocs/admin/save_roles.php. The manipulation of the argument id leads to sql injection. The name of the patch is 6cfeb2f6b35c1b3a7320add07cd0493e4f752af3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-220056. 2023-02-04 not yet calculated CVE-2013-10017 MISC MISC MISC fanzila -- webfinance A vulnerability was found in fanzila WebFinance 0.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file htdocs/prospection/save_contact.php. The manipulation of the argument nom/prenom/email/tel/mobile/client/fonction/note leads to sql injection. The name of the patch is 165dfcaa0520ee0179b7c1282efb84f5a03df114. It is recommended to apply a patch to fix this issue. The identifier VDB-220057 was assigned to this vulnerability. 2023-02-04 not yet calculated CVE-2013-10018 MISC MISC MISC nrel -- api-umbrella-web A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.0 is able to address this issue. The name of the patch is bcc0e922c61d30367678c8f17a435950969315cd. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220060. 2023-02-04 not yet calculated CVE-2015-10072 MISC MISC MISC MISC mosbth -- cimage A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. Upgrading to version 0.7.19 is able to address this issue. The name of the patch is 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715. 2023-01-29 not yet calculated CVE-2016-15022 MISC MISC MISC MISC sitefusion -- application_server A vulnerability, which was classified as problematic, was found in SiteFusion Application Server up to 6.6.6. This affects an unknown part of the file getextension.php of the component Extension Handler. The manipulation leads to path traversal. Upgrading to version 6.6.7 is able to address this issue. The name of the patch is 49fff155c303d6cd06ce8f97bba56c9084bf08ac. It is recommended to upgrade the affected component. The identifier VDB-219765 was assigned to this vulnerability. 2023-01-31 not yet calculated CVE-2016-15023 MISC MISC MISC MISC MISC segmentio -- is-url A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be launched remotely. Upgrading to version 1.2.3 is able to address this issue. The name of the patch is 149550935c63a98c11f27f694a7c4a9479e53794. It is recommended to upgrade the affected component. VDB-220058 is the identifier assigned to this vulnerability. 2023-02-04 not yet calculated CVE-2018-25079 MISC MISC MISC MISC MISC mobiledetect -- mobiledetect A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.32 is able to address this issue. The name of the patch is 31818a441b095bdc4838602dbb17b8377d1e5cce. It is recommended to upgrade the affected component. The identifier VDB-220061 was assigned to this vulnerability. 2023-02-04 not yet calculated CVE-2018-25080 MISC MISC MISC MISC MISC sage -- frp_1000 A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL. 2023-01-27 not yet calculated CVE-2019-25053 MISC onshift -- turbogears A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading to version 1.0.11.11 is able to address this issue. The name of the patch is f68bbaba47f4474e1da553aa51564a73e1d92a84. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220059. 2023-02-04 not yet calculated CVE-2019-25101 MISC MISC MISC MISC MISC portfoliocms -- portfoliocms Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation. 2023-01-31 not yet calculated CVE-2020-20402 MISC mremoteng -- mremoteng An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file. 2023-02-02 not yet calculated CVE-2020-24307 MISC MISC schnieder_electric -- multiple_products   A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol. Affected Products: Modicon M340 CPU (part numbers BMXP34*) (Versions prior to V3.30), Modicon M580 CPU (part numbers BMEP* and BMEH*) (Versions prior to SV3.20), Modicon MC80 (BMKC80) (Versions prior to V1.6), Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) (All Versions), Modicon Momentum MDI (171CBU*) (Versions prior to V2.3), Legacy Modicon Quantum (All Versions) 2023-02-01 not yet calculated CVE-2021-22786 MISC hewlett_packard -- hp_pc_bios   HP has identified a potential vulnerability in BIOS firmware of some Workstation products. Firmware updates are being released to mitigate these potential vulnerabilities. 2023-02-01 not yet calculated CVE-2021-3439 MISC phpwcms -- phpwcms An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation. 2023-02-03 not yet calculated CVE-2021-36424 MISC phpwcms -- phpwcms Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlink method in include/inc_act/act_ftptakeover.php file. 2023-02-03 not yet calculated CVE-2021-36425 MISC phpwcms -- phpwcms File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general.inc.php. 2023-02-03 not yet calculated CVE-2021-36426 MISC jcoms -- jcoms SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check() function in jocms/apps/mask/inc/mask.php. 2023-02-03 not yet calculated CVE-2021-36431 MISC jcoms -- jcoms SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask() function in jocms/apps/mask/mask.php. 2023-02-03 not yet calculated CVE-2021-36432 MISC jcoms -- jcoms SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_mask function in jocms/apps/mask/mask.php. 2023-02-03 not yet calculated CVE-2021-36433 MISC jcoms -- jcoms SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocms/apps/mask/inc/getmask.php. 2023-02-03 not yet calculated CVE-2021-36434 MISC imcat -- imcat Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification. 2023-02-03 not yet calculated CVE-2021-36443 MISC imcat -- imcat Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page. 2023-02-03 not yet calculated CVE-2021-36444 MISC jizhicms -- jizhicms SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. 2023-02-03 not yet calculated CVE-2021-36484 MISC allegro -- allegro Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon. 2023-02-03 not yet calculated CVE-2021-36489 MISC xpdfreader -- xpdfimages Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command. 2023-02-03 not yet calculated CVE-2021-36493 MISC native-php-cms -- native-php-cms SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file. 2023-02-03 not yet calculated CVE-2021-36503 MISC portfoliocms  -- portfoliocms Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php. 2023-02-03 not yet calculated CVE-2021-36532 MISC cesanta_software -- mjs Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf. 2023-02-03 not yet calculated CVE-2021-36535 MISC gurock_holding_gmbh -- testrail Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. 2023-02-03 not yet calculated CVE-2021-36538 MISC tcpms -- tcpms Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. 2023-02-03 not yet calculated CVE-2021-36544 MISC tcpms -- tcpms Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page. 2023-02-03 not yet calculated CVE-2021-36545 MISC kitecms -- kitecms Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL. 2023-02-03 not yet calculated CVE-2021-36546 MISC fuel-cms -- fuel-cms Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2. 2023-02-03 not yet calculated CVE-2021-36569 MISC fuel-cms -- fuel-cms Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. 2023-02-03 not yet calculated CVE-2021-36570 MISC yzmcms -- yzmcms Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function. 2023-02-03 not yet calculated CVE-2021-36712 MISC MISC modern_honey_network -- modern_honey_network Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API. 2023-02-03 not yet calculated CVE-2021-37234 MISC jeecg -- jeecg An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface. 2023-02-03 not yet calculated CVE-2021-37304 MISC jeecg -- jeecg An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin. 2023-02-03 not yet calculated CVE-2021-37305 MISC jeecg -- jeecg An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: api uri:/sys/user/checkOnlyUser?username=admin. 2023-02-03 not yet calculated CVE-2021-37306 MISC fcitx5 -- fcitx5 Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listening port. 2023-02-03 not yet calculated CVE-2021-37311 MISC MISC asus -- rt-ac68u Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations. 2023-02-03 not yet calculated CVE-2021-37315 MISC asus -- rt-ac68u SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view sensitive information via /etc/shadow. 2023-02-03 not yet calculated CVE-2021-37316 MISC asus -- rt-ac68u Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the target for COPY and MOVE operations. 2023-02-03 not yet calculated CVE-2021-37317 MISC pbootcms -- pbootcms SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request. 2023-02-03 not yet calculated CVE-2021-37497 MISC MISC hdfgroup -- hdf5-h5dump Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sprint in /hdf5/tools/lib/h5tools_str.c. 2023-02-03 not yet calculated CVE-2021-37501 MISC MISC automad -- automad Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user. 2023-02-03 not yet calculated CVE-2021-37502 MISC vimium_extension -- vimium_extension Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via omnibar feature. 2023-02-03 not yet calculated CVE-2021-37518 MISC MISC memcached -- memcached Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file. 2023-02-03 not yet calculated CVE-2021-37519 MISC MISC hp -- bios Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities. 2023-02-01 not yet calculated CVE-2021-3808 MISC hp -- bios Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities. 2023-02-01 not yet calculated CVE-2021-3809 MISC nyuccl -- psiturk A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has been disclosed to the public and may be used. Upgrading to version 3.2.1 is able to address this issue. The name of the patch is 47787e15cecd66f2aa87687bf852ae0194a4335f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-219676. 2023-01-28 not yet calculated CVE-2021-4315 MISC MISC MISC MISC MISC wireguard -- wireguard WireGuard, such as WireGuard 0.5.3 on Windows, does not fully account for the possibility that an adversary might be able to set a victim's system time to a future value, e.g., because unauthenticated NTP is used. This can lead to an outcome in which one static private key becomes permanently useless. 2023-01-29 not yet calculated CVE-2021-46873 MISC schneider_electric -- ecostruxure_power_commission A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) 2023-01-30 not yet calculated CVE-2022-0223 MISC nemo-appium -- nemo-appium Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies. 2023-01-31 not yet calculated CVE-2022-21129 MISC MISC MISC ibm -- tivoli_workload_scheduler IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328. 2023-02-03 not yet calculated CVE-2022-22486 MISC MISC schneider_electric -- ecostruxure_power_commission A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) 2023-01-30 not yet calculated CVE-2022-22731 MISC schneider_electric -- ecostruxure_power_commission A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) 2023-01-30 not yet calculated CVE-2022-22732 MISC schneider_electric -- igss_data_server A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073) 2023-02-01 not yet calculated CVE-2022-2329 MISC ip-label -- newtest The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE. 2023-01-30 not yet calculated CVE-2022-23334 MISC MISC MISC hp_inc -- hp_support_assistant Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. 2023-02-01 not yet calculated CVE-2022-23453 MISC hp_inc -- hp_support_assistant Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. 2023-02-01 not yet calculated CVE-2022-23454 MISC hp_inc -- hp_support_assistant Potential security vulnerabilities have been identified in HP Support Assistant. These vulnerabilities include privilege escalation, compromise of integrity, allowed communication with untrusted clients, and unauthorized modification of files. 2023-02-01 not yet calculated CVE-2022-23455 MISC grafana -- grafana Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire another user’s session. To mitigate the vulnerability you can disable datasource query caching for all datasources. This issue has been patched in versions 9.2.10 and 9.3.4. 2023-02-03 not yet calculated CVE-2022-23498 MISC grafana -- grafana Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix. 2023-01-27 not yet calculated CVE-2022-23552 MISC MISC MISC MISC MISC schneider_electric – igss_data_server_igssdataserverexe A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073) 2023-02-01 not yet calculated CVE-2022-24324 MISC symfony -- symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4. 2023-02-03 not yet calculated CVE-2022-24894 MISC MISC symfony -- symfony Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch. 2023-02-03 not yet calculated CVE-2022-24895 MISC MISC MISC MISC apache -- portable_runtime_utility   Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0. 2023-01-31 not yet calculated CVE-2022-24963 MISC apache -- portable_runtime_utility Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. 2023-01-31 not yet calculated CVE-2022-25147 MISC wordpress -- wordpress The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key 2023-02-02 not yet calculated CVE-2022-2546 MISC cache_semantics -- cache_semantics This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library. 2023-01-31 not yet calculated CVE-2022-25881 MISC MISC MISC snyk -- is-http2 All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function. 2023-02-01 not yet calculated CVE-2022-25906 MISC MISC snyk -- mt7688-wiscan Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function. 2023-02-01 not yet calculated CVE-2022-25916 MISC MISC MISC snyk -- servst Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. 2023-01-30 not yet calculated CVE-2022-25936 MISC MISC MISC snyk -- eta Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data. 2023-01-30 not yet calculated CVE-2022-25967 MISC MISC MISC MISC snyk -- jsuites Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function. 2023-01-31 not yet calculated CVE-2022-25979 MISC MISC MISC MISC ami -- megarac_spx-12 AMI Megarac Password reset interception via API 2023-01-30 not yet calculated CVE-2022-26872 MISC hp -- bios Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities. 2023-02-01 not yet calculated CVE-2022-27537 MISC hp -- bios A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability. 2023-02-01 not yet calculated CVE-2022-27538 MISC apache -- portable_runtime_utility On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow. 2023-01-31 not yet calculated CVE-2022-28331 MISC schneider_electric -- somachine_hvac A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software. Affected Products: SoMachine HVAC (Versions prior to V2.1.0), EcoStruxure Machine Expert – HVAC (Versions prior to V1.4.0) 2023-01-30 not yet calculated CVE-2022-2988 MISC toshiba -- storage_security_software Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtained via(local) password authentication module. 2023-01-31 not yet calculated CVE-2022-30421 MISC MISC MISC MISC landisgyr – e850_zmq200 All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values. 2023-02-01 not yet calculated CVE-2022-3083 MISC bestechnic -- bluetooth_mesh_sdk In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU. 2023-02-01 not yet calculated CVE-2022-30904 MISC cypress -- bluetooth_mesh_sdk_bsa0107_05.01.00-bx8-amesh-08 Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is pb_transport_handle_frag_. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered during mesh provisioning. Because there is no check for mismatched SegN and TotalLength in Transaction Start PDU. 2023-02-01 not yet calculated CVE-2022-31363 MISC cypress -- bluetooth_mesh_sdk_bsa0107_05.01.00-bx8-amesh-08 Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: affected function is lower_transport_layer_on_seg. ¶¶ In Cypress Bluetooth Mesh SDK, there is an out-of-bound write vulnerability that can be triggered by sending a series of segmented packets with inconsistent SegN. 2023-02-01 not yet calculated CVE-2022-31364 MISC cloud_foundry -- diego/cf_deployment   Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate. 2023-02-03 not yet calculated CVE-2022-31733 MISC notepad++ -- notepad++ Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). 2023-02-01 not yet calculated CVE-2022-31902 MISC MISC dell -- bios Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable. 2023-02-01 not yet calculated CVE-2022-32482 MISC schneider_electric -- canbrass A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command which exploits this vulnerability is utilized. Affected Products: CanBRASS (Versions prior to V7.5.1) 2023-01-30 not yet calculated CVE-2022-32512 MISC schneider_electric -- multiple_products A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) 2023-01-30 not yet calculated CVE-2022-32513 MISC schneider_electric -- multiple_products A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0) 2023-01-30 not yet calculated CVE-2022-32514 MISC schneider_electric -- context_combox A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form. Affected Products: Conext™ ComBox (All Versions) 2023-01-30 not yet calculated CVE-2022-32515 MISC schneider_electric -- context_combox A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product suffers from POST-Based Cross-Site Request Forgery (CSRF). Affected Products: Conext™ ComBox (All Versions) 2023-01-30 not yet calculated CVE-2022-32516 MISC schneider_electric -- context_combox A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into interacting with the application in an unintended way when the product does not implement restrictions on the ability to render within frames on external addresses. Affected Products: Conext™ ComBox (All Versions) 2023-01-30 not yet calculated CVE-2022-32517 MISC schneider_electric -- data_center_expert A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32520. Affected Products: Data Center Expert (Versions prior to V7.9.0) 2023-01-30 not yet calculated CVE-2022-32518 MISC schneider_electric -- data_center_expert A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. Affected Products: Data Center Expert (Versions prior to V7.9.0) 2023-01-30 not yet calculated CVE-2022-32519 MISC schneider_electric -- data_center_expert A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party. This CVE is unique from CVE-2022-32518. Affected Products: Data Center Expert (Versions prior to V7.9.0) 2023-01-30 not yet calculated CVE-2022-32520 MISC schneider_electric -- data_center_expert A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server. Affected Products: Data Center Expert (Versions prior to V7.9.0) 2023-01-30 not yet calculated CVE-2022-32521 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted mathematically reduced data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32522 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted online data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32523 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted time reduced data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32524 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32525 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted setting value messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32526 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm cache data messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32527 MISC schneider_electric -- igss_data_server A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read files in the IGSS project report directory when an attacker sends specific messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32528 MISC schneider_electric -- igss_data_server A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted log data request messages. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22170) 2023-01-30 not yet calculated CVE-2022-32529 MISC schneider_electric -- ecostruxure_cybersecurity_admin_expert   A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2) 2023-01-30 not yet calculated CVE-2022-32747 MISC schneider_electric -- ecostruxure_cybersecurity_admin_expert A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert (CAE) (Versions prior to 2.2) 2023-01-30 not yet calculated CVE-2022-32748 MISC btcpay_server -- btcpay_server BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed. 2023-01-31 not yet calculated CVE-2022-32984 MISC mitsubishi_electric_corporation -- multiple_products Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section. 2023-02-02 not yet calculated CVE-2022-33323 MISC MISC MISC biltema -- ip/baby_camera_software Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information. 2023-02-03 not yet calculated CVE-2022-34138 MISC MISC dell – openmanage_server_administrator Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges. Exploitation may lead to a complete system compromise. 2023-02-01 not yet calculated CVE-2022-34396 MISC dell -- bios   Dell BIOS contains a Time-of-check Time-of-use vulnerability. A local authenticated malicious user couldu00a0potentially exploit this vulnerability by using a specifically timed DMA transaction during an SMI to gain arbitrary code execution on the system. 2023-02-01 not yet calculated CVE-2022-34398 MISC dell -- bios   Dell BIOS contains a heap buffer overflow vulnerability. A local attacker with admin privileges could potentially exploit this vulnerability to perform an arbitrary write to SMRAM during SMM. 2023-02-01 not yet calculated CVE-2022-34400 MISC dell -- bios   Dell BIOS contains a Stack based buffer overflow vulnerability. A local authenticated attacker could potentially exploit this vulnerability by using an SMI to send larger than expected input to a parameter to gain arbitrary code execution in SMRAM. 2023-02-01 not yet calculated CVE-2022-34403 MISC dell -- rugged _control_center Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. A Local Low Privilege attacker could potentially exploit this vulnerability, leading to an Escalation of privileges. 2023-02-01 not yet calculated CVE-2022-34443 MISC dell -- multiple_products Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in download operation component. A local malicious user could potentially exploit this vulnerability leading to the disclosure of confidential data. 2023-02-01 not yet calculated CVE-2022-34458 MISC dell -- multiple_products Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature in get applicable driver component. A local malicious user could potentially exploit this vulnerability leading to malicious payload execution. 2023-02-01 not yet calculated CVE-2022-34459 MISC lenovo -- xclarity_controller A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service. 2023-01-30 not yet calculated CVE-2022-34884 MISC motorola -- mr2600 An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code. 2023-01-30 not yet calculated CVE-2022-34885 MISC lenovo -- xclarity_controller The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect. 2023-01-30 not yet calculated CVE-2022-34888 MISC pesign -- pesign A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. 2023-02-02 not yet calculated CVE-2022-3560 MISC wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin

Read more »

KrebsOnSecurity in Upcoming Hulu Series on Ashley Madison Breach
KrebsOnSecurity will likely have a decent amount of screen time in an upcoming Hulu documentary series about the 2015 megabreach at marital infidelity site Ashley Madison. While I can't predict what the producers will do with the video interviews we shot, it's fair to say the series will explore tantalizing new clues as to who may have been responsible for the attack.

Read more »

The New HomePod Brings a New Sound and More Home Smarts
The new HomePod sounds better than the original, but still lacks in some areas. Its smart home features get a boost. The post appeared first on The Mac Security Blog.

Read more »

Everything you can do with the Apple HomePod
The HomePod does a lot more than play music. Learn how to set it up, and how to use it with Siri to perform a number of useful tasks. The post appeared first on The Mac Security Blog.

Read more »

Finland’s Most-Wanted Hacker Nabbed in France
Julius "Zeekill" Kivimäki, a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding since October 2022, when he failed to show up in court and Finland issued an international warrant for his arrest.

Read more »

Credential Stuffing, Pig Butchering, Security Keys for Your Apple Account, and the New Mac mini – Intego Mac Podcast Episode 277
This week's threats involve credential stuffing and pig butchering, and we examine whether you should use security keys to protect your Apple ID account, and why the new Mac mini is a maxi computer. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of January 23, 2023
Original release date: January 30, 2023 | Last revised: January 31, 2023  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22240 MISC adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22241 MISC adobe -- acrobat_reader Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-01-27 7.8 CVE-2023-22242 MISC assimp -- assimp An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/ColladaParser.cpp. 2023-01-20 8.8 CVE-2022-45748 MISC ays-pro -- survey_maker The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parameter of its 'ays_surveys_export_json' action. 2023-01-20 8.8 CVE-2023-23490 MISC cisco -- cx_cloud_agent A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. This vulnerability is due to insecure file permissions. An attacker could exploit this vulnerability by persuading support to update settings which call the insecure script. A successful exploit could allow the attacker to take complete control of the affected device. 2023-01-20 7.3 CVE-2023-20044 MISC cisco -- identity_services_engine A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands. A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user. Cisco has not yet released software updates that address this vulnerability. 2023-01-20 8.8 CVE-2022-20964 MISC cisco -- roomos A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are in the local file system. An attacker could exploit this vulnerability by placing a symbolic link in a specific location on the local file system of an affected device. A successful exploit could allow the attacker to overwrite arbitrary files on the affected device. 2023-01-20 7.1 CVE-2023-20008 MISC contec -- conprosys_hmi_system Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to alter user credentials information. 2023-01-20 7.5 CVE-2023-22331 MISC MISC MISC MISC contec -- conprosys_hmi_system Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypass access restriction and obtain the server certificate including the private key of the product. 2023-01-20 7.5 CVE-2023-22339 MISC MISC MISC MISC electerm_project -- electerm An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service. 2023-01-20 9.8 CVE-2020-23256 MISC hcltech -- bigfix_mobile HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts. 2023-01-20 7.5 CVE-2021-27782 MISC hospital_management_system_project -- hospital_management_system SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php. 2023-01-20 9.8 CVE-2022-48120 MISC inxedu -- inxedu SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction. 2023-01-20 9.8 CVE-2020-21152 MISC MISC login_with_phone_number_project -- login_with_phone_number The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. 2023-01-20 8.8 CVE-2023-23492 MISC mangboard -- mangboard_wp SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin board. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running. 2023-01-20 9.8 CVE-2021-26644 MISC mariadb -- mariadb MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer. 2023-01-20 7.5 CVE-2022-47015 MISC microsoft -- edge Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. 2023-01-24 8.3 CVE-2023-21775 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21796. 2023-01-24 8.3 CVE-2023-21795 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2023-21795. 2023-01-24 8.3 CVE-2023-21796 MISC misp-project -- misp In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function. 2023-01-20 9.8 CVE-2023-24028 MISC online_food_ordering_system_project -- online_food_ordering_system Multiple SQL Injection vulnerabilies in tourist5 Online-food-ordering-system 1.0. 2023-01-20 9.8 CVE-2020-29297 MISC MISC MISC remoteclinic -- remote_clinic SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php. 2023-01-20 9.8 CVE-2022-48152 MISC reprisesoftware -- reprise_license_manager Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server. 2023-01-20 8.1 CVE-2021-37500 MISC MISC MISC sandhillsdev -- easy_digital_downloads The Easy Digital Downloads WordPress Plugin, version < 3.1.0.4, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action. 2023-01-20 9.8 CVE-2023-23489 MISC solarwinds -- database_performance_analyzer In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. 2023-01-20 7.5 CVE-2022-38112 MISC MISC solarwinds -- dynamips Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. 2023-01-20 7.5 CVE-2022-47012 MISC strangerstudios -- paid_memberships_pro The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. 2023-01-20 9.8 CVE-2023-23488 MISC tenable -- nessus A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1. An authenticated attacker could potentially execute a specially crafted file to obtain root or NT AUTHORITY / SYSTEM privileges on the Nessus host. 2023-01-20 8.8 CVE-2023-0101 MISC MISC tmux_project -- tmux A null pointer dereference issue was discovered in function window_pane_set_event in window.c in tmux 3.0 thru 3.3 and later, allows attackers to cause denial of service or other unspecified impacts. 2023-01-20 7.8 CVE-2022-47016 MISC MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48121 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48122 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function. 2023-01-20 9.8 CVE-2022-48123 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48124 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48125 MISC totolink -- a7100ru_firmware TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function. 2023-01-20 9.8 CVE-2022-48126 MISC tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of U3D files. Crafted data in a U3D file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18893. 2023-01-26 7.8 CVE-2022-42394 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. Crafted data in an XPS file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18274. 2023-01-26 7.8 CVE-2022-42395 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of XPS files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18278. 2023-01-26 7.8 CVE-2022-42396 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18327. 2023-01-26 7.8 CVE-2022-42399 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18328. 2023-01-26 7.8 CVE-2022-42400 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in an embedded U3D object can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18632. 2023-01-26 7.8 CVE-2022-42402 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18892. 2023-01-26 7.8 CVE-2022-42403 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EMF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18367. 2023-01-26 7.8 CVE-2022-42405 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PGM files. Crafted data in a PGM file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18365. 2023-01-26 7.8 CVE-2022-42410 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. Crafted data in a JP2 file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18366. 2023-01-26 7.8 CVE-2022-42415 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18673. 2023-01-26 7.8 CVE-2022-42416 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18676. 2023-01-26 7.8 CVE-2022-42417 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18677. 2023-01-26 7.8 CVE-2022-42418 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18700. 2023-01-26 7.8 CVE-2022-42419 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18686. 2023-01-26 7.8 CVE-2022-42420 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18703. 2023-01-26 7.8 CVE-2022-42421 N/A N/A tracker-software -- pdf-xchange_editor This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF files. Crafted data in a TIF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-18716. 2023-01-26 7.8 CVE-2022-42423 N/A N/A trendmicro -- maximum_security_2022 A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location and in the process of removal and restoral an attacker could replace an original folder with a mount point to an arbitrary location, allowing a escalation of privileges on an affected system. 2023-01-20 7 CVE-2022-48191 MISC MISC uber -- kraken kraken

Read more »

Apple’s 2023 Mac mini is a Mini Mac Studio
Apple's new M2 Mac mini offers a wide range of configuration options. The post appeared first on The Mac Security Blog.

Read more »

How to protect your Apple ID account with Security Keys on iPhone, iPad, or Mac
You can now protect your Apple ID account with a security key, a hardware device that acts as a second factor for two-factor authentication. But should you? The post appeared first on The Mac Security Blog.

Read more »

The Year in Mac Malware 2022 – Intego Mac Podcast Episode 276
Apple has updated all its operating systems again, and even issued a security update for iOS 12. We discuss new features in the HomePod software, and we look back at the notable Mac malware of 2022. The post appeared first on The Mac Security Blog.

Read more »

Experian Glitch Exposing Credit Files Lasted 47 Days
On Dec. 23, 2022, KrebsOnSecurity alerted big-three consumer credit reporting bureau Experian that identity thieves had worked out how to bypass its security and access any consumer's full credit report -- armed with nothing more than a person's name, address, date of birth, and Social Security number. Experian fixed the glitch, but remained silent about the incident for a month. This week, however, Experian acknowledged that the security failure persisted for nearly seven weeks, between Nov. 9, 2022 and Dec. 26, 2022.

Read more »

Get a new 13-inch M1 MacBook Air at Apple today for as low as $849
Apple has 13″ M1 MacBook Airs, Certified Refurbished, available today starting at only $849 for 8-Core CPU/7-Core GPU/256GB models and $1059 for 8-Core CPU/8-Core GPU/512GB models. These are the cheapest M1-powered MacBooks for sale at Apple and also the best deal on MacBooks available anywhere. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook […] The post first appeared on MacPrices.net.

Read more »

Apple Education is offering $100 discounts on 13″ MacBook Pros with M2 processors
Need a new Apple MacBook for school? Whether you’re a student, teacher, or staff member, you can use your .edu email address when ordering at Apple Education to take $100 off the price of a 13″ MacBook Pro with an Apple M2 CPU. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount, including parents of students. […] The post first appeared on MacPrices.net.

Read more »

Week’s Best Deals: Clearance 14″ M1 Pro MacBook Pros for only $1699
B&H Photo recently dropped prices on Apple’s previous-generation 14″ M1 Pro MacBook Pros by as much as $400 off original MSRP, with prices now available starting at $1699. Free 1-2 day shipping is available to most US addresses: – 14″ MacBook Pro M1 Pro/8-Core CPU/16GB RAM/512GB SSD/Gray: $1699, $300 off MSRP – 14″ MacBook Pro M1 Pro/8-Core CPU/16GB RAM/512GB SSD/Silver: $1699, $300 off MSRP – […] The post first appeared on MacPrices.net.

Read more »

How Apple has combined features of macOS and iOS and their rumored plans to potentially combine the two operating systems
Apple’s Mac operating system (now termed macOS) has grown considerably from its early days and it’s now one of the most popular desktop operating systems in the world. In fact, according to research firm NetMarketShare, which tracks usage statistics for software across web browsers and devices, macOS was the most popular desktop OS globally in April 2018. Apple has continued to add new features to […] The post first appeared on MacPrices.net.

Read more »

24″ M1 iMacs with 8-Core GPUs on sale for $200 off Apple’s MSRP
Amazon has Apple’s 24″ M1 iMacs with 8-Core GPUs on sale for $200 off MSRP. Their prices are currently the lowest available for these iMacs among the Apple retailers we track: – 24″ M1 iMacs (8-Core CPU/8-Core GPU/256GB SSD): $1299.99 $200 off MSRP – 24″ M1 iMacs (8-Core CPU/8-Core GPU/512GB SSD): $1499.99 $200 off MSRP Be sure to make your purchase from Amazon, rather than […] The post first appeared on MacPrices.net.

Read more »

Apple iPad minis are on sale for $100-$110 off MSRP
Amazon is offering Apple’s 8.3″ WiFi iPad minis for $100-$110 off MSRP including free shipping. Prices start at $399. Amazon’s prices are the lowest currently available for these minis from any Apple retailer we track: – 64GB WiFi iPad mini 5 (all colors): $399.99 $100 off MSRP – 256GB WiFi iPad mini 5 (all colors): $539.99 $110 off MSRP For the latest prices and sale, […] The post first appeared on MacPrices.net.

Read more »

Get an Apple Pencil 2 today for 30% off MSRP, save $40
Amazon has the Apple Pencil 2 on sale for $40 (30%) off MSRP for a limited time. Shipping is free: – Apple Pencil 2: $89.99 $40 off MSRP (30%) Their discount reduces the price of this Pencil to $10 below that of the Apple Pencil 1. For the latest prices and sales, keep an eye on our Apple Pencil Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Get an Apple Pencil 2 today for 30% off MSRP, save $40
Amazon has the Apple Pencil 2 on sale for $40 (30%) off MSRP for a limited time. Shipping is free: – Apple Pencil 2: $89.99 $40 off MSRP (30%) Their discount reduces the price of this Pencil to $10 below that of the Apple Pencil 1. For the latest prices and sales, keep an eye on our Apple Pencil Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Get an Apple Pencil 2 today for 30% off MSRP, save $40
Amazon has the Apple Pencil 2 on sale for $40 (30%) off MSRP for a limited time. Shipping is free: – Apple Pencil 2: $89.99 $40 off MSRP (30%) Their discount reduces the price of this Pencil to $10 below that of the Apple Pencil 1. For the latest prices and sales, keep an eye on our Apple Pencil Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch SE GPS models on sale for $30 off MSRP
Amazon has for a limited time, each including free shipping. Their prices are the lowest currently available for SE Watches: – 40mm Apple Watch SE GPS: $219.99, save $30 – 44mm Apple Watch SE GPS: $249.99, save $30 Note that their sale prices may be restricted to certain band colors, and stock is likely […] The post first appeared on MacPrices.net.

Read more »

Sunday Sale: Apple AirPods Pro for $199, save $50
Amazon has new 2022 Apple AirPods Pro on sale for $199.99 including free shipping. Their price is $50 off MSRP, and it’s currently the lowest price available for new AirPods Pro from any of the retailers we track. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple exploring the possibility of adding a high-end iPhone to its lineup
Mark Gurman, in this weeks’s Power On newsletter discusses a comment made by Apple Inc. CEO Tim Cook during Apple’s most recent earnings call that could be a clue to the company’s future. When asked if the mounting average price of the iPhone was sustainable, Cook expressed that the cost increase would not be an issue; in fact, it seemed that he believed consumers could […] The post first appeared on MacPrices.net.

Read more »