Get your favorite film or TV fan a TeeVee subscription for just $39.99
Macworld If you know someone who can spend hours scrolling through Netflix looking for something new to watch, here’s a gift idea that can help them get all those hours back. But just so we’re clear – TeeVee is no simple media tracking app. It’s a curated approach to watching movies and TV, helping viewers personalize their media consumption so they’ll always know what film or TV show to watch next. With a cutting-edge intuitive design and interface, the TeeVee app basically serves as a media concierge, guiding users to movies and shows that suit their specific taste, cultivating a watch list, and making sure no one ever thinks “there’s nothing to watch” ever again. This fluidly simple app keeps track of the shows a member watches, alerts them when new episodes are available, and guides them to the streaming service that is hosting those episodes. And while most apps focus exclusively on either film or television, TeeVee handles both, integrating all of your viewing together. But TeeVee has a mind of its own too. Based on trending items, TeeVee will make personalized recommendations for the next binge session, then use individual watchlists to help map a viewer’s personal journey to all the best films and shows. At a glance, a viewer can see what they’ve watched, and all the video treasures they still need to dive into. With an impressive 4.8 out of 5-star rating among users in the Apple App Store, TeeVee is dedicated to ending the practice of binge scrolling once and for all. Regularly $89.97, you can get a lifetime subscription to a TeeVee Premium membership for yourself or your favorite cinephile or TV junkie now at more than half off, down to just $39.99 during this limited-time, best-price-on-the-web sale.   TeeVee Premium: Lifetime Subscription – $39.99 Watch everything for $39.99 Prices subject to change. Accessories

Read more »

Apple highlights Smart Portrait Mode in new iPhone 15 ad
After sharing a video promoting the Personal Voice feature introduced this year with iOS 17, Apple has now published another video on its YouTube channel. More specifically, there’s a new ad for the iPhone 15 that shows the Smart Portrait Mode feature in action. more…

Read more »

WebKit Zero-Day Vulnerabilities Prompt iOS 17.1.2, iPadOS 17.1.2, macOS 14.1.2, and Safari 17.1.2
Apple has released updates to iOS, iPadOS, macOS, and Safari to block a pair of WebKit vulnerabilities that have been exploited in the wild. Don’t panic, but update soon.

Read more »

Space soap opera For All Mankind hits stride in ‘House Divided’ episode [Apple TV+ recap] ★★★☆☆
But hey, "For All Mankind" isn't just a soap opera, so our recaps aren't just running lists of characters who either get killed or laid. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Buy Apple-refurbished AirPods Pro 2 and save $40
Apple began selling refurbished AirPods Pro 2 wireless earbuds on Friday. Those willing to buy a previously-purchased unit save $40 off the regular cost. These are Apple’s premium earbuds, and this is the first time the company has put refurb units up for sale. Apple wireless earbuds with all the bells and whistles AirPods Pro […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Hidden tricks to customize the new Messages design in iOS 17
One of the more noticeable design changes in iOS 17 this year is in the Messages app. Apple has revamped the interface and moved access to iMessage apps and shortcuts to a new pop-up menu. Here’s a closer look at these changes, with a trick to get one-tap access to the Photos picker. more…

Read more »

Best Buy slashes M2 MacBook Air prices to as low as $899 today only
Holiday deals are in full swing on Apple's M2 MacBook Air, with Apple retailers engaging in a price war that offers shoppers discounts of up to $200 off and prices as low as $899.Enjoy rock-bottom pricing on Apple's MacBook AirShopping for a fantastic holiday gift just got more affordable at Best Buy this weekend, as the Apple retailer has slashed prices on current M2 MacBook Air models — with prices dipping to as low as $899. Read more...

Read more »

tvOS 17.2 changes the behavior of the Siri button on the Apple TV Remote
Apple has been running tests with tvOS 17.2 beta for some time now, and the update brings changes to the Apple TV operating system – and it looks like Apple is still tweaking a few things. With the latest beta of tvOS 17.2 available to developers, the company has changed the behavior of the Siri button on the Apple TV Remote. more…

Read more »

Create perfect AI voiceovers for your content with Micmonster
AI-powered voiceover tool Micmonster can give your projects greater professionalism. Get voiceovers on demand with a lifetime subscription. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

AirPods not working? Here are 5 ways to fix them
AirPods not working? Whether you’re having issues getting them connected or with charging, trouble with sound, or something else, follow along for 5 ways to fix AirPods. more…

Read more »

Apple Music celebrates Artist of the Year, Taylor Swift, with free ‘Eras Experience’
Apple Music is celebrating its Artist of the Year, Taylor Swift, with a free "Eras Experience" in New York City… The post appeared first on MacDailyNews.

Read more »

Apple Music to host event honoring Taylor Swift as its 2023 Artist of the Year
Apple unveils 'Taylor Swift's Eras: The Experience,' a celebration of Swift's 2023 Apple Music Artist of the Year award, inviting fans to immerse themselves in the artist's iconic journey through 10 eras in New York City.Apple has announced an event called "Taylor Swift's Eras: The Experience" to honor the singer's recognition as the 2023 Apple Music Artist of the Year. This award is a testament to Swift's incredible accomplishments in 2023, which include the hugely successful Eras tour and the release of "1989 (Taylor's Version)."Taking place in New York City on December 8 and December 9, Apple Music extends an invitation to all "Swifties" to join the festivities. The event promises an immersive celebration of Taylor Swift's musical journey, featuring ten distinct set pieces that encapsulate the essence of Swift's ten eras. Read more...

Read more »

Washington D.C. police commander: AirTag your $2,000 Canada Goose jacket to deter thieves
Last winter, George Washington University sent out an alert about a string of Canada Goose jacket thefts and robberies that are continuing… The post appeared first on MacDailyNews.

Read more »

Apple celebrating Taylor Swift with free ‘Eras Experience’ in New York City
Taylor Swift was crowned the “Apple Music Artist of the Year” a few weeks ago, and the festivities aren’t stopping anytime soon. Apple today announced that it will be holding a free “Taylor Swift Eras Experience” in New York City next week on December 8 and December 9. Apple is quick to point out, however, that Taylor Swift herself won’t be in attendance. more…

Read more »

Proton Sentinel arrives for Proton Pass Plus users, secures accounts even when credentials are stolen
Continuing with its mission to provide the most private and secure services, Proton is out today with the expansion of its Proton Sentinel security program. The feature comes to Proton Pass Plus users for free and delivers the company’s highest level of protection that can secure your Proton account even if your login credentials are compromised. more…

Read more »

Apple stock could perform better than usual this December
Since 1981, December ranks as the third worst month for Apple stock, according to Dow Jones Market Data, but there are reasons why… The post appeared first on MacDailyNews.

Read more »

Apple now selling refurbished AirPods Pro 2 in the US, but only with Lightning case
Last month, Apple started selling refurbished AirPods Pro 2 for the first time – but only in Europe. Starting today, however, refurbished AirPods Pro 2 are available in the United States at $209. That’s a $40 discount compared to how much AirPods Pro cost brand new. Apple only began selling refurbished AirPods back in August, starting with AirPods 3. Prior to August, refurbished AirPods had never been available from Apple. more…

Read more »

HomeKit Weekly: Leviton delivers a Matter-enabled outdoor smart plug in preparation for Christmas decorations
As summer turns to fall, I am already starting to see retail stores slowly bring out some Christmas items, and there’s one thing that you need to have ready to go ahead of time – an outdoor smart plug. For outdoor Christmas decorations, Christmas trees, etc. – smart plugs that can handle moisture and cold weather are a must-have. Recently, Leviton delivered a . more…

Read more »

Paramount surges on report it’s in talks to bundle streaming service with Apple TV+
Paramount Global (PARA) shares jumped Friday following a report that suggested the group is in talks to bundle its content with Apple TV+… The post appeared first on MacDailyNews.

Read more »

Amazon previewing iOS-only smart home mapping feature in redesigned Alexa app
The Amazon Alexa app isn’t just for configuring and managing service integrations. It’s also a smart home controller akin to Apple’s Home app. Amazon is putting that front and center with the redesigned Alexa app launching today. There’s also a new smart home mapping feature that’s exclusive to iOS devices. more…

Read more »

9to5Mac Daily: December 1, 2023 – iPhone 16 rumors, third-party app stores
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Dreametech: Check out Dreametech’s ultra-intelligent AI vacuuming and mopping solutions, now available with a 40% discount on selected models, offering savings of up to $450! more…

Read more »

If you missed it on Black Friday, the Apple Watch Series 9 is back to its all-time low
Macworld The Apple Watch Series 9 was on sale at Amazon over Black Friday for a new all-time low of $70 off, but if you missed it, it’s back: Amazon is selling the 41mm Apple Watch Series 9 for $329 and the 45mm Apple Watch Series 9 for $379 (after a coupon is applied), a savings of $70 each and the lowest price we’ve seen. The Apple Watch Series 9 has a new S9 chip that’s faster and smarter than previous generations with a new four-core Neural Engine. It also has the new double-tap gesture that lets you control apps without touching the screen. And of course, you’re getting an excellent 41mm or 45mm display and an incredible array of sensors, including heart rate, ECG, blood-oxygen, and temperature, as well as all-day battery life, 50 meters of water resistance, Emergency SOS and Crash Detection. In our  review of the Apple Watch Series 9, we called it “the best general-purpose smartwatch Apple has ever made.” And at this all-time low price, it can’t be beat. Apple Watch

Read more »

GraphicConverter 12.0.8
Brings new features, improvements, and bug fixes to the Swiss Army knife of graphics programs. ($39.95 new, free update, 257.6 MB, macOS 10.13+)

Read more »

Apple warns billions of users of actively exploited zero-day vulnerability
Macworld In case you didn’t read the subhead, if you have an iPhone, iPad, or Mac, you need to update it right now. Apple has released iOS and iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1 for macOS Monterey and macOS Ventura to patch two extremely critical WebKit flaws affecting Safari on the Mac and every browser on the iPhone and iPad. Apple reports that the zero-day (meaning it was previously unknown to users and security researchers) “may have been exploited against versions of iOS before iOS 16.7.1,” which only arrived in November to fix a separate zero-day flaw. It’s unclear whether any instances of the vulnerability being exploited on the Mac have been recorded. It’s the 20th zero-day patch issued by Apple in 2023. Apple is also working on watchOS 10.2 and tvOS 17.2, which will presumably arrive within a week or two and contain the same patch. Both fixes affect WebKit and were discovered by Clément Lecigne of Google’s Threat Analysis Group: WebKit (CVE-2023-42916) Impact: Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: An out-of-bounds read was addressed with improved input validation. WebKit (CVE-2023-42917) Impact: Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1. Description: A memory corruption vulnerability was addressed with improved locking. Earlier this week, Google also issued an emergency update for Chrome on Mac, which patches seven security flaws, at least one of which has been known to have been exploited in the wild. To update your device, head over to Settings (iPhone or iPad) or System Settings (Mac), then General and Software Update. On older Macs, go to System Preferences, then Software Update. iOS, MacOS

Read more »

This M3 Max MacBook Pro 14-inch with 96GB RAM is down to $3,749, plus $50 off AppleCare
Apple's loaded M3 Max MacBook Pro in the gorgeous Space Black finish is $250 off right now when ordered with 96GB memory and a 1TB SSD. The M3 Max chip sports a 14-core CPU and 30-core GPU, making it a robust machine in a portable chassis.The exclusive deal is available on the high-end configuration when you enter promo code APINSIDER during Step 3 of checkout at Apple Authorized Reseller Adorama. This particular spec features Apple's premium M3 Max chip with 14-core CPU and 30-core GPU. Further future-proofing the laptop is the upgrade to 96GB of Unified Memory and 1TB of storage, making it a powerful workstation in a portable chassis.Use code APINSIDER Read more...

Read more »

Coming to Apple TV+: All the shows and movies coming to the streaming service
Macworld Apple’s list of currently available content for Apple TV+ continues to grow, and so does the list of upcoming projects in the works. Films, limited series, specials, and multi-season series—Apple’s got lots of irons in the fire.d Some of these projects have been officially announced and acknowledged by Apple, while others have been reported by the Hollywood press, which always has its ear to the ground about what projects actors, directors, and producers are involved in. We’ve divided this list in two: Coming Soon is a list of shows for which Apple has given an official release date or release window, and Further Out compiles content that is still in production or perhaps haven’t even begun yet. Updated 12/01/23: We’ve updated our list with the latest release dates and trailers. Apple TV 4K (2022, 3. Gen.) 128GB WiFi + Ethernet Read our review Price When Reviewed: 64GB – $129 | 128GB $149 Best Prices Today: $129 at Apple You don’t need an Apple TV set top box to watch Apple TV+, nor do you have to pay for a subscription, see: How to watch Apple TV+ for free. Coming Soon The following shows, series, and movies have been officially announced by Apple and will typically will begin streaming in the next few weeks or months. John Lennon: Murder Without a Trial What it’s about: For the first time, key figures from John Lennon’s life and death — including friends, doctors and investigators — share personal memories and reveal what happened on the night of his killing. Important names: Narrated by Kiefer Sutherland, directed by Nick Holt and Rod Coldstream. When you can watch: John Lennon: Murder Without a Trial streams on December 6, 2023. The Family Plan What it’s about: Dan Morgan was once an elite government assassin. Now decades later, he lives a quiet suburban family life. When enemies from his past track him down, he packs his unsuspecting wife, angsty teen daughter, pro-gamer teen son, and 10-month-old baby into their minivan on a cross-country vacation trip to Las Vegas. Apple Important names: Starring Mark Wahlberg and Michelle Monaghan, directed by Simon Cellan Jones. When you can watch: The Family Plan will stream on December 15, 2023. Criminal Record What it’s about: An eight-episode, one-hour series set in London. An anonymous phone call draws two brilliant detectives into a confrontation over an old murder case—one a young woman in the early stages of her career, the other a well-connected man determined to protect his legacy. Important names: Stars Peter Capaldi and Cush Jumbo, directed by Jim Loach. When you can watch: Criminal Record premieres on January 10, 2024. Masters of the Air What it’s about: Based on Donald L. Miller’s book of the same name, Masters of the Air follows the men of the 100th Bomb Group (the “Bloody Hundredth”) as they conduct perilous bombing raids over Nazi Germany and grapple with the frigid conditions, lack of oxygen and sheer terror of combat conducted at 25,000 feet in the air.  Important names: Starring Austin Butler, Callum Turner, Anthony Boyle, and Nate Mann, executive produced by Tom Hanks, Steven Spielberg, and Gary Goetzman. When you can watch: Masters of the Air will premiere on January 26, 2024. The New Look What it’s about: A limited series that Apple describes as, “an epic thriller set against the World War II Nazi occupation of Paris when Coco Chanel’s reign as the world’s most famous fashion designer ends and Christian Dior rises helping return spirit and life to the world with his groundbreaking, iconic imprint of beauty and influence that will go on to define generations to come.” Apple Important names: Written and executive produced by Todd A. Kessler, starring Ben Mendelsohn and Juliette Binoche. When you can watch: The New Look premieres on February 14, 2024. The Dynasty: New England Patriots What it’s about: A 10-part documentary event series about the New England Patriots, based on the New York Times bestselling book by author Jeff Benedict. Important names: Directed by Matthew Hamachek. When you can watch: The Dynasty will premiere on February 16, 2024. Napoleon What it’s about: A big historical action epic film about Napoleon Bonaparte.  Important names: Joaquin Phoenix is to star as Napoleon, Ridley Scott will direct. When you can watch: Napoleon will release into theaters on November 22, 2023. There has been no streaming date set yet. Killers of the Flower Moon What it’s about: Based on the book Killers Of The Flower Moon: The Osage Murders And The Birth Of The FBI. It tells the story of a series of murders of wealthy Osage Native Americans in Oklahoma in the 1920s after oil was found on their land. According to Deadline, Paramount will distribute the film in theaters, while it will be an Apple TV+ streaming exclusive. Important names: Directed by Martin Scorsese, with Leonardo DiCaprio and Robert De Niro in the leading roles. When you can watch: The film released in theaters on October 20, but a streaming release date has not yet been announced. Further Out These shows, series, and movies may or may not have been officially announced, and do not yet have definitive release dates. Some may debut in the next few months, others be more than a year away. It’s even possible that some of these projects will never be released. Argylle What it’s about: Follows the globe-trotting adventures of a super-spy named Argylle across the U.S., London and other exotic locations. Important names: An ensemble cast starring Henry Cavill, Bryce Dallas Howard, Sam Rockwell, Bryan Cranston, Catherine O’Hara, Dua Lipa and Ariana DeBose with John Cena and Samuel L. Jackson. When you can watch: Argylle will get a theatrical release on February 2, 2024. It will stream on Apple TV+ after that date (likely a month or two later). Camp Snoopy What it’s about: After discovering their troop is in danger of disbanding, Snoopy and the Beagle Scouts set off to the Great Outdoors to earn their performance badges, with the Beagle Scout Manual as their guide. Meanwhile, Charlie Brown and friends enjoy their summer at Camp Spring Lake, crossing paths with Snoopy as they experience everything camp and the outdoors have to offer. Important names: Features the same Peanuts characters we’ve known for decades. When you can watch: Camp Snoopy is a new series set to debut in 2024, with no release date yet. La Maison What it’s about: A family drama series about the life of an iconic French fashion house. Important names: Stars Lambert Wilson, Amira Casar, Carole Bouquet, Zita Hanro, and Pierre Deladonchamps. Directed by Fabrice Gobert and Daniel Grou alias Podz. When you can watch: La Maison does not yet have a release date. Carême What it’s about: A biography drama about Antonin Carême, the so-called first celebrity chef, who rose to stardom in the 19th century. While he dreams only of becoming the most famous chef in the world, his talent and ambitions attract the attention of renowned and powerful politicians, who use him as a spy for France. Important names: Benjamin Voisin stars as Carême, with Jérémie Renier and Lyna Khoudri co-staring. When you can watch: Carême does not yet have a release date. The Savant What it’s about: An eight-episode limited series inspired by a true story published by Cosmopolitan. The storyline and character details are being kept under wraps for now. Important names: Written and showrun by Melissa James Gibson, starring Jessica Chastain in the lead role. When you can watch: The Savant does not yet have a release date. Mere Mortals What it’s about: An eight-episode series of individual tales set in the world of Mythic Quest that will explore the lives of employees, players, and fans who are impacted by the game. It is said to be in the vein of Mythic Quest episodes “A Dark Quiet Death,” “Backstory!,” “Everlight,” and “Sarian.” Important names: The series is created by Mythic Quest writers Ashly Burch, John Howell Harris, and Katie McElhenney. When you can watch: Mere Mortals does not yet have a release date. Firebug What it’s about: A fictional drama series inspired by true events, Firebug will follow a troubled detective and an enigmatic arson investigator as they pursue the trails of two serial arsonists. Important names: Written and created by Dennis Lehane, starring Taron Egerton. When you can watch: Firebug does not yet have a release date. Untitled Vince Gilligan drama What it’s about: It is described as a “described as a blended, grounded genre drama,” which doesn’t tell us much. Important names: Vince Gilligan gave us Breaking Bad and Better Call Saul. Rhea Seehorn is attached to star in the lead role. When you can watch: This new series does not yet have a release date. Land of Women What it’s about: Based on Sandra Barneda’s bestselling novel of the same name. A six-episode dramedy about Gala, a New York empty nester whose life is turned upside down when her husband implicates the family in financial improprieties, and she is forced to flee the city alongside her aging mother and college-age daughter. Important names: Will star Eva Longoria and Carmen Maura. Directed by Carlos Sedes. When you can watch: Land of Women does not yet have a release date. Sugar What it’s about: Not much is known about the story yet, with Apple only calling it a “genre-bending series” and Deadline describes it as a “Los Angeles-based, contemporary take on the private detective story.” Important names: Starring Colin Farrell, directed by Fernando Meirelles, created by Mark Protosevich. When you can watch: Sugar has no release date yet. Untitled Formula One film starring Brad Pitt What it’s about: We don’t know much, other than that Apple says “Brad Pitt stars as a driver who comes out of retirement to compete alongside a rookie driver against the titans of the sport.” Important names: Brad Pitt stars, with Joseph Kosinski directing, and seven-time Formula One champion Sir Lewis Hamilton producing. When you can watch: The film does not yet have a release date. Speed Racer What it’s about: A live-action series based on the beloved Japanese animated show from the ’60s. Important names: Will be produced by J.J. Abrams’ Bad Robot production company, with Hiram Martinez and Ron Fitzgerald as writers and showrunners. When you can watch: Speed Racer has no release date yet. Las Azules What it’s about: A 10-episode crime drama series set in 1970 and based on the true stories of Mexico’s first female police force. Important names:  Fernando Rovzar and Pablo Aramendi serve as directors and showrunners. Starring Bárbara Mori. When you can watch: Las Azules is in production but does not yet have a release date. Untitled Noel Fielding comedy series What it’s about: A comedy series about the legendary British highwayman Dick Turpin. Important names: Stars Noel Fielding, directed by Ben Palmer. When you can watch: This series does not have a release date yet, nor a title. The White Darkness What it’s about: A limited series based on David Grann’s nonfiction book about Henry Worsley, who crossed Antarctica on foot. Important names: Tom Hiddleston stars, Soo Hugh directs. When you can watch: The White Darkness has no release date yet. The Big Cigar What it’s about: A six-episode limited series that tells the story of how Black Panther leader Huey P. Newton relied on his best friend Bert Schneider, the Hollywood producer behind “Easy Rider,” to elude a nationwide manhunt and escape to Cuba while being pursued into exile by the FBI. Important names: Janine Sherman Barrois, Don Cheadle, Jim Hecht, and Joshuah Bearman, are on on board as producers. Don Cheadle will also direct the first two episodes. André Holland is in discussions to star. When you can watch: The Big Cigar does not yet have a release date. Constellation What it’s about: A thriller about Jo, a woman who returns to Earth after a disaster in space only to discover that key pieces of her life seem to be missing. Important names: The series will star Noomi Rapace and Jonathan Banks. When you can watch: Constellation does not yet have a release date. Dark Matter What it’s about: A series based on the novel Dark Matter; an alternate-universe thriller about a man who is abducted, drugged, and wakes up in a reality in which he made different choices in the past. Important names: The series is being adapted as a series by the author Blake Crouch and stars Joel Edgerton. When you can watch: No release date yet. Untitled Lewis Hamilton documentary What it’s about: A feature documentary about the groundbreaking life and career of seven-time Formula One world champion Lewis Hamilton Important names: Directed by Matt Kay, featuring full access to Hamilton and his team. When you can watch: This documentary does not yet have a release date. Midnight Family What it’s about: Apple’s first all-Spanish-language series, with an entirely Hispanic cast and crew. The story follows Marigaby Tamayo, a medical student by day who spends her nights saving lives throughout Mexico City aboard her family’s privately owned ambulance. Important names: Stars Joaquín Cosío, Renata Vaca, Diego Calva, Yalitza Aparicio, Itzan Escamilla, and more. When you can watch: Midnight Family has no release date yet. Benjamin Franklin biography series What it’s about: A limited series about one of America’s founding fathers, based on the book A Great Improvisation: Franklin, France, and the Birth of America by Pulitzer Prize winner Stacy Schiff. Important names: Michael Douglass is set to star as Benjamin Franklin. When you can watch: This series does not yet have a release date, nor a final title. Omnivore What it’s about: A food documentary series that tells the story of humanity and the planet through eight defining ingredients. Important names: Created by filmmaker Cary Joji Fukunaga and chef René Redzepi. When you can watch: Omnivore does not yet have a release date. Presumed Innocent What it’s about: An eight-episode limited series inspired by the Scott Turow novel of the same name. A courtroom drama that tells the story of a murder that ends up in the Chicago Prosecuting Attorneys’ office when one of its own is suspected of the crime. Important names: The showrunner is David E. Kelley, with J.J. Abrams and Dustin Thomason as executive producers. When you can watch: Presumed Innocent has no release date yet. Mrs. American Pie What it’s about: A 10-episode comedy series in production at Apple Studios. Set in the early 1970s, it tells the story of Maxine Simmons as she attempts to secure her place in Palm Beach high society. Important names: Starring Kirsten Wiig and Laura Dern. When you can watch: Mrs. American Pie does not yet have a release date. Sunny What it’s about: Apple describes this 10-episodes series as a “darkly comedic half-hour drama” about Suzie, an American woman living in Kyoto, Japan. When her husband and son disappear in a mysterious plane crash, she’s given Sunny, one of a new class of domestic robots made by her husband’s electronics company. They develop an unexpected friendship, and uncover the dark truth of what really happened to Suzie’s family. Important names: Rashida Jones stars as Suzie, written and executive produced by Katie Robbins. When you can watch: Sunny has no release date yet. Manhunt What it’s about: A limited series true crime story about the hunt for John Wilkes Booth and the aftermath of Abraham Lincoln’s assassination. Important names: Set to star Tobias Menzies, directed by Carl Franklin. When you can watch: Manhunt has no release date yet. Disclaimer What it’s about: Based on the novel of the same name by Renee Knight. Catherine Ravenscroft is a television documentary journalist whose work has been built on revealing the concealed transgressions of long-respected institutions. A novel written by a widower has her as a key character in a story that she had hoped was long buried in the past. A story that reveals her darkest secret. A secret she thought was hers alone. Important names: Acclaimed filmmaker Alfonso Cuarón will write and direct all episodes. Cate Blanchett and Kevin Kline will star. When you can watch: This series has no release date yet. Untitled Jon Watts / Brad Pitt / George Clooney film What it’s about: A thriller in which two lone-wolf fixers (Pitt and Clooney) get assigned to the same job. Deadline reports that Apple outbid other major studios and distributors for the film rights. The film doesn’t have a title yet. Important names: Written and directed by Jon Watts, starring George Clooney and Brad Pitt. When you can watch: This film has no release date yet. Yo Gabba Gabba! What it’s about: A beloved Nickelodeon series that ran for six seasons and featured live action, puppets, short sketches, and music. Apple has acquired the entire back catalog and rights to produce new episodes. So far, there are plans to produce 20 new episodes as a “a reimagining based on the heart and essence of what Yo Gabba Gabba! is.” Important names: It’s unclear which of the original cast or crew will participate in the new episodes. When you can watch: We don’t have word yet on when old episodes will appear on Apple TV+, nor when the new episodes will debut. Bad Monkey What it’s about: An adaptation of the Carl Hiaasen novel of the same name, “Bad Monkey” tells the story of Andrew Yancy, a one-time detective demoted to restaurant inspector in Southern Florida. A severed arm found by a tourist out fishing pulls Yancy into the world of greed and corruption that decimates the land and environment in both Florida and the Bahamas. And yes, there’s a monkey. Important names: Written and produced by Bill Lawrence (Scrubs, Ted Lasso, Cougar Town) and starring Vince Vaughn. When you can watch: Bad Monkey has no release date yet. Untitled Negro League Baseball series What it’s about: Follows the life and career of legendary pitcher Leroy “Satchel” Paige. Important names: The series is produced by Erving “Magic” Johnson, among others. It is in conjunction with the Negro Leagues Baseball Museum and MLB. When you can watch: This series has no release date yet. Number One on the Call Sheet What it’s about: A pair of documentary films that examine the history of black actors and actresses in Hollywood. One focuses on leading men, the other on leading women. Important names: Producers include Jamie Foxx, Kevin Hart, Datari Turner, Dan Cogan, Angela Bassett, Halle Berry, Reginald Hudlin, and Bryan Smiley. When you can watch: These two companion films have no release date yet. Untitled Chuck Barris drama What it’s about: Gong Show host Chuck Barris famously claimed to be a secret CIA assassin in his autobiography Confessions of a Dangerous Mind, which was made into a feature film in 2002. A Deadline report says Apple is developing an hour-long drama series about Barris as both Gong Show host and CIA assassin. Important names: Justin Timberlake is attached to star as Chuck Barris. When you can watch: This series has no release date yet. Lady in the Lake What it’s about: Apple’s description of this limited series says it “takes place in ’60s Baltimore, where an unsolved murder pushes housewife and mother Maddie Schwartz to reinvent her life as an investigative journalist and sets her on a collision course with Cleo Sherwood, a hard-working woman juggling motherhood, many jobs and a passionate commitment to advancing Baltimore’s Black progressive agenda.” Important names: It will star Natalie Portman and Moses Ingram. Directed by Alma Har’el. When you can watch: No release date yet. The Search for WondLa What it’s about: Based on the children’s book by Tony DiTerlizzi, which follows the story of Eva Nine, a girl who spent most of her life living underground before being forced to flee outside and survive with a robot named Muthr, an alien named Rovander Kitt, and a water bear named Otto. Apple plans to run at least two seasons of this show. Important names: Written and produced by Lauren Montgomery. When you can watch: No release date yet. Dolly What it’s about: Deadline describes it as a “sci-fi courtroom drama in which a robotic ‘companion doll’ kills its owner and then shocks the world by claiming that she is not guilty and asking for a lawyer.” Important names: Florence Pugh and Vanessa Taylor are attached to star and Drew Pearce will write the script. When you can watch: No release date yet. Bride What it’s about: Deadline reports that this is a genre-bending film about an engineered “ideal wife” who rejects her creator, escapes captivity, and discovers her true self. Important names: The film will star Scarlett Johansson and will be directed by Sebastián Lelio. When you can watch: No release date yet. Earthsound What it’s about: A natural history documentary series that uses new audio technology and cinematic 360-degree audio to reveal untold nature stories from every continent. Important names: It will be executive produced by Alex Williamson, and the series producer is Sam Hodgson. When you can watch: No release date yet. Untitled Idris Elba spy thriller What it’s about: According to Variety, this is to be a “spy movie with romance set in Africa” but little else is known about the nascent project. The report says it’s early in production.  Important names: The film will star Idris Elba and is produced by Simon Kinberg and Audrey Chon. When you can watch: No release date yet. Snow Blind What it’s about: When a high school student in a small Alaskan town posts a photo of his dad online, and discovers that his family is in the Witness Protection Program. A man seeking revenge soon finds them, the FBI shows up…but what if his dad’s reasons for going into the program aren’t as innocent as he says? Important names: Jake Gyllenhaal is set to start with Gustav Möller directing. When you can watch: No release date yet. Hedy Lamarr series What it’s about: According to The Hollywood Reporter, it’s an eight-episode series about the 1930s and 40s actress and inventor Hedy Lamarr (whose frequency-hopping radio technology is still the basis for many modern wireless communications). Important names: Gal Gadot is set to star as Lamarr, with a script written by Sarah Treem. When you can watch: No release date yet. Where the Wild Things Are What it’s about: Apple has struck an overall deal with The Maurice Sendak Foundation to produce shows or series based on the author’s works for children. The most famous of these, by far, is Where the Wild Things Are. Important names: Apple is working with longtime Sendak collaborator Arthur Yorinks and his production studio Night Kitchen Studios. When you can watch: No release date yet. Custom of the Country What it’s about: A limited-series adaptation of the Edith Wharton novel The Custom of the Country. The novel, published in the early 20th century, is about a midwestern girl who climbs the ladder of New York high society. Important names: The big one is Sofia Coppola, who is developing the series for Apple. No word yet on whether she will direct it. When you can watch: No release date yet. El Gato Negro What it’s about: Based on Richard Dominguez’s comic book about an aging luchador who teams up with his grandson to use the El Gato Negro persona to fight crime in South Texas. Important names: Robert Rodriguez will direct and produce, while Diego Boneta will star and also produce. When you can watch: No release date yet. Brie Larson CIA biography series What it’s about: A report in Variety says that Apple has made a direct-to-series order for a new drama based on the real-life experiences of CIA undercover operative Amaryllis Fox. Fox has a hot novel named Life Undercover: Coming of Age in the CIA that released in October 2019.  Important names: Brie Larson will star and executive produce the series. When you can watch: No release date yet. My Glory Was I Had Such Friends What it’s about: A report from Variety says that Apple has made a direct-to-series order of My Glory Was I Had Such Friends. The limited series, based on the Amy Silverstein memoir about a woman awaiting heart surgery and the women who supported her, will star Jennifer Garner and be executive produced by J.J. Abrams through his Bad Robot production company. Important names: J.J. Abrams and Jennifer Garner are working together again for the first time since the show Alias. When you can watch: No release date yet. Losing Earth What it’s about: This summer, The New York Times Magazine published an epic feature titled, “Losing Earth: The Decade We Almost Stopped Climate Change.” At over 30,000 words, it took up an entire issue of the magazine and earned critical acclaim. It focused on how, from 1979 to 1989, a small team of scientists, activists, and politicians tried to stop climate change while there was still time.  We don’t know the format the show will take, but The New York Times specifically calls it a “series.” Based on the source material, it seems like a single-season limited series makes the most sense. Important names: The article’s author, Nathaniel Rich, will serve as executive producer together with Anonymous Content founder and CEO Steve Golin. When you can watch: No release date yet. Time Bandits What it’s about: Terry Gilliam’s time-traveling adventure comedy Time Bandits may make its way to the small screen in a TV series. Deadline reports that Apple is buying up the rights to make a TV show of the cult classic film. The film, about a young boy who gets caught up with a troupe of thieves as they hop across history to steal treasure, ever on the run from the “supreme being” from whom they’ve stolen their time map, is good fodder for a TV show. But the film has a dedicated cult following who will place high demands on maintaining the film’s heart and quirky sense of British humor. Important names: Terry Gilliam will have an executive producer role, but will not write for the show. A report in Variety says that the series will be directed by Taika Waititi, whose quirky film What We Do in the Shadows earned him a cult following, and who earned huge international acclaim for his direction of Thor: Rangrarok and Jojo Rabbit.  When you can watch: No release date yet. You Think It, I’ll Say It What it’s about:  According to Variety, Apple has ordered a 10-episode, half-hour run of a new comedy variety show. The show is inspired by Curtis Sittenfeld’s collection of short stories You Think It, I’ll Say It. Important names: SNL alum Kristen Wiig was set to star, but pulled out citing scheduling conflicts with Wonder Woman 1984. The show is created and produced by Colleen McGuinness (30 Rock, About a Boy). When you can watch: This project does not yet have a title or release date. Damien Chazelle drama series What it’s about: According to Variety, Apple has gone straight-to-series (ordered a whole season of a series without first shooting a pilot) on a drama by Damien Chazelle. Chazelle is the acclaimed writer and director of La La Land and Whiplash, and is currently working on a Neil Armstrong biopic called First Man. No details have been given about the series at all, except that Chazelle will write and direct every episode. We don’t know the subject matter, the stars, the length of each episode…really nothing at all.  Important names: Chazelle is the acclaimed writer and director of La La Land and Whiplash, and is currently working on a Neil Armstrong biopic called First Man. When you can watch: No release date yet. Apple TV

Read more »

Will RCS support on iPhone make you more likely to switch to Android?
Sponsored by Capital One Shopping: Capital One Shopping users saved over $800 million in the past year. Get automatic free coupons at...

Read more »

Take a rare look inside Apple silicon lab
Here's your chance to take a look inside Apple's vaunted chip-making operation powering devices, courtesy of CNBC. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iPad mini 7: Here’s what’s next for Apple’s smallest tablet
Macworld Apple’s smallest iPad was given a substantial facelift at the end of 2021. The 6th-generation iPad mini sports a complete redesign with a bigger display, Touch ID on the power button, USB C instead of Lightning, and an upgraded front camera. This represented the first major change to the design since the iPad mini was first introduced back in 2012. The mini celebrated its 10-year anniversary in 2022 without an update and no update was forthcoming in 2023 either. But a new iPad mini 7th generation is rumored to be in the works for 2024. iPad mini 7 release date: When will the new iPad mini arrive? It’s been more than two years since the 6th generation iPad mini launched in September 2021, and, based on the dates when other iPad mini models have launched, a fall 2023 update for the iPad mini would have made sense. However, since the “Scary Fast” October event came and went without a mention of a new iPad mini, it seems likely that it will launch in the spring, but we could have an even longer wait. Back in December 2022, respected Apple analyst Ming-Chi Kuo said the new iPad mini won’t arrive until late 2023 or early 2024. However, as of November 2023, Kuo has pushed that prediction back. He now thinks the 7th-gen iPad mini won’t arrive until the second half of 2024. In a year that has seen no iPad updates for the first time ever, it seems that Apple is too busy with the new Vision Pro headset to be bothered with its tablet. iPad mini 7 price: How much will the new iPad mini cost? The arrival of the redesigned iPad mini 6th generation saw a $100 increase in price over the previous model to $499. That price increased even further outside the U.S. including in the U.K. where the price increased another £90. However, with Apple reducing prices for the iPhone 15 around the world following 2021/2022 price hikes outside the U.S. it may be the case that prices drop in some markets. Here’s how the prices of the 6th and 5th generations compared: iPad mini 6th generation: $499/£479 (Now £569 in the U.K) iPad mini 5th generation: $399/£379 As the iPad mini 7 will be similar to the iPad mini 6 we think it’s likely that the price will stay the same for the 7th generation although we hope to see more favorable pricing around the world. iPad mini 7 specs There is an expectation the new iPad mini will feature a more impressive processor than it does currently. We are also hoping for some small internal improvements. Improved processor The iPad mini 6 offers the A15 Bionic chip as found in the iPhone 13, mini, Pro and Max, however, this chip is down-clocked compared to the one inside the iPhone 13 series. Here’s how that chip compares to the rest of the range and what is expected for the next generation. iPad Pro: M2. Next generation is expected to get an M3 chip. iPad Air (5th gen): M1. Next generation is expected to get an M2 chip. iPad mini (6th gen): A15 chip, as found in iPhone 13 series. Next generation is expected to get A16, as found in the iPhone 14 Pro and iPhone 15. iPad (10th gen): A14 chip, as found in iPhone 12 series. Next generation is expected to get A16, as found in the iPhone 14 Pro and iPhone 15. iPad (9th gen): A13, as found in iPhone 11 series. Kuo reported in December that the iPad mini’s “main selling point” would be the new processor. He didn’t specify which processor at the time, but it is now expected to be the A16 chip found in the iPhone 14 Pro and Max and the iPhone 15 and 15 Plus. You may be looking at the iPad Air and wondering if the iPad mini might get an M1 chip like that found in the iPad Air. Perhaps it’s something Apple might consider down the line, but the rumors around the launch of the iPad Air indicated that Apple’s reason for using the M1 was actually the reduced of availability of the A16 at the time, as per this tweet from Mark Gurman. Could also be another explanation for why the iPad Air got the M1 (supply). https://t.co/lrvuVR0QkW— Mark Gurman (@markgurman) March 13, 2022 Increased storage On the current iPad mini 6th generation, the base model starts off with a rather paltry 64GB of storage. For a device like an iPad, where you can store movies, TV shows, books, comics, magazines, games, and a wide range of apps, that amount can often become a problem, especially if you want to take your iPad away on holiday or use it for your commute without needing to manage the storage. Although Apple has something of a history of giving base models low storage capacities, we think it would be a wise move to upgrade the entry-level iPad mini 7th generation to at least 128GB. File sizes are growing all the time, due to higher-quality cameras and software, so doubling the existing 64GB would be a very consumer-friendly solution. Along these lines, there’s also the possibility that the upper limit of the storage could be increased. At the time of writing, the most storage available on the iPad mini 6th generation is 256GB. Moving up to 512GB would be the logical step, especially if the baseline storage moves to 128GB. iPad mini 7 display The iPad mini will likely keep the same design for several generations.IDG It’s unlikely that the design will change, but the new iPad mini is expected to include a new display controller designed to mitigate a problem described as a “jelly scrolling issue” that reportedly makes content look laggy. There have been reports for a while that Apple will move the display technology to OLED but this looks like it won’t happen until later on. Apple is apparently talking to LG, Samsung, and other companies regarding active matrix OLEDs (AMOLEDs). But, according to market research company Omdia: “Apple is continuously discussing the possibility of widely adopting OLED technology for the iPad mini and iPad Air lineup as the next phase of its strategy from 2026 onward.” Screen size The iPad mini screen was 7.9-inches up until the current iPad mini 6th generation launched in 2021. The iPad mini 6th generation screen is 8.3-inch thanks to the removal of the Home button. A report from ET News suggests that an iPad mini with a larger 8.7-inch OLED display is in the works. However, this change might not happen with the 7th generation as the iPad mini with OLED screen isn’t expected until 2026. Folding display Apple is said to have been working on an iPad with a folding display, but it’s unlikely to come to this model. In December 2022, Ming-Chi Kuo said that reports of a folding iPad mini in development were wrong “because a foldable iPad will have a markedly higher price than an iPad mini, so such a replacement is not reasonable.” (3/3)Additionally, Apple is currently working on a new version of the iPad mini equipped with a new processor as the main selling point, and the mass shipment is expected to start by the end of 2023 or in 1H24.— 郭明錤 (Ming-Chi Kuo) (@mingchikuo) December 27, 2022 ProMotion The screen in the 7th gen model isn’t expected to grow from the current 8.3-inch, but there may be new screen technology. A post on a South Korean forum back in November 2021 indicated Apple had ordered 8.3-inch displays from Samsung that support 120Hz maximum refresh rates. If true, the post on Clien (translated here) could mean the next mini offers the ProMotion ultra-smooth scrolling feature currently seen on the iPad Pro, iPhone 13 Pro models, and 14- & 16-inch MacBook Pro. This would address the minor issue of “jelly scrolling” that some users have complained about with the current iPad mini. I would be surprised since it is currently an a-Si LCD which isn't compatible with ProMotion. Only their Pro models support ProMotion as they use an Oxide LCD.— Ross Young (@DSCCRoss) June 28, 2022 However, it’s not looking like this particular rumor is accurate. Analyst Ross Young, CEO of Display Supply Chain Consultants, doesn’t believe that Apple will be giving the iPad mini a ProMotion display yet. He indicates that doing so would require significant hardware changes. This would require a “whole new level of engineering,” according to Young. We remain skeptical of a ProMotion upgrade as it’s one of the main differentiators between the standard and Pro devices Apple sells. iPad mini design It’s been surprisingly quiet on the rumor front, which probably means the iPad mini 7 design will be largely the same as the 6th-gen model. Here’s what we’ve managed to uncover. One of the most obvious changes to the iPad mini 6th generation was the new palette of colors that Apple made available. While you can currently select between space gray, pink, purple, and starlight, there are several interesting hues available on the iPad Air when it received its new look in fall 2021, including silver, rose gold, green, and sky blue. It would therefore seem reasonable to assume that some of these make it to the mini. Plus now that the iPad 10th generation brought a bold selection of colors, the iPad mini may get a completely new palette. However, the iPhone 15 introduced an extremely light palette of colors so it’s unclear which direction Apple will go. We’ll update this article as more details become available, but until then, be sure to read our iPad buying guide to see which models we’d recommend if you want to buy one of Apple’s tablets today. And check our roundup of the best iPad mini deals for the latest bargains on the current range. iPad

Read more »

Washington, D.C. police tell residents to buy AirTags as thieves target Canada Goose jackets
Last month, Washington, D.C. police gave some advice to citizens worried about car theft: buy an AirTag. Now, police are back with more advice for people concerned about thieves stealing their high-end Canada Goose jackets: . more…

Read more »

Okta: Breach Affected All Customer Support Users
When KrebsOnSecurity broke the news on Oct. 20, 2023 that identity and authentication giant Okta had suffered a breach in its customer support department, Okta said the intrusion allowed hackers to steal sensitive data from fewer than one percent of its 18,000+ customers. But today, Okta revised that impact statement, saying the attackers also stole the name and email address for nearly all of its customer support users.

Read more »

ID Theft Service Resold Access to USInfoSearch Data
One of the cybercrime underground's more active sellers of Social Security numbers, background and credit reports has been pulling data from hacked accounts at the U.S. consumer data broker USinfoSearch, KrebsOnSecurity has learned.

Read more »

Vulnerability Summary for the Week of November 20, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47066 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47067 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47068 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47069 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47070 adobe -- after_effects Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-11-17 7.8 CVE-2023-47073 code-projects -- simple_crud_functionality SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. 2023-11-17 9.8 CVE-2023-48078 concrete_cms -- concrete_cms Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excessive permissions can be granted when creating a directory with permissions greater than 0755 or when the permissions argument is not specified. 2023-11-17 9.8 CVE-2023-48648   corebos -- corebos Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer. 2023-11-17 8 CVE-2023-48029   cubecart -- cubecart Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. 2023-11-17 8.1 CVE-2023-38130   cubecart -- cubecart CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. 2023-11-17 7.2 CVE-2023-47675   dreamer_cms -- dreamer_cms Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management. 2023-11-18 8.8 CVE-2023-48017 getsimplecms -- getsimplecms A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edit.php. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-245735. 2023-11-17 9.8 CVE-2023-6188   git-urls -- git-urls git-urls version 1.0.1 is vulnerable to ReDOS (Regular Expression Denial of Service) in Go package. 2023-11-18 7.5 CVE-2023-46402 honeywell -- prowatch Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most recent version of this product, service or offering (Pro-watch 6.0.2, 6.0, 5.5.2,5.0.5). 2023-11-17 7.8 CVE-2023-6179   kodcloud -- kodbox kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based on varying response messages, potentially paving the way for a brute force attack. 2023-11-18 9.8 CVE-2023-48028   liblisp -- liblisp Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c 2023-11-17 8.1 CVE-2023-48025 librenms -- librenms LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In affected versions the login method has no rate limit. An attacker may be able to leverage this vulnerability to gain access to user accounts. This issue has been addressed in version 23.11.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. 2023-11-17 7.5 CVE-2023-46745 luxsoft -- luxcal_web_calendar SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote unauthenticated attacker to execute an arbitrary SQL command by sending a crafted request and obtain or alter information stored in the database. 2023-11-20 9.8 CVE-2023-46700   medart_health_services -- medart_notification_panel Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows SQL Injection. This issue affects Medart Notification Panel: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-23 9.8 CVE-2023-3631 misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. 2023-11-17 9.8 CVE-2023-48655   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. 2023-11-17 9.8 CVE-2023-48656   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. 2023-11-17 9.8 CVE-2023-48657   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. 2023-11-17 9.8 CVE-2023-48658   misp -- malware_information_sharing_platform An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. 2023-11-17 9.8 CVE-2023-48659   nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39544 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39545 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39546 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39547 nec -- clusterpro_x/expresscluster_x CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows an attacker to log in to the product may execute an arbitrary command. 2023-11-17 8.8 CVE-2023-39548 neutron -- ip_camera Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1. 2023-11-23 7.5 CVE-2023-6118 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. 2023-11-20 7.8 CVE-2023-43612 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. 2023-11-20 7.8 CVE-2023-6045 openharmony -- openharmony in OpenHarmony v3.2.2 and prior versions allow a local attacker to get confidential information or rewrite sensitive file through incorrect default permissions. 2023-11-20 7.1 CVE-2023-3116 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS commands by inserting them into the URL portion of HTTP GET requests. 2023-11-17 9.8 CVE-2023-38316 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP request with a missing client redirect query string parameter. Triggering this issue results in crashing openNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated and can be triggered only when the BinAuth option is set. 2023-11-17 7.5 CVE-2023-38313 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing client token query string parameter. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). 2023-11-17 7.5 CVE-2023-38315 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafted GET HTTP with a missing User-Agent header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). 2023-11-17 7.5 CVE-2023-38320 opennds -- captive_portal An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP request with a missing User-Agent HTTP header. Triggering this issue results in crashing OpenNDS (a Denial-of-Service condition). The issue occurs when the client is about to be authenticated and can be triggered only when the BinAuth option is set. 2023-11-17 7.5 CVE-2023-38322 opennds -- opennds An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string of GET requests. This leads to a stack-based buffer overflow in versions 9.x and earlier, and to a heap-based buffer overflow in versions 10.x and later. Attackers may exploit the issue to crash OpenNDS (Denial-of-Service condition) or to inject and execute arbitrary bytecode (Remote Code Execution). 2023-11-17 9.8 CVE-2023-41101   opennds -- opennds An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may lead to a Denial-of-Service condition due to the consumption of all available memory. 2023-11-17 7.5 CVE-2023-41102   opensupports -- opensupports OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation. 2023-11-17 9.8 CVE-2023-48031   prestashop -- prestashop In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().` 2023-11-17 9.8 CVE-2023-45387   prestashop -- prestashop In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system. 2023-11-17 7.5 CVE-2023-45382   tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48109 tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48110 tenda -- ax1803_firmware Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) attack 2023-11-20 7.5 CVE-2023-48111 veribilim_software_computer -- veribase Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection. This issue affects Veribase: through 20231123.  NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-23 9.8 CVE-2023-3377 wordpress -- wordpress The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to and including 4.2.5. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. 2023-11-18 9.8 CVE-2023-4214   wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin

Read more »

Vulnerability Summary for the Week of November 13, 2023
 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info checkpoint -- endpoint_security Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2023-11-12 7.8 CVE-2023-28134 discourse -- discourse Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, the embedding feature is susceptible to server-side request forgery. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable the Embedding feature. 2023-11-10 9.8 CVE-2023-47121   discourse -- discourse Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.beta2 of the `beta` and `tests-passed` branches, Redis memory can be depleted by crafting a site with an abnormally long favicon URL and drafting multiple posts which Onebox it. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. There are no known workarounds. 2023-11-10 7.5 CVE-2023-47120   dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus. 2023-11-14 8.8 CVE-2023-48020 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. 2023-11-14 8.8 CVE-2023-48021 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run 2023-11-13 8.8 CVE-2023-48058 dreamer_cms -- dreamer_cms Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add 2023-11-13 8.8 CVE-2023-48060 emsigner -- emsigner Incorrect access control in the Forgot Your Password function of EMSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered users, including those with administrator privileges via a crafted password reset token. 2023-11-14 9.8 CVE-2023-43902 fortinet -- fortimail An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 through 7.0.6 and before 6.4.8 may allow an unauthenticated attacker to perform a brute force attack on the affected endpoints via repeated login attempts. 2023-11-14 7.3 CVE-2023-45582 fortinet -- fortiwlm A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through 8.3.0 and 8.2.2 allows attacker to read arbitrary files via crafted http requests. 2023-11-14 7.5 CVE-2023-42783 froxlor -- froxlor Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. 2023-11-10 8.8 CVE-2023-6069   gibbonedu -- gibbon GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint accepts the img, path, and gibbonPersonID parameters. The img parameter is expected to be a base64 encoded image. If the path parameter is set, the defined path is used as the destination folder, concatenated with the absolute path of the installation directory. The content of the img parameter is base64 decoded and written to the defined file path. This allows creation of PHP files that permit Remote Code Execution (unauthenticated). 2023-11-14 9.8 CVE-2023-45878 gibbonedu -- gibbon GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateFileDestination parameter can be set to an arbitrary pathname (and extension). This allows creation of PHP files outside of the uploads directory, directly in the webroot. 2023-11-14 7.2 CVE-2023-45880 golden -- golden An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. 2023-11-14 7.5 CVE-2023-45558 hanwhavision -- wave_server_software Bashis, a Security Researcher at IPVM has found a flaw that allows for a remote code execution during the installation of Wave on the camera device. The Wave server application in camera device was vulnerable to command injection allowing an attacker to run arbitrary code. HanwhaVision has released patched firmware for the highlighted flaw. Please refer to the hanwhavision security report for more information and solution." 2023-11-13 8.8 CVE-2023-5747 headscale -- headscale Headscale through 0.22.3 writes bearer tokens to info-level logs. 2023-11-11 7.5 CVE-2023-47390 icssolution -- ics_business_manager A SQL injection vulnerability has been found in ICS Business Manager, affecting version 7.06.0028.7089. This vulnerability could allow a remote user to send a specially crafted SQL query and retrieve all the information stored in the database. The data could also be modified or deleted, causing the application to malfunction. 2023-11-13 8.8 CVE-2023-6097 intel(r) -- unison_software Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-22663 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-36860 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-39221 intel(r) -- unison_software Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. 2023-11-14 8.8 CVE-2023-39412 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2022-45469 intel(r) -- unison_software Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2023-22292 intel(r) -- unison_software Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local access. 2023-11-14 7.8 CVE-2023-38570 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-22285 intel(r) -- unison_software Improper input validation for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-22337 intel(r) -- unison_software Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. 2023-11-14 7.5 CVE-2023-39228 intel(r) -- unison_software Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network access. 2023-11-14 7.2 CVE-2023-22448 johnson_controls -- quantum_hd_unity_compressor_firmware An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. 2023-11-10 9.8 CVE-2023-4804   linux -- kernel A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_trans_gc_catchall did not remove the catchall set element from the catchall_list when the argument sync is true, making it possible to free a catchall set element many times. We recommend upgrading past commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630. 2023-11-14 7.8 CVE-2023-6111   memberscard -- memberscard An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. 2023-11-14 7.5 CVE-2023-45560 microsoft -- edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability 2023-11-10 7.3 CVE-2023-36014 microsoft -- edge_chromium Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 2023-11-10 7.1 CVE-2023-36024 netgate -- pfsense An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. 2023-11-14 8.8 CVE-2023-42326 phonepe -- phonepe Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions. This issue affects PhonePe Payment Solutions: from n/a through 1.0.15. 2023-11-13 7.5 CVE-2022-45835 phpgurukul -- restaurant_table_booking_system A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the file check-status.php of the component Booking Reservation Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-244943. 2023-11-10 9.8 CVE-2023-6074   phpgurukul -- restaurant_table_booking_system A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionality of the file booking-details.php of the component Reservation Status Handler. The manipulation of the argument bid leads to information disclosure. The attack can be launched remotely. The identifier VDB-244945 was assigned to this vulnerability. 2023-11-10 7.5 CVE-2023-6076   phpgurukul -- teacher_subject_allocation_management_system SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obtain sensitive information via the 'searchdata' parameter. 2023-11-14 7.5 CVE-2023-46024 qnap -- qumagie An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.3 and later 2023-11-10 8.8 CVE-2023-39295 qnap -- qumagie A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.4 and later 2023-11-10 8.8 CVE-2023-41284 qnap -- qumagie A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.4 and later 2023-11-10 8.8 CVE-2023-41285 remarshal -- remarshal Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack. Processing untrusted YAML files may cause a denial-of-service (DoS) condition. 2023-11-13 7.5 CVE-2023-47163   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 9.8 CVE-2023-6126   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6125   salesagility -- suitecrm Path Traversal: '..filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6130   salesagility -- suitecrm Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. 2023-11-14 8.8 CVE-2023-6131   shenzhen_youkate_industrial -- facial_love_cloud_platform A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-13 9.8 CVE-2023-6099   siemens -- comos A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is vulnerable to Structured Exception Handler (SEH) based buffer overflow. This could allow an attacker to execute arbitrary code on the target system or cause denial of service condition. 2023-11-14 9.8 CVE-2023-43504 siemens -- comos A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and project information in cleartext via UDP. 2023-11-14 7.5 CVE-2023-43503 statamic_cms -- statamic_cms Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0. 2023-11-10 9.8 CVE-2023-47129   sysaid -- sysaid_on-premises In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023. 2023-11-10 9.8 CVE-2023-47246   telit -- bgs5_firmware A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, Telit Cinterion PLS62 that could allow a local, low privileged attacker to elevate privileges to "manufacturer" level on the targeted system. 2023-11-10 7.8 CVE-2023-47611 thinkingreed_inc. -- oss_calendar SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter the information stored in the database by sending a specially crafted request. 2023-11-14 8.8 CVE-2023-47609   tongda -- tongda_oa A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/vehicle/checkup/delete.php. The manipulation of the argument VU_ID leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. VDB-244994 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. 2023-11-12 9.8 CVE-2023-6084   wbce -- wbce_cms SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE parameter. 2023-11-10 9.8 CVE-2023-39796   weston-embedded -- cesium_net An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to memory corruption. An attacker can send a network request to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-24585 weston-embedded -- cesium_net A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network packets can lead to arbitrary code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-25181 weston-embedded -- cesium_net A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-27882 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-28379 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-28391 weston-embedded -- cesium_net A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead to code execution. An attacker can send a malicious packet to trigger this vulnerability. 2023-11-14 9.8 CVE-2023-31247 wordpress -- wordpress Server-Side Request Forgery (SSRF) vulnerability in StylemixThemes Motors - Car Dealer, Classifieds & Listing. This issue affects Motors - Car Dealer, Classifieds & Listing: from n/a through 1.4.6. 2023-11-13 7.5 CVE-2023-46207 wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability leading to Local File Inclusion (LF) in Webpushr Web Push Notifications Web Push Notifications - Webpushr plugin

Read more »

Alleged Extortioner of Psychotherapy Patients Faces Trial
Prosecutors in Finland this week commenced their criminal trial against Julius Kivimäki, a 26-year-old Finnish man charged with extorting a once popular and now-bankrupt online psychotherapy practice and thousands of its patients. In a 2,200-page report, Finnish authorities laid out how they connected the extortion spree to Kivimäki, a notorious hacker who was convicted in 2015 of perpetrating tens of thousands of cybercrimes, including data breaches, payment fraud, operating a botnet and calling in bomb threats.

Read more »

Vulnerability Summary for the Week of November 6, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1e -- platform The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-URLResponseTime instruction to v20.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45161MISCMISC 1e -- platform The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input parameter, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue download the updated Network product pack from the 1E Exchange and update the 1E-Exchange-CommandLinePing instruction to v18.1 by uploading it through the 1E Platform instruction upload UI 2023-11-06 7.2 CVE-2023-45163MISCMISC 1e -- platform The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Caption or Message parameters, which allows for a specially crafted input to perform arbitrary code execution with SYSTEM permissions. To remediate this issue DELETE the instruction "Show dialogue with caption %Caption% and message %Message%" from the list of instructions in the Settings UI, and replace it with the new instruction 1E-Exchange-ShowNotification instruction available in the updated End-User Interaction product pack. The new instruction should show as "Show %Type% type notification with header %Header% and message %Message%" with a version of 7.1 or above. 2023-11-06 7.2 CVE-2023-5964MISCMISC 7-zip -- 7-zip 7-Zip through 22.01 on Linux allows an integer underflow and code execution via a crafted 7Z archive. 2023-11-03 7.8 CVE-2023-31102MISCMISCMISC advanced_export_products_orders_cron_csv_excel_project -- advanced_export_products_orders_cron_csv_excel Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer table. 2023-11-07 7.5 CVE-2023-43984 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-3889 arm -- valhall_gpu_kernel_driver A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. 2023-11-07 7.8 CVE-2023-4295 asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system, or terminate services. 2023-11-03 8.8 CVE-2023-41345MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41346MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41347MISC asus -- rt-ax55_firmware ASUS RT-AX55's authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands, disrupt the system or terminate services. 2023-11-03 8.8 CVE-2023-41348MISC asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_ln 2C318 function. 2023-11-09 9.8 CVE-2023-47005 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ipaddr field in the sub_6FC74 function. 2023-11-09 9.8 CVE-2023-47006 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the lan_ifname field in the sub_391B8 function. 2023-11-09 9.8 CVE-2023-47007 asus -- rt-ax57_firmware An issue in ASUS RT-AX57 v.3.0.0.4_386_52041 allows a remote attacker to execute arbitrary code via a crafted request to the ifname field in the sub_4CCE4 function. 2023-11-09 9.8 CVE-2023-47008 best_courier_management_system -- best_courier_management_system An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. 2023-11-03 9.8 CVE-2023-46980MISCMISC bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or a mail-gateway REST API call. 2023-11-03 7.5 CVE-2023-41259MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. 2023-11-03 7.5 CVE-2023-41260MISCCONFIRMCONFIRM bestpractical -- request_tracker Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. 2023-11-03 7.5 CVE-2023-45024MISCCONFIRM bleachbit -- bleachbit BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been patched in version 4.5.0. 2023-11-08 7.3 CVE-2023-47113 boltwire -- boltwire An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. 2023-11-07 9.1 CVE-2023-46501   botan_project -- botan bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it easier for attackers to determine the cleartext password. 2023-11-03 7.5 CVE-2017-7252CONFIRMMISC clickbar -- dot-diver Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notation. In versions prior to 1.0.2 there is a Prototype Pollution vulnerability in the `setByPath` function which can leads to remote code execution (RCE). This issue has been addressed in commit `98daf567` which has been included in release 1.0.2. Users are advised to upgrade. There are no known workarounds to this vulnerability. 2023-11-06 9.8 CVE-2023-45827MISCMISC couchbase -- couchbase_server Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. 2023-11-08 7.5 CVE-2023-36667   djangoproject -- django In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters. 2023-11-03 7.5 CVE-2023-41164CONFIRMMISC   djangoproject -- django In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232. 2023-11-03 7.5 CVE-2023-43665CONFIRMMISC   ec-cube -- ec-cube EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability due to improper settings of the template engine Twig included in the product. As a result, arbitrary code may be executed on the server where the product is running by a user with an administrative privilege. 2023-11-07 7.2 CVE-2023-46845   eclipse -- glassfish In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the server via access to insecure ORB listeners. 2023-11-03 9.8 CVE-2023-5763MISCMISC eclipse -- parsson In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support for parsing numbers with large scale in Java has a number of edge cases where the input text of a number can lead to much larger processing time than one would expect. To mitigate the risk, parsson put in place a size limit for the numbers as well as their scale. 2023-11-03 7.5 CVE-2023-4043MISCMISC espressif -- esptool An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. 2023-11-09 7.5 CVE-2023-46894 wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin

Read more »

Microsoft Patch Tuesday, November 2023 Edition
Microsoft today released updates to fix more than five dozen security holes in its Windows operating systems and related software, including three "zero day" vulnerabilities that Microsoft warns are already being exploited in active attacks.

Read more »

It’s Still Easy for Anyone to Become You at Experian
In the summer of 2022, KrebsOnSecurity documented the plight of several readers who had their accounts at big-three consumer credit reporting bureau Experian hijacked after identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hijacked, and the only way I could recover access was by recreating the account.

Read more »

Who’s Behind the SWAT USA Reshipping Service?
Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today's Part II, we'll examine clues about the real-life identity left behind by "Fearless," the nickname chosen by the proprietor of the SWAT USA Drops service.

Read more »

Vulnerability Summary for the Week of October 30, 2023
  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info contec -- solarview_compact_firmware An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component. 2023-10-27 9.8 CVE-2023-46509MISC dreamsecurity -- magicline_4.0 A Buffer overflow vulnerability in DreamSecurity MagicLine4NX versions 1.0.0.1 to 1.0.0.26 allows an attacker to remotely execute code. 2023-10-30 9.8 CVE-2023-45797MISC google -- android In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 8.8 CVE-2023-21356MISC google -- android In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 8.8 CVE-2023-21361MISC google -- android In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 8.8 CVE-2023-40129MISCMISC google -- android In NFC, there is a possible way to setup a default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2021-39810MISC google -- android In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21351MISC google -- android In libaudioclient, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21355MISC google -- android In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21358MISC google -- android In libdexfile, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21372MISC google -- android In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21373MISC google -- android In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21374MISC google -- android In Sysproxy, there is a possible out of bounds write due to an integer underflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21375MISC google -- android In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21378MISC google -- android In Media Resource Manager, there is a possible local arbitrary code execution due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.8 CVE-2023-21381MISC google -- android In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40116MISCMISC google -- android In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40117MISCMISCMISC google -- android In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40120MISCMISC google -- android In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40125MISCMISC google -- android In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40128MISCMISC google -- android In onBindingDied of CallRedirectionProcessor.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7.8 CVE-2023-40130MISCMISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.5 CVE-2023-21347MISC google -- android In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 7.5 CVE-2023-21353MISC google -- android In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 7 CVE-2023-40131MISCMISC juzaweb -- cms An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. 2023-10-28 7.8 CVE-2023-46468MISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-43738MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'contact' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44162MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add1' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44375MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add2' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44376MISCMISC projectworlds -- online_art_gallery Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'add3' parameter of the header.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-10-27 9.8 CVE-2023-44377MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45012MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_query' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45013MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'bus_id' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45014MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45015MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'source' parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45016MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'destination' parameter of the search.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45017MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45018MISCMISC projectworlds -- online_bus_booking_system   Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45019MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45111MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'feedback' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45112MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45113MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'subject' parameter of the feed.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45114MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45323MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'price' parameter of the routers/add-item.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45324MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45325MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45326MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45327MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45328MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'role' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45329MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45330MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'contact' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45331MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'deleted' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45332MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'verified' parameter of the routers/add-users.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45333MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45334MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/edit-orders.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45335MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45336MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the routers/router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45337MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45338MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'type' parameter of the routers/add-ticket.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45339MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45340MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45341MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45342MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-message.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45343MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45344MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45345MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45346MISCMISC projectworlds -- online_food_ordering_system   Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router.php resource does not validate the characters received and they are sent unfiltered to the database. 2023-11-02 9.8 CVE-2023-45347MISCMISC radare -- radare2 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32_fpu function of libr/arch/p/nds32/nds32-dis.h. 2023-10-28 9.8 CVE-2023-46569MISCMISC radare -- radare2 An out-of-bounds read in radare2 v.5.8.9 and before exists in the print_insn32 function of libr/arch/p/nds32/nds32-dis.h. 2023-10-28 9.8 CVE-2023-46570MISCMISC solarwinds -- network_configuration_manager   The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to perform the actions with SYSTEM privileges. 2023-11-01 8 CVE-2023-33226MISCMISC solarwinds -- network_configuration_manager   The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to perform the actions with SYSTEM privileges. 2023-11-01 8 CVE-2023-33227MISCMISC solarwinds -- solarwinds_platform   SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user to execute commands with SYSTEM privileges. 2023-11-01 8 CVE-2023-40062MISCMISC solarwinds -- solarwinds_platform    Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. 2023-11-01 7.1 CVE-2023-40061MISC trteksolutions -- education_portal Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection.This issue affects Education Portal: before 3.2023.29. 2023-10-27 9.8 CVE-2023-5807MISC zentao -- biz ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF). 2023-10-27 8.8 CVE-2023-46375MISC zentao -- biz Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. 2023-10-27 7.5 CVE-2023-46376MISC zpesystems -- nodegrid_os ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discovered to contain a command injection vulnerability via the endpoint /v1/system/toolkit/files/. 2023-10-28 8.8 CVE-2023-43322CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat_for_edge   Adobe Acrobat for Edge version 118.0.2088.46 (and earlier) is affected by a Use After Free vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2023-10-30 5.5 CVE-2023-44323MISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access array elements at out-of-bounds indexes. 2023-10-30 6.5 CVE-2023-46866MISCMISC color -- demoiccmax In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer dereference. 2023-10-30 6.5 CVE-2023-46867MISCMISC flusity -- flusity A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/posts.php. The manipulation of the argument edit_post_id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 6943991c62ed87c7a57989a0cb7077316127def8. It is recommended to apply a patch to fix this issue. The identifier VDB-243641 was assigned to this vulnerability. 2023-10-27 4.8 CVE-2023-5810MISCMISCMISCMISC google -- android In Bluetooth, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21360MISC google -- android In the Security Element API, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21370MISC google -- android In Secure Element, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21371MISC google -- android In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.7 CVE-2023-21380MISC google -- android In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 6.5 CVE-2023-21395MISC google -- android In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21294MISC google -- android In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21350MISC google -- android In NFA, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21352MISC google -- android In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21354MISC google -- android In Usage, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21362MISC google -- android In ContactsProvider, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21364MISC google -- android In Contacts, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service in the Phone app with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21365MISC google -- android In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21366MISC google -- android In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21367MISC google -- android In Audio, there is a possible out of bounds read due to missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21368MISC google -- android In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. 2023-10-30 5.5 CVE-2023-21369MISC google -- android In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21376MISC google -- android In SELinux Policy, there is a possible restriction bypass due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21377MISC google -- android In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21382MISC google -- android In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. 2023-10-30 5.5 CVE-2023-21383MISC google -- android In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21384MISC google -- android In Whitechapel, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21385MISC google -- android In Telecomm, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 5.5 CVE-2023-21394MISC google -- android In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40121MISCMISC google -- android In updateActionViews of PipMenuView.java, there is a possible bypass of a multiuser security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40123MISCMISC google -- android In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. 2023-10-27 5.5 CVE-2023-40133MISCMISC google -- android In NFC, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21357MISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21359MISC google -- android In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure in the Bluetooth server with System execution privileges needed. User interaction is not needed for exploitation. 2023-10-30 4.4 CVE-2023-21379MISC gougucms -- gougucms A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the headimgurl parameter. 2023-10-27 5.4 CVE-2023-46394MISC lenovo -- thinkpad_e14_firmware An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. 2023-10-30 6.7 CVE-2022-48189MISC lenovo -- thinkpad_x1_fold_gen_1_firmware An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code. 2023-10-30 6.7 CVE-2022-4573MISC macwk -- icecms IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF). 2023-10-27 6.5 CVE-2023-42188MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44484MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'lastName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44485MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'address' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-44486MISCMISC projectworlds -- online_blood_donation_management_system   Online Blood Donation Management System v1.0 is vulnerable to multiple Store Cross-Site Scripting vulnerabilities. The 'city' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php response. 2023-10-31 6.1 CVE-2023-5306MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45201MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45202MISCMISC projectworlds -- online_examination_system   Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. 2023-11-01 6.1 CVE-2023-45203MISCMISC pwncyn -- fancms Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file. 2023-10-27 6.1 CVE-2023-46505MISC pwncyn -- yxbookcms Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book input modules. 2023-10-27 6.1 CVE-2023-46503MISC pwncyn -- yxbookcms Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name function in the general settings component. 2023-10-27 5.4 CVE-2023-46504MISC solarwinds -- network_configuration_manager   The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to obtain sensitive information. 2023-11-01 4.5 CVE-2023-33228MISCMISC wordpress -- wordpress The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the deleteselected function. This makes it possible for unauthenticated attackers to delete sliders in bulk via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2023-10-27 6.5 CVE-2023-5821MISCMISCMISC wordpress -- wordpress Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin

Read more »

Russian Reshipping Service ‘SWAT USA Drop’ Exposed
One of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. Here’s a closer look at the Russia-based SWAT USA Drop Service, which currently employs more than 1,200 people across the United States who are knowingly or unwittingly involved in reshipping expensive consumer goods purchased with stolen credit cards.

Read more »

Deal Alert! Apple Smart Folio Keyboard for iPad/iPadAir on Holiday sale for 50% off MSRP
Apple iPad Smart Keyboard Folio prices are on Holiday sale for only $79 at Amazon, or 50% off MSRP: - iPad Smart Folio Keyboard for iPad (7th-9th gen)/iPad Air (3rd gen): $79 $79 (50%) off MSRP This is a limited-time only price, so act now if you're interested! For the latest prices & sales, keep an eye on our iPad Keyboard Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Apple Watch Series 9 models are now on Holiday sale this weekend for $70 off MSRP on Walmart’s online store
Walmart has Apple Watch Series 9 models now on Holiday sale for $70 off MSRP on their online store. Sale prices available for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available). These are the lowest prices of the season for Series 9 Watches: - 41mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $329, save $70 - 45mm Apple Watch Series 9 GPS (Midnight, Starlight, Silver, Red): $359, save $70 - 41mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $429, save $70 - 45mm Apple Watch Series 9 GPS + Cellular (Midnight, Starlight, Silver, Red): $459, save $70 For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Holiday sale this weekend at Xfinity Mobile: $500 off new iPhones, up to $800 off with trade-in
Switch to Xfinity Mobile (Mobile Virtual Network Operator..using Verizon's network) and save $500 instantly on any iPhone 15, 14, or 13 and up to $800 off with eligible trade-in. The total is applied to your account as credits over a 24 month service term. Offer is valid this weekend and ends on the 5th. The fine print: "Offer Ends 12/5/23. Requires qualifying phone trade-in, and purchase and activation of a new eligible Apple, Samsung, Google, or Motorola phone (excludes iPhone 12 mini, iPhone SE models, Galaxy S21 FE, Galaxy A-Series, Galaxy Z Fold, Pixel 6a, Pixel 7a, moto g stylus 5G 2023, moto g stylus 5G 2022, moto g power 5G, moto g play and moto g 5G) while supplies last, a 24-month Xfinity Mobile Device Payment Plan Agreement ("Device Agreement"), and activation of new Xfinity Mobile line within 30 days of phone purchase date. Existing phone must be paid in full. Trade-in must be completed within 21 days of device shipment date. Must maintain line required for offer until trade-in is completed. Actual trade in amount varies depending on model of phone for trade in and purchase. Trade-in credit will not exceed the retail value of the purchased device. Trade-in credits applied monthly to your account over 24 months so long as Device Agreement is in effect. If line is canceled, voluntarily or involuntarily or device payments are accelerated, balance of credits associated with device payment are forfeited. Back orders are eligible. Out of stock devices are not eligible. Offer not valid with prior purchases, returns or exchanges. May not be combined with other offers." This deal is live today at Xfinity Mobile. For the latest prices & sales, keep an eye on our iPhone Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

13-inch M2 MacBook Airs with 512GB of storage on sale for the lowest price of the season at $1179, $220 off MSRP
Best Buy has the 13" M2 MacBook Air with 512GB of storage on Holiday sale this weekend for $220 off MSRP on their online store. Sale price is $1179. Price valid for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup (if available): - 13" M2 MacBook Air (8GB RAM/512GB SSD): $1179 $220 off MSRP Their price for this configuration is the lowest we've seen from any Apple retailer this season. For the latest sales & prices, see our 13" MacBook Air Price Tracker. The post first appeared on MacPrices.net.

Read more »

B&H Photo has Apple’s 14-inch M3/M3 Pro/M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, free 1-2 day shipping
B&H Photo has new Gray and Black 14" M3, M3 Pro, and M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, starting at only $1499. B&H offers free 1-2 day delivery to most US addresses: - 14" 8-Core M3 MacBook Pro (8GB RAM/512GB SSD/Gray): $1499 $100 off MSRP - 14" 8-Core M3 MacBook Pro (8GB RAM/1TB SSD/Gray): $1699 $100 off MSRP - 14" 11-Core M3 Pro MacBook Pro (18GB RAM/512GB SSD/Black): $1799 $200 off MSRP - 14" 12-Core M3 Pro MacBook Pro (18GB RAM/1TB SSD/Black): $2199 $200 off MSRP - 14" 14-Core M3 Max MacBook Pro (36GB RAM/1TB SSD/Black): $2999 $200 off MSRP Their prices are among the lowest currently available for new 14" MacBook Pros from any Apple retailer this weekend. For the latest prices and sales, see our 14" MacBook Pro Price Tracker, updated daily. The post B&H Photo has Apple’s 14-inch M3/M3 Pro/M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, free 1-2 day shipping first appeared on MacPrices.net.

Read more »

B&H Photo has Apple’s 14-inch M3/M3 Pro/M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, free 1-2 day shipping
B&H Photo has new Gray and Black 14" M3, M3 Pro, and M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, starting at only $1499. B&H offers free 1-2 day delivery to most US addresses: - 14" 8-Core M3 MacBook Pro (8GB RAM/512GB SSD/Gray): $1499 $100 off MSRP - 14" 8-Core M3 MacBook Pro (8GB RAM/1TB SSD/Gray): $1699 $100 off MSRP - 14" 11-Core M3 Pro MacBook Pro (18GB RAM/512GB SSD/Black): $1799 $200 off MSRP - 14" 12-Core M3 Pro MacBook Pro (18GB RAM/1TB SSD/Black): $2199 $200 off MSRP - 14" 14-Core M3 Max MacBook Pro (36GB RAM/1TB SSD/Black): $2999 $200 off MSRP Their prices are among the lowest currently available for new 14" MacBook Pros from any Apple retailer this weekend. For the latest prices and sales, see our 14" MacBook Pro Price Tracker, updated daily. The post B&H Photo has Apple’s 14-inch M3/M3 Pro/M3 Max MacBook Pros on Holiday sale this weekend for $100-$200 off MSRP, free 1-2 day shipping first appeared on MacPrices.net.

Read more »

15-inch M2 MacBook Airs are $200 off MSRP on Best Buy’s online store
Best Buy has Apple 15" MacBook Airs with M2 CPUs in stock and on Holiday sale for $200 off MSRP on their online store. Their prices are among the lowest currently available for new 15" M2 MacBook Airs this weekend. - 15" M2 MacBook Air (8GB RAM/256GB SSD): $1099 $200 off MSRP - 15" M2 MacBook Air (8GB RAM/512GB SSD): $1299 $200 off MSRP Prices valid for online orders only. In-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 15" MacBook Air Price Tracker. The post first appeared on MacPrices.net.

Read more »

Get a 9th-generation Apple iPad for only $249 on Walmart’s online store this Holiday
Walmart has Apple's 9th generation 10.2" iPads on sale for $80 off MSRP on their online store as part of their Cyber Week Holiday sale, only $249. Their prices are the lowest new prices available for iPads in stock anywhere: - 9th-gen 10.2" 64GB WiFi iPad (Space Gray or Silver): $249 $80 off MSRP Sale prices for online orders only, in-store prices may way. Order online and choose free shipping or free local store pickup (if available). For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Space Gray Apple AirPods Max headphones are on Holiday sale for $100 off MSRP
Amazon has Apple AirPods Max headphones in stock and on Holiday sale for $100 off MSRP. The sale price is valid for Space Gray at the time of this post. Shipping is free: - AirPods Max (Space Gray): $449.99 $100 off MSRP Amazon's price is the lowest available anywhere for AirPods Max. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers. The post first appeared on MacPrices.net.

Read more »

Space Gray Apple AirPods Max headphones are on Holiday sale for $100 off MSRP
Amazon has Apple AirPods Max headphones in stock and on Holiday sale for $100 off MSRP. The sale price is valid for Space Gray at the time of this post. Shipping is free: - AirPods Max (Space Gray): $449.99 $100 off MSRP Amazon's price is the lowest available anywhere for AirPods Max. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers. The post first appeared on MacPrices.net.

Read more »

Space Gray Apple AirPods Max headphones are on Holiday sale for $100 off MSRP
Amazon has Apple AirPods Max headphones in stock and on Holiday sale for $100 off MSRP. The sale price is valid for Space Gray at the time of this post. Shipping is free: - AirPods Max (Space Gray): $449.99 $100 off MSRP Amazon's price is the lowest available anywhere for AirPods Max. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers. The post first appeared on MacPrices.net.

Read more »

Apple AirTags 4-Pack back on Holiday sale for $20 off MSRP, only $79
Amazon has Apple AirTags 4 Pack back on Holiday sale for $79.99 including free shipping. That's 19% ($20) off Apple's MSRP. Their price is the lowest available for 4 Pack AirTags from any of the retailers we track. For the latest prices and sales, see our AirTags Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »