Tim Cook: iPhone users adopting iOS 18.1 twice as fast as iOS 17.1
Apple released iOS 18.1 with the first Apple Intelligence features on Monday. In a new interview with CNBC today, Apple CEO Tim Cook touted that Apple is seeing strong adoption numbers of iOS 18.1 so far. Cook’s comments come following Apple’s Q4 2024 earnings report, where it set a new September quarter revenue record. more…

Read more »

Apple published a new Press Release
Apple just published a new Press Release:Apple reports fourth quarter results

Read more »

Tim Cook says users are updating to iOS 18.1 at twice the rate of iOS 17.1
Tim Cook has revealed that the adoption rate of iOS 18.1 is far faster than it was for iOS 17.1 at the same time in 2023.Tim Cook and the Apple Intelligence icon — image credit: AppleJust ahead of its latest earnings call, Tim Cook has announced that the first indications of Apple Intelligence's success have come from the increased rate of updates."A really early stat, which is only three days worth of data," he told CNBC, "but users are adopting iOS 18.1 at twice the rate that they adopted 17.1 in the year ago quarter." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

MacDailyNews presents live notes from Apple’s Q424 conference call
MacDailyNews presents live notes from Apple’s fiscal Q424 Conference Call with analysts starting at 2pm PT / 5pm ET today, October 31, 2024… The post appeared first on MacDailyNews.

Read more »

Strong iPhone sales return Apple to record revenue
Apple's Q4 2024 results reveal record revenue and strong iPhone performance. Get the details on the company's financial success and growth. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

9to5Mac Daily: October 31, 2024 – Apple’s health projects, more
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Dreametech: Industry-leading smart cleaning products, available now with massive savings. more…

Read more »

Apple beats Wall Street predictions with record-breaking iPhone sales revenue
Apple has reported its results for the fourth quarter of 2024, with revenue of $94.93 beating Wall Street expectations mostly on the strength of iPhone sales.Apple CEO Tim Cook [left] and outgoing CFO Luca Maestri [right]The final quarter of Apple's fiscal year, Thursday saw Apple release its results for the three-month period that concluded at the end of September. As the end-of-year results, it was also the opportunity for Apple to report its full-year results.In the fourth quarter, Apple achieved $94.93 billion in revenue, up from the $89.5 billion it reported in Q4 2023. The earnings per share was also declared at $1.64. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple reports record Q4 2024 earnings with nearly $95 billion in revenue
Apple has released its earnings report for fiscal Q4 2024. The company reports $94.93 billion in revenue during the three-month period, up 6% year-over-year. This sets a new September quarter revenue record. For comparison’s sake, Apple reported $89.5 billion in revenue in the same quarter last year. There is, however, a $10 billion wrinkle to Apple’s earnings this quarter… more…

Read more »

Apple beats the Street with all-time fourth quarter revenue
Apple today announced financial results for its fiscal 2024 fourth quarter ended September 28, 2024. The Company posted quarterly… The post appeared first on MacDailyNews.

Read more »

Copilot Money review: The best budgeting app gets better with iPad support, Cash Flow, and Tags
I’ve written before about Copilot’s crucial role in my life, making it extraordinarily easy (and even enjoyable!) to track my finances. Over the last several months, Copilot has gotten even better with new “Tags” and “Cash Flow” features. Copilot is also expanding to yet another platform: the iPad. Here’s everything you need to know about what’s new with Copilot and how I’m using the new features every day. Before we begin, a quick reminder that 9to5Mac readers can use code 9TO5MAC to unlock an extended two-month free trial of Copilot. more…

Read more »

ChatGPT search is officially here, this is what it can do
Following a limited test under the name SearchGPT, OpenAI today formally launched its newly branded ChatGPT search feature. The best shot at a Google contender in years is here, and this is what it can do. more…

Read more »

MacBook Air vs Pro: Which Mac laptop is right for you?
Macworld Apple currently sells two laptop lines: the MacBook Pro and MacBook Air. The MacBook Pro comes with a 14-inch or 16-inch display and the MacBook Air has either a 13.6-inch or a 15-inch display. And among those models are an even wider range of specs. In this article, we are concerned with the Mac laptops best suited to average use: home, student, and office work. There are 14- and 16-inch MacBook Pro models powered by M4 Pro or M4 Max chips that are better suited to pro users and have much higher prices, and they aren’t included here. But if you are thinking your needs might extend a little further on the pro side, you may be interested to read Which MacBook Pro or our guide to all of Apple’s laptops. We’ll be considering the following similarly specced Mac laptops: 13.6-inch MacBook Air, M2 (launched July 2022) 13.6-inch MacBook Air, M3 (launched March 2024) 14-inch MacBook Pro, M4 (launched October 2024) 15-inch MacBook Air, M3 (launched March 2024) For advice about the best MacBook, we also have a buying guide, see: Best MacBook: Which Mac laptop is best? We also offer advice about how much storage, RAM and cores in How much MacBook do you really need? Off to university? Read our guide to the best MacBook for students. MacBook Air vs MacBook Pro compared Here are the four Mac laptops that have our attention. We will compare design, specs, displays, price and other features below. 1. Apple 13-inch MacBook Air (M2, 2022) Price When Reviewed: $1,099 (current price at $999) Best Prices Today: $899 at Amazon$899 at B&H$899 at Best Buy Read our full Apple 13-inch MacBook Air (M2, 2022) review 2. Apple 13-inch MacBook Air (M3, 2024) Price When Reviewed: $1,099 (base) Best Prices Today: $999 at B&H$1049 at Adorama$1,064.49 at Amazon 3. Apple 15-Inch MacBook Air (M3, 2024) Price When Reviewed: $1,299 (base) Best Prices Today: $1,093 at Amazon$1199 at B&H$1199 at Best Buy Read our full Apple 15-inch MacBook Air (M3, 2024) review 4. Apple 14-inch MacBook Pro (M4, 2024) Price When Reviewed: $1,599 | $1,799 | $1,999 Best Prices Today: $1599 at Apple MacBook Air vs MacBook Pro: Design The design of the MacBook Air hasn’t changed since Apple revealed it in June 2022 and you could have been forgiven for thinking you were looking at a MacBook Pro. Gone is the tapered edge for which the Air was famous, replaced with a more uniform design. The MacBook Air is still thinner–albeit fractionally–but it is also very slightly larger than the old version of the Air, thanks to the bigger screen. Looking at the screen you will notice the other glaring difference in the new design: the MacBook Air has a notch like the one that’s also seen on the 14- and 16-inch MacBook Pro and iPhones. This enables the bigger screen and conceals a much better FaceTime camera, so it’s not a bad thing, although some people don’t like notches. If you miss that tapered design that made the MacBook Air instantly identifiable it is still available if you buy the M1 version of the MacBook Air. Apple no longer sells this model as a new laptop, but limited M1 MacBook Air inventory may be available in the Apple Certified Refurbished Store and you may still be able to pick one up from a third party–see our round-up of the Best MacBook Air deals. If a 13.6-inch screen isn’t big enough for you, Apple added a 15.3-inch MacBook Air to the lineup in June 2023. This larger model looks identical to the 13.6-inch MacBook Air, and shares (mostly) the same specs, it’s just bigger. 15-inch MacBook Air (left) and 14-inch MacBook Pro (right).Foundry The 14-inch MacBook Pro is a bit chunkier and heavier than the 15-inch MacBook Air due to the fans needed for heat dissipation, while the Air is, unsurprisingly, wider and taller, thanks to the bigger display. Both models have a Touch ID sensor built into the keyboard, and six-speaker arrays (the 13-inch Air only has a four-speaker sound system). The sound on the MacBook Pro is described by Apple as “High Fidelity,” by which we assume Apple is indicating it is superior to the Air. Connectivity for both models is via Bluetooth 5.3 and Wi-Fi 6E. With the October 2024 MacBook Pro update to the M4 chip, the 14-inch MacBook Pro now has a 12-megapixel camera with support for Center Stage and Desk View. The MacBook Air still has the 1080p FaceTime HD camera. The MacBook Pro camera is much better, in case you’re concerned with quality for video conferences. Another difference between these MacBooks is the color choices. There are four color choices for the 13-inch MacBook Air and the 15-inch MacBook Air: Midnight (dark blue), Starlight (gold), Space Gray and Silver. The Starlight shade is paler gold, while Midnight is close to black with a dark blue hue. The 14-inch MacBook Pro with M4 offers only Silver and Space Black options. There are four different color options for the MacBook Air.Apple MacBook Air vs MacBook Pro: Dimensions The 13-inch MacBook Air is lighter than the 14-inch MacBook Pro, as you’d expect, but the 15-inch MacBook Air is also lighter than the 14-inch MacBook Pro. 14-inch MacBook Pro, M4: 3.4 pounds (1.55 kg) 15-inch MacBook Air, M3: 3.3 pounds (1.51 kg) 13-inch MacBook Air, M3: 2.7 pounds (1.24 kg) The MacBook Air is thinner than the MacBook Pro. Apple The 15-inch MacBook Air is the largest of the M3 laptops, but because it’s thinner, it weighs less than the Pro. The 13-inch MacBook Air dimensions aren’t much smaller than those of the 14-inch MacBook Air. 15-inch MacBook Air, M3: 13.40 x 9.35 x 0.45 inches (34.04 x 23.76 x 1.15cm) 14-inch MacBook Pro, M3: 12.31 x 8.71 x 0.61 inches (31.26cm x 22.12cm x 1.55cm) 13-inch MacBook Air, M3: 11.97 x 8.46 x 0.44 inches (30.41 x 21.5 x 1.13cm) MacBook Air vs MacBook Pro: Display Here are the specs at a glance: 13-inch MacBook Air M3: 13.6 inches diagonal, 2,560 by 1,664 pixels 14-inch MacBook Pro M4: 14.2 inches diagonal, 3,024 by 1,964 pixels 15-inch MacBook Air M3: 15.3 inches diagonal, 2,880 by 1,864 pixels The MacBook Air has either a 15.3-inch or a 13.6-inch Liquid Retina display. The MacBook Pro comes with a superior 14.2-inch Liquid Retina XDR panel. The screen on the Air is a bit bigger, but the image quality is not as good as the screen on the MacBook Pro–it still looks great, though. The 15-inch Air’s display runs at a resolution of 2,880 by 1,864, while the 13-inch offers 2,560 by 1,664. Both Airs have a maximum brightness of 500 nits, which is half of the Pro’s 1,000 nits in normal use, or a third if you’re running HDR content at a max of 1,600 nits. This is achieved by the Pro display incorporating mini-LEDs rather than the Air’s standard LCD screen. Perhaps the biggest difference though is that the Pro features ProMotion, meaning that the refresh rate tops out at 120Hz, again double that of the Air’s 60Hz refresh rate. This helps keep scrolling and animations smooth and crisp. Any of these displays will be great for everyday use and long hours of work, but the Pro has the edge when it comes to features. With the M4 MacBook Pro, Apple introduced a nano-texture glass option that has a matte-like finish for $150. This option is not available on the MacBook Air, and if you need to cut down the glare from the display, it’s a feature to consider. 15-inch MacBook Air (left) and 14-inch MacBook Pro 2023.Foundry MacBook Air vs MacBook Pro: Specs All of Apple’s laptops are powered by Apple’s silicon. Amidst the MacBook Air and MacBook Pro offerings are two generations of chip: the M2 in the $999 13.6-inch MacBook Air, an M3 in the 13.6-inch and 15-inch Air models, and an M4 in the 14-inch MacBook Pro that we are considering here (there are also M4 Pro and M4 Max MacBook Pro options for those who need more power). To learn more about all the Mac processors read our Mac processor comparison and see how the M3 stacks up against all of Apple’s chips. This is how the specs in the various MacBook Air and the 14-inch MacBook Pro standard configurations compare: MacBookPriceCPUGPUMemorySSD13.6-inch MacBook Air, M2 (2022)$999/£9998-core, M28-core, M216GB (up to 24GB)256GB SSD13.6-inch MacBook Air, M3 (2024) $1,099/£1,0998-core, M38-core, M316GB (up to 24GB)256GB SSD13.6-inch MacBook Air, M3 (2024) $1,299/£1,2998-core, M310-core, M316GB (up to 24GB)512GB SSD13.6-inch MacBook Air, M3 (2024) $1,499/£1,4998-core, M310-core, M316GB (up to 24GB)512GB SSD15-inch MacBook Air, M3 (2024)$1,299/£1,2998-core, M310-core, M316GB (up to 24GB)256GB SSD15-inch MacBook Air, M3 (2024)$1,499/£1,4998-core, M310-core, M316GB (up to 24GB)512GB SSD15-inch MacBook Air, M3 (2024)$1,699/£1,6998-core, M310-core, M324GB (up to 24GB)512GB SSD14-inch MacBook Pro, M4 (2024)$1,599/£1,69910-core, M410-core, M416GB (up to 32GB)512GB SSD14-inch MacBook Pro, M4 (2024)$1,799/£1,89910-core, M410-core, M416GB (up to 32GB)1TB SSD14-inch MacBook Pro, M4 (2024)$1,999/£2,09910-core, M410-core, M424GB (up to 32GB)1TB SSDThe specs look similar, but expect more power from newer processor generations. There are also M4 Pro and M4 Max MacBook Pro models that we discuss in our MacBook Pro comparison and our Best MacBook guide. If you glance at the specs above, the closest comparison is between the $1,499/£1,499 15-inch MacBook Air and the $1,599/£1,699 14-inch MacBook Pro. The extra money for the MacBook Pro includes a better display, one more Thunderbolt port, an HDMI port, an SDXC Card slot, a better camera, and built-in fans to cool the laptop so it can maintain performance on long tasks. You may or may not need those features. With a smaller budget the 13.6-inch MacBook Air, M2 (2022) looks like a good deal at $999/£999. The main problem with this machine is the smaller SSD, not just because it’s smaller, but also because the 256GB SSDs are known to be slower. It still might be a good choice despite the SSD, because that probably won’t matter to you if the apps you use aren’t frequently writing to the hard drive. There are other factors that can slow down the MacBook Air though. Because the Air is compact and fanless it is less able to manage heat, and therefore may run slower in order to keep cool if you really push it. If it’s power you need then the benchmarks give a clearer picture (MacBook Pro M4 benchmarks are not yet available. We will update this chart as soon as we get the data. For your reference, you can see how the rest of the chips compare):

Read more »

MacBook Pro features the most advanced lineup of chips ever in a pro laptop
MacBook Pro features the most advanced lineup of chips ever built for a pro laptop. Phenomenal single- and multithreaded CPU… The post appeared first on MacDailyNews.

Read more »

Save up to $90 on latest iPad Magic Keyboard from Apple
Save a bundle on the Apple Magic Keyboard for your iPad and unlock its full potential to act as both a tablet and a laptop. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

M4 MacBook Air: Here’s everything that’s coming next
Apple has launched its first M4 Macs, but the most popular Mac wasn’t among them. The MacBook Air has not yet received an M4 chip. But here’s everything we know about when that upgrade’s coming, and what else to expect from the new model. more…

Read more »

New M4 Mac mini, MacBook Pro, and iMac reactions
Benjamin and Chance react to this week’s trio of Apple announcements, with the exciting launch of the newly redesigned M4 Mac mini, and all the changes in the updated M4 MacBook Pro and iMac lineups.  And in Happy Hour Plus, we consider how successful this three-day event format was for Apple, and whether we’d like them to do it again. Subscribe at 9to5mac.com/join. Sponsored by Shopify: Grow your business no matter what stage you’re in. Sign up for a $1 per month trial at shopify.com/happyhour. Sponsored by Oracle: Take a free test drive of OCI at oracle.com/HAPPYHOUR more…

Read more »

Are you wasting time applying for tech industry ‘ghost jobs?’
Fake job listings from legitimate companies -- "ghost jobs" -- serve multiple purposes, some of them nefarious. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Hands-on with M4 MacBook Pro, iMac, and tiny new Mac mini – video
Via Apple’s Los Angeles hands-on showroom event on Wednesday, which let creators get their first hands on with the new M4-powered… The post appeared first on MacDailyNews.

Read more »

This surprising Mac upgrade hints at big Apple Intelligence features coming
Apple’s big trio of M4 Mac announcements is over. But one of the week’s biggest surprises gives us a hint into what Apple has in store for the Mac’s future, especially in the realm of new Apple Intelligence features. more…

Read more »

4 reasons why another 27-inch iMac is unlikely
Uncover the mystery of the missing 27-inch iMac. Learn the drawbacks and reasons behind Apple's decision to discontinue the desktop. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Get a MacBook Pro M4 with AppleCare from $52/mo, with option to upgrade every 2 years
There's no doubt about it — buying a new MacBook Pro in full every two years can get expensive. But with this subscription service, it's easy to get the latest technology (and enjoy the peace of mind of having AppleCare included) for a low monthly fee.Get low monthly payments with option to upgrade every 2 years - Image credit: UpgradedIf you're like me and want to upgrade your Mac regularly, it's worth checking out GetUpgraded.com, a service operating similarly to Apple's iPhone Upgrade Program, but for MacBooks.Check out the service Continue Reading on AppleInsider | Discuss on our Forums

Read more »

M4 MacBook Pro doesn’t tempt me because Apple Silicon Macs are almost too good
The new M4 MacBook Pro is a beast, offering a phenomenal combination of performance and battery-life, with the bonus of a Center Stage camera and the option of a nano-texture display. But I have to say that I’m note remotely tempted because, honestly, my 2021 M1 Max MacBook Pro still feels to me like a brand-new machine – and that phenomenon could be an issue for Apple going forward … more…

Read more »

Deals: M4 MacBook Pro up to $960 off with M3 trade, black Apple Watch Ultra 2 new low, Apple Pencil Pro, more
Joining early discounts and elevated trade-in opportunities on the new M4 iMac and the new M4 Mac mini, today we are turning our attention to the next-generation M4 MacBook Pro lineup with the deals. Not only can My Best Buy members knock up to $150 off pre-orders right now, but the retailer is also offering elevated trade-in values that can net you an M4 MacBook Pro as low as $639 when flipping a base model M3 model (and the value just goes up from there). All of the details you need are right here alongside new lows on the black Apple Watch Ultra 2, notable discounts on M2 iPad Air models starting from $497, a solid offer on Apple Pencil Pro, and more. Everything awaits below in today’s 9to5Toys Lunch Break.  more…

Read more »

Report: Apple to make its own Wi-Fi chip as soon as 2025
Macworld Following reports earlier this month that Apple is planning to use its own 5G modem in the next iPhone SE, a new report claims that Apple will start to implement its own Wi-Fi chip in the iPhone 17 starting next year. Analyst Ming-Chi Kuo posted on X that in the second half of 2025, Apple will use its own Wi-Fi chip in new products, ditching the chip created by Qualcomm. The chip will be manufactured using “TSMC’s N7 process and support the latest Wi-Fi 7 spec.” See the X post below: Broadcom currently supplies over 300 million Wi-Fi+BT chips (hereafter referred to as Wi-Fi chips) per year to Apple. However, Apple will rapidly reduce its reliance on Broadcom. With new products in 2H25 (e.g., iPhone 17), Apple plans to use its own Wi-Fi chips, which will be made by TSMC’s N7 process and support the latest Wi-Fi 7 spec. Apple expects to move nearly all products to in-house Wi-Fi chips within about three years. This move will reduce costs and enhance Apple’s ecosystem integration advantages. Ming-Chi Kuo, October 31, 2024 Interestingly, Kuo states the iPhone 17 as an example, which makes it unclear if he thinks the iPhone 17 will use the same 5G, Wi-Fi, and Bluetooth combo chip that was reported by 9to5Mac earlier this month, or if he’s referring to a different chip altogether. Apple could also update its just-released M4 Mac lineup with the M5 chip in the second half of 2025 and install its own Wi-Fi chip, which will use “the latest W-Fi 7 spec” according to Kuo. The new M4 Macs surprisingly do not feature Wi-Fi 7 like the iPhone 16 lineup. Instead, they have Wi-Fi 6E, so perhaps Apple held off on Wi-Fi 7 until its own chip is ready. Rumors of an Apple-made 5G modem have been making the rounds for years, and it seems that it could finally come to fruition next year. By creating its own chip instead of relying on a third-party one, Apple can optimize it for performance, which could help with power efficiency and performance. It could also save the company some money, too.

Read more »

Hacks and jokes ‘fix’ M4 Mac mini’s odd power-button placement
Is this the Magic Mouse charging port all over again? Internet hacks and jokes poke fun with M4 Mac mini power button "fixes." (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Google Maps adding weather disruption reporting & more detailed driving map
In addition to Gemini for search, summaries, and Q&A, Google Maps for Android and iOS are getting updates to improve the entire driving experience “from start to finish.”  more…

Read more »

Claude now has a dedicated AI Mac app from Anthropic
The Mac’s AI announcement week continues on. Apple doesn’t have any new AI-ready Macs to announce today, but instead we’re getting a dedicated Mac app from one of the biggest AI players. Claude is now available in a Mac app from Anthropic. more…

Read more »

Wall Street thinks Apple is doing great
Get an early look at financial results of Apple's latest quarter. Analysts anticipate record total revenue powered by strong iPhone sales. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple said to dump Broadcom Wi-Fi for its own custom design next year
Apple is set to take another step towards self-reliance. The company is developing its own Wi-Fi 7 chips to replace Broadcom parts… The post appeared first on MacDailyNews.

Read more »

Change Healthcare Breach Hits 100M Americans
Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information.

Read more »

The Global Surveillance Free-for-All in Mobile Ad Data
Not long ago, the ability to remotely track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a powerful surveillance tool that should only be in the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows that anyone can now access this capability, thanks to a proliferation of commercial services that hoover up the digital exhaust emitted by widely-used mobile apps and websites.

Read more »

Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.--Social Link Groups  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com  acm309--PutongOJ  PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually. 2024-10-17 9.1 CVE-2024-48920 security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com  acronis -- cyber_files  Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.8 CVE-2024-49389 security@acronis.com  acronis -- cyber_files  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.3 CVE-2024-49390 security@acronis.com  acronis -- cyber_files  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.3 CVE-2024-49391 security@acronis.com  acronis -- cyber_protect  Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. 2024-10-15 9.1 CVE-2024-49388 security@acronis.com  acronis -- cyber_protect  Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. 2024-10-15 7.5 CVE-2024-49387 security@acronis.com  Agustin Berasategui--AB Categories Search Widget  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Agustin Berasategui AB Categories Search Widget allows Reflected XSS.This issue affects AB Categories Search Widget: from n/a through 0.2.5. 2024-10-18 7.1 CVE-2024-49240 audit@patchstack.com  Ahime--Ahime Image Printer  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ahime Ahime Image Printer.This issue affects Ahime Image Printer: from n/a through 1.0.0. 2024-10-16 7.5 CVE-2024-49245 audit@patchstack.com  Ahmet Imamoglu--Ahmeti Wp Timeline  Cross-Site Request Forgery (CSRF) vulnerability in Ahmet Imamoglu Ahmeti Wp Timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through 5.1. 2024-10-17 7.1 CVE-2024-49237 audit@patchstack.com  Al Imran Akash--Recently  Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently allows Object Injection.This issue affects Recently: from n/a through 1.1. 2024-10-16 9.8 CVE-2024-49218 audit@patchstack.com  anand23--Ajax Rating with Custom Login  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login allows SQL Injection.This issue affects Ajax Rating with Custom Login: from n/a through 1.1. 2024-10-17 9.3 CVE-2024-49246 audit@patchstack.com  andrewmrobbins--ShopWP  The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts. 2024-10-16 7.2 CVE-2019-25214 security@wordfence.comsecurity@wordfence.com  Apa--Apa Banner Slider  Cross-Site Request Forgery (CSRF) vulnerability in Apa Apa Banner Slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49622 audit@patchstack.com  Apa--APA Register Newsletter Form  Cross-Site Request Forgery (CSRF) vulnerability in Apa APA Register Newsletter Form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49621 audit@patchstack.com  apache -- activemq_artemis  Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue. 2024-10-14 8.8 CVE-2023-50780 security@apache.org  apache -- cloudstack  Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. 2024-10-16 8.8 CVE-2024-45693 security@apache.orgsecurity@apache.orgsecurity@apache.org  apache -- cloudstack  The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. 2024-10-16 7.1 CVE-2024-45462 security@apache.orgsecurity@apache.orgsecurity@apache.org  Apache Software Foundation--Apache CloudStack  Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks to their existing instances. Due to missing validation checks for KVM-compatible templates or volumes in CloudStack 4.0.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1, an attacker that can upload or register templates and volumes, can use them to deploy malicious instances or attach uploaded volumes to their existing instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Additionally, all user-uploaded or registered KVM-compatible templates and volumes can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run this on their secondary storage(s) and inspect output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "nn"; done The command can also be run for the file-based primary storages; however, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. For checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "nn"; done 2024-10-16 8.5 CVE-2024-45219 security@apache.orgsecurity@apache.orgsecurity@apache.org  Apache Software Foundation--Apache Solr  Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue. 2024-10-16 9.8 CVE-2024-45216 security@apache.org  Apache Software Foundation--Apache Solr  Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise. 2024-10-16 8.1 CVE-2024-45217 security@apache.org  Arif Nezami--Better Author Bio  Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11. 2024-10-17 7.1 CVE-2024-49229 audit@patchstack.com  arisoft--ARI Adminer WordPress Database Manager  The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes. 2024-10-16 7.3 CVE-2019-25215 security@wordfence.comsecurity@wordfence.com  arraytics--WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin  The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible. 2024-10-17 9.8 CVE-2024-9263 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Asep Bagja Priandana--Woostagram Connect  Unrestricted Upload of File with Dangerous Type vulnerability in Asep Bagja Priandana Woostagram Connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through 1.0.2. 2024-10-20 10 CVE-2024-49327 audit@patchstack.com  Autodesk--Revit  A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-16 7.8 CVE-2024-7993 psirt@autodesk.com  Autodesk--Revit  A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-16 7.8 CVE-2024-7994 psirt@autodesk.com  Avchat.net--AVChat Video Chat  Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2. 2024-10-20 7.1 CVE-2024-49605 audit@patchstack.com  bc2018--WordPress Landing Page Squeeze Page Responsive Landing Page Builder Free WP Lead Plus X  The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-10-16 8.3 CVE-2020-36839 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Bhaskar Dhote--Back Link Tracker  Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Back Link Tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49617 audit@patchstack.com  Boyan Raichev--IP Loc8  Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 allows Object Injection.This issue affects IP Loc8: from n/a through 1.1. 2024-10-16 9.8 CVE-2024-48028 audit@patchstack.com  Brandon Clark--SiteBuilder Dynamic Components  Deserialization of Untrusted Data vulnerability in Brandon Clark SiteBuilder Dynamic Components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through 1.0. 2024-10-20 9.8 CVE-2024-49625 audit@patchstack.com  Brandon White--Author Discussion  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through 0.2.2. 2024-10-20 8.5 CVE-2024-49609 audit@patchstack.com  brx8r--Nice Backgrounds  Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through 1.0. 2024-10-20 10 CVE-2024-49330 audit@patchstack.com  ChanGate--Property Management System  Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. 2024-10-15 9.8 CVE-2024-9972 twcert@cert.org.twtwcert@cert.org.tw  chertz--WP Easy Post Types  The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. 2024-10-18 8.8 CVE-2024-10079 security@wordfence.comsecurity@wordfence.com  chertz--WP Easy Post Types  The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts. 2024-10-18 7.3 CVE-2024-10078 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Cisco--Cisco Analog Telephone Adaptor (ATA) Software  A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device. This vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware. 2024-10-16 8.2 CVE-2024-20458 ykramarz@cisco.com  Cisco--Cisco Analog Telephone Adaptor (ATA) Software  A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. 2024-10-16 7.1 CVE-2024-20421 ykramarz@cisco.com  cmssoft--CSV Product Import Export for WooCommerce  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cmssoft CSV Product Import Export for WooCommerce allows SQL Injection.This issue affects CSV Product Import Export for WooCommerce: from n/a through 1.0.0. 2024-10-17 8.5 CVE-2024-49244 audit@patchstack.com  code-projects -- pharmacy_management_system  A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_customer.php?action=search. The manipulation of the argument text leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-15 9.8 CVE-2024-9976 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Blood Bank Management System  A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file member_register.php. The manipulation of the argument fullname/username/password/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "password" to be affected. But it must be assumed that other parameters are affected as well. 2024-10-15 7.3 CVE-2024-9986 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  CodeFlock--FREE DOWNLOAD MANAGER  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through 1.0.0. 2024-10-17 8.6 CVE-2024-49315 audit@patchstack.com  CodePassenger--Job Board Manager for WordPress  Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through 1.0. 2024-10-17 9.8 CVE-2024-49322 audit@patchstack.com  Codezips--Sales Management System  A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10165 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Sales Management System  A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file checkuser.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10166 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Sales Management System  A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10167 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Cookie Scanner Nikel Schubert--Cookie Scanner  Cross-Site Request Forgery (CSRF) vulnerability in Cookie Scanner - Nikel Schubert Cookie Scanner allows Stored XSS.This issue affects Cookie Scanner: from n/a through 1.1. 2024-10-17 7.1 CVE-2024-49220 audit@patchstack.com  cyberlord92--Miniorange OTP Verification with Firebase  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. 2024-10-17 9.8 CVE-2024-9862 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  cyberlord92--Miniorange OTP Verification with Firebase  The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled. 2024-10-17 9.8 CVE-2024-9863 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  cyberlord92--Miniorange OTP Verification with Firebase  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user. 2024-10-17 8.1 CVE-2024-9861 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Dan Alexander--SermonAudio Widgets  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dan Alexander SermonAudio Widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through 1.9.3. 2024-10-20 8.5 CVE-2024-49614 audit@patchstack.com  Dassault Systmes--3DSwymer  An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker to access some unauthorized data. 2024-10-16 7.7 CVE-2024-8040 3DS.Information-Security@3ds.com  Dassault Systmes--ENOVIA Collaborative Industry Innovator  A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. 2024-10-16 8.7 CVE-2024-6380 3DS.Information-Security@3ds.com  Dell--Dell OpenManage Enterprise  Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. 2024-10-17 8 CVE-2024-45766 security_alert@emc.com  Denis--Azz Anonim Posting  Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through 0.9. 2024-10-16 10 CVE-2024-49257 audit@patchstack.com  Dennis Hoppe--Encyclopedia / Glossary / Wiki  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dennis Hoppe Encyclopedia / Glossary / Wiki allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through 1.7.60. 2024-10-17 7.1 CVE-2024-49320 audit@patchstack.com  didi--DDMQ  A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. 2024-10-20 7.3 CVE-2024-10173 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Dotsquares--Google Map Locations  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dotsquares Google Map Locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through 1.0. 2024-10-20 7.1 CVE-2024-49606 audit@patchstack.com  dueclic -- wp_2fa_with_telegram  The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator. 2024-10-15 8.8 CVE-2024-9687 security@wordfence.comsecurity@wordfence.com  dueclic -- wp_2fa_with_telegram  The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication. 2024-10-15 7.5 CVE-2024-9820 security@wordfence.comsecurity@wordfence.com  easy.jobs--EasyJobs  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14. 2024-10-17 7.1 CVE-2024-43997 audit@patchstack.com  edo888--Translate WordPress Google Language Translator  The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support. 2024-10-16 7.1 CVE-2021-4452 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Edush Maxim--GoogleDrive folder list  Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2. 2024-10-20 7.1 CVE-2024-49335 audit@patchstack.com  emrevona--WP Fastest Cache  The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server. 2024-10-16 8.8 CVE-2020-36836 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  ESi Technology--AIM LINE Marketing Platform  AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content. 2024-10-15 9.8 CVE-2024-9982 twcert@cert.org.twtwcert@cert.org.tw  F5--BIG-IP  BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. 2024-10-16 7.2 CVE-2024-45844 f5sirt@f5.com  facebook--Facebook Chat Plugin Live Chat Plugin for WordPress  The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. 2024-10-16 7.4 CVE-2020-36838 security@wordfence.comsecurity@wordfence.com  Fahad Mahmood--Endless Posts Navigation  Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through 2.2.7. 2024-10-20 7.1 CVE-2024-49629 audit@patchstack.com  Fahad Mahmood--Keep Backup Daily  : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through 2.0.7. 2024-10-17 7.5 CVE-2024-48024 audit@patchstack.com  filemanagerpro -- file_manager  The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-10-16 8.8 CVE-2024-8507 security@wordfence.comsecurity@wordfence.com  filemanagerpro -- file_manager  The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible. 2024-10-16 8.8 CVE-2024-8746 security@wordfence.comsecurity@wordfence.com  Fliperrr Team--Creates 3D Flipbook, PDF Flipbook  Unrestricted Upload of File with Dangerous Type vulnerability in Fliperrr Team Creates 3D Flipbook, PDF Flipbook allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through 1.2. 2024-10-16 9.9 CVE-2024-48034 audit@patchstack.com  formosasoft -- ee-class  The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify and delete database contents. 2024-10-15 8.8 CVE-2024-9980 twcert@cert.org.twtwcert@cert.org.tw  formosasoft -- ee-class  The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server. 2024-10-15 8.8 CVE-2024-9981 twcert@cert.org.twtwcert@cert.org.tw  Gabriele Valenti--Telecash Ricaricaweb  Deserialization of Untrusted Data vulnerability in Gabriele Valenti Telecash Ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through 2.2. 2024-10-16 9.8 CVE-2024-48030 audit@patchstack.com  Gerry Ntabuhashe--GERRYWORKS Post by Mail  : Incorrect Privilege Assignment vulnerability in Gerry Ntabuhashe GERRYWORKS Post by Mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through 1.0. 2024-10-20 8.8 CVE-2024-49608 audit@patchstack.com  Giveaway Boost--Giveaway Boost  Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4. 2024-10-20 9.8 CVE-2024-49332 audit@patchstack.com  google -- chrome  Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) 2024-10-15 8.8 CVE-2024-9954 chrome-cve-admin@google.comchrome-cve-admin@google.com  google -- chrome  Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) 2024-10-15 8.8 CVE-2024-9965 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google Cloud--Migrate to Containers  There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user "m2cuser". We recommend upgrading to 1.2.3 or beyond 2024-10-16 7.8 CVE-2024-9858 cve-coordination@google.com  Google--Chrome  Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9955 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9957 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9959 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9960 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9961 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 7.8 CVE-2024-9956 chrome-cve-admin@google.comchrome-cve-admin@google.com  Gora Tech LLC--Cooked Pro  Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0. 2024-10-17 10 CVE-2024-49291 audit@patchstack.com  Grafana--Grafana  The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. 2024-10-18 9.9 CVE-2024-9264 security@grafana.com  Grayson Robbins--Disc Golf Manager  Deserialization of Untrusted Data vulnerability in Grayson Robbins Disc Golf Manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through 1.0.0. 2024-10-16 9.8 CVE-2024-48026 audit@patchstack.com  Hasan Movahed--Duplicate Title Validate  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hasan Movahed Duplicate Title Validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through 1.0. 2024-10-20 8.5 CVE-2024-49623 audit@patchstack.com  helmholz -- myrex24_v2_virtual_server  An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. 2024-10-15 7.5 CVE-2024-45272 info@cert.vde.cominfo@cert.vde.com  Henrique Rodrigues--SafetyForms  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49615 audit@patchstack.com  Hgiga--OAKlouds  The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently . 2024-10-14 9.8 CVE-2024-9924 twcert@cert.org.twtwcert@cert.org.tw  HMS Networks--EWON FLEXY 202  The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials. 2024-10-17 8.2 CVE-2024-7755 ics-cert@hq.dhs.gov  HP Inc.--Certain HP DesignJet products  Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials. 2024-10-15 7.5 CVE-2024-5749 hp-security-alert@hp.com  Hung Trang Si--SB Random Posts Widget  : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through 1.0. 2024-10-16 7.5 CVE-2024-48029 audit@patchstack.com  Igor Funa--Ad Inserter  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Igor Funa Ad Inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.7.37. 2024-10-17 7.1 CVE-2024-49248 audit@patchstack.com  Imagination Technologies--Graphics DDK  Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. 2024-10-14 7.8 CVE-2024-43701 367425dc-4d06-4041-9650-c2dc6aaa27ce  Infotuts--SW Contact Form  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infotuts SW Contact Form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through 1.0. 2024-10-20 8.5 CVE-2024-49612 audit@patchstack.com  Innovaweb Sp. z o.o.--Free Stock Photos Foter  Deserialization of Untrusted Data vulnerability in Innovaweb Sp. Z o.O. Free Stock Photos Foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through 1.5.4. 2024-10-16 8.8 CVE-2024-49227 audit@patchstack.com  Jack Zhu--photokit  Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0. 2024-10-20 10 CVE-2024-49610 audit@patchstack.com  James Park--Analyse Uploads  Relative Path Traversal vulnerability in James Park Analyse Uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through 0.5. 2024-10-16 8.6 CVE-2024-49253 audit@patchstack.com  JetBrains--YouTrack  In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests 2024-10-17 8.1 CVE-2024-49579 cve@jetbrains.com  jetmonsters--Timetable and Event Schedule by MotoPress  The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more. 2024-10-16 7.3 CVE-2020-36840 security@wordfence.comsecurity@wordfence.com  Jon Vincent Mendoza--Dynamic Elementor Addons  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jon Vincent Mendoza Dynamic Elementor Addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through 1.0.0. 2024-10-18 7.5 CVE-2024-49243 audit@patchstack.com  Jordan Lyall--MyTweetLinks  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through 1.1.1. 2024-10-20 8.5 CVE-2024-49618 audit@patchstack.com  Joshua Clayton--Feed Comments Number  Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Clayton Feed Comments Number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through 0.2.1. 2024-10-16 10 CVE-2024-49216 audit@patchstack.com  Julian Weinert // cs&m--cSlider  Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m cSlider allows Stored XSS.This issue affects cSlider: from n/a through 2.4.2. 2024-10-17 7.1 CVE-2024-49221 audit@patchstack.com  Kubernetes--Image Builder  A security issue was discovered in the Kubernetes Image Builder versions

Read more »

Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach
Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being "USDoD," a prolific cybercriminal who rose to infamy in 2022 after infiltrating the FBI's InfraGard program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the consumer data broker National Public Data that led to the leak of Social Security numbers and other personal information for a significant portion of the U.S. population.

Read more »

Sudanese Brothers Arrested in ‘AnonSudan’ Takedown
The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running Anonymous Sudan (a.k.a. AnonSudan), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers. One of the brothers is facing life in prison for allegedly seeking to kill people with his attacks.

Read more »

Lamborghini Carjackers Lured by $243M Cyberheist
The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later, while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom.

Read more »

Patch Tuesday, October 2024 Edition
Microsoft today released security updates to fix at least 117 security holes in Windows computers and other software, including two vulnerabilities that are already seeing active attacks. Also, Adobe plugged 52 security holes across a range of products, and Apple has addressed a bug in its new macOS 15 "Sequoia" update that broke many cybersecurity tools.

Read more »

A Single Cloud Compromise Can Feed an Army of AI Sex Bots
Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom jailbreaks to bypass content filtering, often veer into darker role-playing scenarios, including child sexual exploitation and rape.

Read more »

Crooked Cops, Stolen Laptops & the Ghost of UGNazi
A California man accused of failing to pay taxes on tens of millions of dollars allegedly earned from cybercrime also paid local police officers hundreds of thousands of dollars to help him extort, intimidate and silence rivals and former business partners, a new indictment charges. KrebsOnSecurity has learned that many of the man's alleged targets were members of UGNazi, a hacker group behind multiple high-profile breaches and cyberattacks back in 2012.

Read more »

U.S. Indicts 2 Top Russian Hackers, Sanctions Cryptex
The United States today unveiled sanctions and indictments against the alleged proprietor of Joker's Stash, a now-defunct cybercrime store that peddled tens of millions of payment cards stolen in some of the largest data breaches of the past decade. The government also indicted a top Russian cybercriminal known as Taleon, whose cryptocurrency exchange Cryptex has evolved into one of Russia's most active money laundering networks.

Read more »

Timeshare Owner? The Mexican Drug Cartels Want You
The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick elderly people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two dozen phony escrow, title and realty firms.

Read more »

Price drop! 13-inch M3 MacBook Airs now available starting at only $829 at Apple, Certified Refurbished
With yesterday's across-the-board MacBook Air upgrade to 16GB of RAM standard, Apple has dropped prices on clearance 13" 8GB M3 MacBook Airs, Certified Refurbished, to a new low starting at only $829. These are the cheapest M3-powered MacBooks for sale at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core M3 CPU, 8-Core GPU/8GB RAM/256GB SSD: $829, was $929 - 13" M2 MacBook Air/8-Core M3 CPU, 10-Core GPU/8GB RAM/512GB SSD: $999, was $1099 - 13" M2 MacBook Air/8-Core M3 CPU, 10-Core GPU/16GB RAM/512GB SSD: $1199, was $1269 According the Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Price drop! Apple 15-inch M3 MacBook Airs now available starting at $999 at Apple, Certified Refurbished
With yesterday's release of 15-inch M3 MacBook Airs with 16GB of RAM standard, Apple has dropped prices on clearance Certified Refurbished 15" 8GB M3 MacBook Airs to a new low starting at only $999. These are the cheapest M3-powered 15" MacBook Airs for sale today at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell. The following standard-configurations are available: - 15" MacBook Air/8-Core M3 CPU, 8-Core GPU/8GB RAM/256GB SSD: $999, was $1099 - 15" MacBook Air/8-Core M3 CPU, 10-Core GPU/8GB RAM/512GB SSD: $1169, was $1269 - 15" MacBook Air/8-Core M3 CPU, 10-Core GPU/16GB RAM/512GB SSD: $1279, was $1439 According the Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Apple has clearance 15-inch M2 MacBook Airs available starting at only $929, Certified Refurbished
Apple has clearance, Certified Refurbished, 15" M2 MacBook Airs now available starting at $929 and ranging up to $410 off original MSRP. These are the cheapest 15" MacBook Airs for sale today at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell. The following standard-configurations are available: - 15" MacBook Air/8-Core M2 CPU, 8-Core GPU/8GB RAM/256GB SSD/Space Gray: $929, $370 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 8-Core GPU/8GB RAM/256GB SSD/Silver: $929, $370 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 8-Core GPU/8GB RAM/256GB SSD/Starlight: $929, $370 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 8-Core GPU/8GB RAM/256GB SSD/Midnight: $929, $370 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 10-Core GPU/8GB RAM/512GB SSD/Space Gray: $1089, $410 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 10-Core GPU/8GB RAM/512GB SSD/Silver: $1089, $410 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 10-Core GPU/8GB RAM/512GB SSD/Starlight: $1089, $410 off original MSRP - 15" MacBook Air/8-Core M2 CPU, 10-Core GPU/8GB RAM/512GB SSD/Midnight: $1089, $410 off original MSRP According the Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 15" MacBook Air Price Tracker, updated daily.

Read more »

Apple drops prices on 13-inch M2 MacBook Airs to only $749, Certified Refurbished
Apple has dropped prices on 13" M2 MacBook Airs to a new low of only $749 in their Certified Refurbished store. These are the cheapest M2-powered MacBooks for sale at Apple. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Space Gray: $749, $250 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Silver: $749, $250 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Starlight: $749, $250 off MSRP - 13" M2 MacBook Air/8-Core GPU/8GB RAM/256GB SSD/Midnight: $749, $250 off MSRP Step up to a 10-core GPU and 512GB of storage for $919: - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Space Gray: $919, $280 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Silver: $919, $280 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Starlight: $919, $280 off MSRP - 13" M2 MacBook Air/10-Core GPU/8GB RAM/512GB SSD/Midnight: $919, $280 off MSRP According to Apple, “You will receive a 'like new' device with genuine Apple replacement parts (as needed) that has been thoroughly cleaned and inspected. Every device will come with all accessories, cables and operating systems. All Apple Certified Refurbished products are packaged in a brand new white box and will be sent to you with free shipping and returns.” Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Clearance 13-inch M1 MacBook Airs available at Apple for $679
Apple has clearance 13" M1 MacBook Airs, Certified Refurbished, now available for $679 for 8-Core CPU/7-Core GPU/256GB models. Apple's one-year warranty is included, shipping is free, and each MacBook has a new outer shell: - 13" MacBook Air/8-Core M1 CPU, 7-Core GPU/256GB SSD/Gray: $759 - 13" MacBook Air/8-Core M1 CPU, 7-Core GPU/256GB SSD/Silver: $759 - 13" MacBook Air/8-Core M1 CPU, 7-Core GPU/256GB SSD/Gold: $759 Note that stock status may vary, check Apple's site for availability. For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

Apple updates their MacBook Pros with the M4 family of Apple Silicon CPUs, better battery life, better camera, and an updated display
Apple has just introduced the latest MacBook Pro lineup, now powered by the advanced M4 family of chips — including the M4, M4 Pro, and M4 Max. These new processors deliver impressive speed and enhanced capabilities tailored for Apple Intelligence, Apple’s personal intelligence system designed to transform how users work, communicate, and create, while prioritizing privacy. Available in sleek space black and silver, the 14-inch MacBook Pro starts at $1,599 and features the powerful M4 chip, three Thunderbolt 4 ports, and 16GB of base memory. The 14- and 16-inch models with M4 Pro and M4 Max take things further, offering Thunderbolt 5 for faster data transfer and expanded connectivity options. Every model comes equipped with a Liquid Retina XDR display, now with an optional nano-texture finish for enhanced visuals, and delivers up to 1,000 nits of brightness for SDR content. Additional features include a 12MP Center Stage camera and an extended battery life of up to 24 hours — the longest of any Mac yet. Pre-orders for the new MacBook Pro are open now, with availability starting November 8. Pricing begins at $1,599 for the 14-inch MacBook Pro with M4, and $1,499 for education customers. The 14-inch MacBook Pro with M4 Pro is priced at $1,999 ($1,849 for education), while the 16-inch model starts at $2,499 ($2,299 for education). All models are available in both space black and silver finishes. We'll be updating our 14-inch MacBook Pro Price Tracker and 16-inch MacBook Pro Price Tracker with the latest information on prices and sales as they become available from Apple retailers in the coming days.

Read more »

Apple updates their MacBook Pros with the M4 family of Apple Silicon CPUs, better battery life, better camera, and an updated display
Apple has just introduced the latest MacBook Pro lineup, now powered by the advanced M4 family of chips — including the M4, M4 Pro, and M4 Max. These new processors deliver impressive speed and enhanced capabilities tailored for Apple Intelligence, Apple’s personal intelligence system designed to transform how users work, communicate, and create, while prioritizing privacy. Available in sleek space black and silver, the 14-inch MacBook Pro starts at $1,599 and features the powerful M4 chip, three Thunderbolt 4 ports, and 16GB of base memory. The 14- and 16-inch models with M4 Pro and M4 Max take things further, offering Thunderbolt 5 for faster data transfer and expanded connectivity options. Every model comes equipped with a Liquid Retina XDR display, now with an optional nano-texture finish for enhanced visuals, and delivers up to 1,000 nits of brightness for SDR content. Additional features include a 12MP Center Stage camera and an extended battery life of up to 24 hours — the longest of any Mac yet. Pre-orders for the new MacBook Pro are open now, with availability starting November 8. Pricing begins at $1,599 for the 14-inch MacBook Pro with M4, and $1,499 for education customers. The 14-inch MacBook Pro with M4 Pro is priced at $1,999 ($1,849 for education), while the 16-inch model starts at $2,499 ($2,299 for education). All models are available in both space black and silver finishes. We'll be updating our 14-inch MacBook Pro Price Tracker and 16-inch MacBook Pro Price Tracker with the latest information on prices and sales as they become available from Apple retailers in the coming days.

Read more »

Apple updates their MacBook Pros with the M4 family of Apple Silicon CPUs, better battery life, better camera, and an updated display
Apple has just introduced the latest MacBook Pro lineup, now powered by the advanced M4 family of chips — including the M4, M4 Pro, and M4 Max. These new processors deliver impressive speed and enhanced capabilities tailored for Apple Intelligence, Apple’s personal intelligence system designed to transform how users work, communicate, and create, while prioritizing privacy. Available in sleek space black and silver, the 14-inch MacBook Pro starts at $1,599 and features the powerful M4 chip, three Thunderbolt 4 ports, and 16GB of base memory. The 14- and 16-inch models with M4 Pro and M4 Max take things further, offering Thunderbolt 5 for faster data transfer and expanded connectivity options. Every model comes equipped with a Liquid Retina XDR display, now with an optional nano-texture finish for enhanced visuals, and delivers up to 1,000 nits of brightness for SDR content. Additional features include a 12MP Center Stage camera and an extended battery life of up to 24 hours — the longest of any Mac yet. Pre-orders for the new MacBook Pro are open now, with availability starting November 8. Pricing begins at $1,599 for the 14-inch MacBook Pro with M4, and $1,499 for education customers. The 14-inch MacBook Pro with M4 Pro is priced at $1,999 ($1,849 for education), while the 16-inch model starts at $2,499 ($2,299 for education). All models are available in both space black and silver finishes. We'll be updating our 14-inch MacBook Pro Price Tracker and 16-inch MacBook Pro Price Tracker with the latest information on prices and sales as they become available from Apple retailers in the coming days.

Read more »

Price drop! 14-inch M3 Pro/M3 Max MacBook Pros now available at Apple starting at $1599, Certified Refurbished
With today's introduction of M4 Pro and M4 Max 14-inch MacBook Pros, Apple has dropped prices on clearance 14" M3 Pro and M3 Max MacBook Pros, Certified Refurbished, to a new low starting at $1599. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 Pro and M3 Max MacBook Pros currently available for sale at Apple: - 14" M3 Pro MacBook Pro (18GB/512GB/Black): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Black): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Black): $2629 was $2719 - 14" M3 Pro MacBook Pro (18GB/512GB/Silver): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Silver): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Silver): $2629 was $2719 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily.

Read more »

Price drop! 14-inch M3 Pro/M3 Max MacBook Pros now available at Apple starting at $1599, Certified Refurbished
With today's introduction of M4 Pro and M4 Max 14-inch MacBook Pros, Apple has dropped prices on clearance 14" M3 Pro and M3 Max MacBook Pros, Certified Refurbished, to a new low starting at $1599. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 Pro and M3 Max MacBook Pros currently available for sale at Apple: - 14" M3 Pro MacBook Pro (18GB/512GB/Black): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Black): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Black): $2629 was $2719 - 14" M3 Pro MacBook Pro (18GB/512GB/Silver): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Silver): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Silver): $2629 was $2719 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily.

Read more »

Price drop! 14-inch M3 Pro/M3 Max MacBook Pros now available at Apple starting at $1599, Certified Refurbished
With today's introduction of M4 Pro and M4 Max 14-inch MacBook Pros, Apple has dropped prices on clearance 14" M3 Pro and M3 Max MacBook Pros, Certified Refurbished, to a new low starting at $1599. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M3 Pro and M3 Max MacBook Pros currently available for sale at Apple: - 14" M3 Pro MacBook Pro (18GB/512GB/Black): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Black): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Black): $2629 was $2719 - 14" M3 Pro MacBook Pro (18GB/512GB/Silver): $1599 was $1699 - 14" M3 Pro MacBook Pro (18GB/1TB/Silver): $1949 was $2039 - 14" M3 Max MacBook Pro (36GB/1TB/Silver): $2629 was $2719 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily.

Read more »

14″ M2 Max MacBook Pro now in stock at Apple, Certified Refurbished, for $630 off original MSRP
Apple has 2023 14" M2 Max MacBook Pros now available in their Certified Refurbished store for $630 off original MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest M2 Max MacBook Pros currently available for sale at Apple: - 14" M2 Max MacBook Pro (30-Core CPU, Space Gray): $2469 save $630 - 14" M2 Max MacBook Pro (30-Core CPU, Silver): $2469 save $630 See our 14" MacBook Pro Price Tracker for the latest prices & deals from Apple's retailers, updated daily.

Read more »