Tim Cook gifted Trump first 2019 Mac Pro off assembly line
Apple CEO Tim Cook gave former President Donald Trump the first 2019 Mac Pro to come off the production line at partner manufacturer Flex, according to a disclosure statement released on Wednesday.Trump toured the Flex plant in Austin, Texas, in late 2019 to prop up his administration's promise to boost American production might.While the visit to Flex, and Apple's new Austin campus, was well documented, Cook's Mac Pro gift was only today revealed in a financial disclosure report highlighted by The New York Times reporter David Enrich. Read more...

Read more »

Apple TV+ had only 3% market share in the US last quarter, N...
Although Apple has been investing in new movies and shows for its streaming service Apple TV+, the platform is still far from being considered a huge success. New research from JustWatch obtained by 9to5Mac revealed that Apple TV+ had only 3% of market share in the fourth quarter of 2020 in the US, ranking far behind competitors like Netflix, Disney+, and even Peacock. more… The post Apple TV+ had only 3% market share in the US last quarter, Netflix still in first place appeared first on 9to5Mac.

Read more »

Kia Will Lead Apple Car Project Work Under Hyundai Motor, Re...
Hyundai Motor, the parent automaker of Hyundai and Kia, will task the Kia division with Apple Car work. The brand also said on Wednesday it's looking at cooperation with foreign firms surrounding self-driving and electric vehicles. CNET reports: Kia made no mention of Apple, though the comment follows the reported connections to the tech giant. Earlier this month, various reports pegged the Apple Car as alive and well inside the tech company and said we could see a final vehicle in 2024 at the earliest. A separate report said the company may show a prototype of the vehicle next year. Interestingly, one of the reports last month also named Kia's factory in Georgia as the rumored home for Apple Car production, which coincides with news of Kia's possible involvement in the latest round of rumors. Reportedly, Apple is hard at work on breakthrough EV battery technology and automated driving systems to help usher in a game changing car. Choosing an established automaker to handle final production seems simple, since Apple has zero history of building cars. If you need an example of how difficult it is to build cars, take a look at Tesla's relatively short history in the business. Read more of this story at Slashdot.

Read more »

Apple, Google welcome Biden administration immigration refor...
The CEOs of Apple and Google in statements on Wednesday backed President Joe Biden's plans to reform U.S. immigration policy, a major component of which includes the extension of the Deferred Action for Childhood Arrivals program.Source: Evan Vucci for APShortly after being sworn in as the 46th president of the United States, Biden signed a pair of executive orders that extends the Obama-era DACA program and reverses President Donald Trump's travel and immigration bans on predominantly Muslim countries. Read more...

Read more »

Apple, Google welcome Biden administration immigration refor...
The CEOs of Apple and Google in statements on Wednesday backed President Joe Biden's plans to reform U.S. immigration policy, a major component of which includes the extension of the Deferred Action for Childhood Arrivals program.Source: Evan Vucci for APShortly after being sworn in as the 46th president of the United States, Biden signed a pair of executive orders that extends the Obama-era DACA program and reverses President Donald Trump's travel and immigration bans on predominantly Muslim countries. Read more...

Read more »

LG Display halts iPhone LCD production
LG Display has halted production of liquid crystal display (LCD) panels for iPhones. LG Display' factory that previously made the LCD panels… The post appeared first on MacDailyNews.

Read more »

Pegatron leases space in Chennai as part of Indian iPhone ma...
Apple supplier Pegatron has leased half a million square feet near Chennai, India as part of its plan to establish iPhone manufacturing operations in the region.Credit: PegatronPegatron plans to use the space, built in an industrial park near Chennai, for assembly and warehouse purposes, Financial Express reported on Wednesday. The company previously laid out plans to spend about $150 million in setting up iPhone manufacturing facilities in the Indian state of Tamil Nadu. Read more...

Read more »

Best apps for young kids to foster fun and creative learning
Just like adults, it can be easy for kiddos to get sucked into passively watching videos on iPad or TV. But what about more engaging digital experiences that encourage creative and fun learning? Follow along for a look at some of the best apps for young kids. more… The post appeared first on 9to5Mac.

Read more »

Sensor-shift optical image stabilization said to expand to e...
The entire iPhone 13 family will feature sensor-shift optical image stabilization (OIS). Currently, only the iPhone 12 Pro Max offers this… The post Sensor-shift optical image stabilization said to expand to entire ‘iPhone 13’ family appeared first on MacDailyNews.

Read more »

M1 Macs can now run full version of Linux thanks to new Core...
Since the new M1 Macs were announced, developers have been working to run different operating systems on the Apple Silicon platform, including Windows and Linux. Now, thanks to Corellium, it’s possible to run Ubuntu — a popular Linux distro — on new Macs with M1 chip. more… The post M1 Macs can now run full version of Linux thanks to new Corellium port appeared first on 9to5Mac.

Read more »

Google Still Doesn’t Have iOS 14 Privacy Labels
I’ve been hesitant to keep sharing these stories. At the time this news first appeared I was skeptical, saying that we just got over the holidays so give Google a break. But as the days turn into weeks, this is when it does start to look damning and now it’s time to give Google some heat. On January 5, Google told TechCrunch that the data would be added to its iOS apps "this week or the next week," but both this week and the next week have come and gone with no update. It has now been well over a month since Google last updated its apps.

Read more »

Poll: Will this year’s new iPhone be the ‘iPhone 12S’ ...
Rumors about what to expect from the 2021 iPhone have started to gather steam, and it’s looking increasingly like that it will be an “S” year. This comes after the iPhone 12 brought a major redesign among other changes, but we want to know what you think: What will this year’s iPhone update be called? more… The post Poll: Will this year’s new iPhone be the ‘iPhone 12S’ or ‘iPhone 13’? appeared first on 9to5Mac.

Read more »

Former Warner Bros. marketing honcho JP Richards joins Apple...
JP Richards has been appointed head of film marketing strategy at Apple TV+, reporting to Zack Van Amburg… The post Former Warner Bros. marketing honcho JP Richards joins Apple TV+ team appeared first on MacDailyNews.

Read more »

EU Fines Valve And Five Other PC Games Publishers
The European Union Commission issued fines totalling €7.8 million ($9.4 million) to Valve and five other games publishers on Wednesday, Techrunch reported. It followed a lengthy investigation that found that firm’s had broken the bloc’s rules. The geo-blocking practices investigated since before 2017 concerned around 100 PC video games of different genres, including sports, simulation and action games. In addition to Valve — which has been fined just over €1.6 million — the five sanctioned games publishers are: Bandai Namco (fined €340,000), Capcom (€396,000), Focus Home (€2.8 million), Koch Media (€977,000) and ZeniMax (€1.6 million). The Commission said the fines were reduced by between 10% and 15% owing to cooperation from the companies, with the exception of Valve, which it said chose not to cooperate (a “prohibition Decision” rather than a fine reduction was applied in its case).

Read more »

Linux Now “Completely Usable” on Apple Silcion M1 Macs
A version of Linux now works on Apple Silicon M1 chip, AppleInsider reported. Security researchers at Corellium ported the operating system, and plan to release it under an open-source license. The Linux version is a full Ubuntu desktop operating system booted from a USB, according to Corellium Chief Technology Officer Chris Wade. Although details are scarce, he said that Linux is now "completely usable" on Apple Silicon machines. Network compatibility is possible through a USB-C dongle, and the current update to the platform will support USB, I2C, and DART. The Ubuntu operating system is one initially meant for the ARM-based Raspberry Pi, Wade added.

Read more »

Tested: New elago MS2 Charging Dock brings HomePod mini vibe...
You’re reading Tested with 9to5Toys, where we explore everyday tech essentials that make life a bit easier. Browse through our entire guide for all of the latest reviews, and sound off in the comments below if there’s something you’d like to see featured. Earlier this week, elago introduced a new line of MagSafe-compatible accessories, including various charging docks, cases, and more. Alongside that announcement, elago is also bringing two more iPhone standalone docks to market with MagSafe functionality, too. Today, we’re taking a look at the elago MS2 Charging Stand for MagSafe, which has a familiar HomePod mini kind of design that won’t take up too much space on your nightstand. Head below for a quick look and a few hands-on thoughts. more… The post Tested: New elago MS2 Charging Dock brings HomePod mini vibes and MagSafe appeared first on 9to5Mac.

Read more »

Apple is driving Ultra Wideband adoption
Because of Apple's promotion of devices with ultra-wideband enabled, applications based on UWB technology have increased and have a broader… The post appeared first on MacDailyNews.

Read more »

President Biden on ‘Same Page’ With EU Over Big Tech Reg...
New U.S. President Joe Biden and the European Union are on the “same page” as regards to regulating Big Tech. That’s according to the Head of the EU Commission. President Biden “An Ally” on Big Tech Ursula Von Der Leyen told CNBC on Wednesday: If there’s hate out there, if there’s polarization, fake news, all of these are things that are threats to our democracies and I am sure that we will have an ally to work on that. She added that while “Europe is coming forward with these standards.. I am convinced that the United States will be attentively listening because Joe Biden has always been a politician who was cherishing the rules-based order.” Ms. Von Der Leyen, who leads the EU’s executive arm, backed “clear guidelines that the internet companies take responsibility for the content they distribute.” She has also told Brussels lawmakers that while it “may have been” right for Twitter to remove Donald Trump’s access to the service during his final days in the White House, “such serious interventions in freedom of expression should be made on the basis of laws and not according to the rules of the game of companies, based on the decision of politicians and parliaments and not the managers of Silicon Valley.”

Read more »

‘Agenda’ date-focused notes app gains support for tables...
Agenda for iPhone, iPad, and Mac is a date-focused notes/productivity app and it has received some new features today in the latest update. Headlining the changes is support for tables, inline styles, and horizontal rules. more… The post ‘Agenda’ date-focused notes app gains support for tables and more on iOS and Mac appeared first on 9to5Mac.

Read more »

iPhone 12 Pro Production Increasing, Mini Production Being ...
iPhone 12 Pro lead times decreased to 10 days from 22 days around two weeks ago, according to analysts, although this is still longer than any other model launched over the course of the last four years. Apple is reportedly ramping up production of the device. Two Million Extra iPhone 12 Pros Being Built Overall, Apple will increase iPhone 12 Pro builds in the March quarter by two million, according to a note by Morgan Stanley analyst Katy Hubert, obtained by Ped30. This is being offset by a build reduction of two million for the mini. The analyst wrote: In China, we believe lower end iPhone 12 models are performing better than in the US, and we estimate iPhone shipments grew ~47% Y/Y in the December quarter. She also noticed positive developments in Tawain: Results from Apple’s Taiwan supply chain points to a 3rd consecutive month of accelerating Y/Y revenue growth (to +20% Y/Y) and a third consecutive month of stronger than seasonal growth, suggesting solid momentum as we head into the March quarter. This is not the first indication iPhon 12 mini sales may be lagging behind the rest of the lineup. Previous research suggested that the device only accounted around four or five percent of sales from major carriers.

Read more »

AirPods in 2021: What to expect from the rumored AirPods 3 a...
Following the introduction of AirPods Max in December, Apple reportedly has updates on the way for the rest of its AirPods lineup in 2021. This year, we expect Apple to introduce a new version of its incredibly popular AirPods and AirPods Pro, bringing major changes to both of them. Here’s everything we know so far. more… The post AirPods in 2021: What to expect from the rumored AirPods 3 and AirPods Pro 2 updates appeared first on 9to5Mac.

Read more »

Apple Watch Tip Bonanza! – TMO Daily Observations 2021-01-...
Charlotte Henry and Bryan Chaffin join host Kelly Guimont to discuss their Apple Watches, and tips and tricks they have picked up and want to share.

Read more »

Apple stock makes bullish move ahead of earnings
The Nasdaq and S&P 500 gapped up to new highs. The Dow Jones Industrial Average lagged a bit despite a bullish move upward for Apple stock … The post appeared first on MacDailyNews.

Read more »

Top 8 Apple deals to snap up now ahead of Valentine's D...
With Valentine's Day fast approaching, picking up a fantastic gift and securing a great deal can go hand in hand. These Apple discounts offer savings of up to $350 off, with hidden and exclusive promotions on everything from AirPods and iPads, to new MacBook Pros and the M1 Mac mini.1. AirPods as low as $128.98Apple AirPods are a hot gift idea leading up to Valentine's Day and resellers, including Amazon and Adorama, are offering cash discounts of up to $50 off. Units are in stock and ready to ship at press time, with optional AppleCare+ also available for purchase. Read more...

Read more »

Apple Joint Venture Program Ends on February 22
Apple’s Joint Venture support program for businesses is ending on February 22, but an AppleCare program will be able to replace it. (via 9To5Mac). Apple Joint Venture Joint Venture launched in 2011 as a device support program for small and midsized businesses. Apple would provide IT teams with priority support, training for Apple products and services, and setup assistance for Apple devices. It cost US$499/year and US$99 for each additional device. Apple notified Joint Venture customers of the change in an email: The Joint Venture Program will be ending on 22/2/21 11:59 pm PST. You’ll continue to have full access to Joint Venture until the program wraps up, and you’ll be receiving a refund for any remaining portion of your membership. We’ve also recently added a great business support option, AppleCare Help Desk Support, which features some of the most requested features of Joint Venture, such as priority phone access to our experienced senior technical support staff, 12 hours a day, 7 days a week. To learn more about AppleCare Help Desk Support, call your Apple Business Team to get started. Businesses can sign up for AppleCare Help Desk Support that offers unlimited support for Apple hardware and software. It too costs US$499/year.

Read more »

The Story of the 30-Year-Old PDF Format
The Portable Document Format (PDF) has been around for thirty years. But how did it become so ubiquitous? Rob Walker shares the interesting story. The PDF keeps spreading not because Adobe or any company forces others to use it, but because of “millions of people all over the world,” Parmenter says, “just doing their thing.”

Read more »

LG Display Stops LCD Production for iPhone
LG Display has stopped producing LCD panels for iPhones, TheElec reported. The work was particularly profitable for the company. LG Display Not Making iPhone LCD Panels Anymore The entire iPhone 12 lineup has OLED displays. While the second-generation iPhone SE does still have an LCD display, ot will use panels from JDI and Sharp instead. Meanwhile, the factor that made the LG Display's LCD panels will make display panels for automobiles instead. Furthermore, The Korea Herald reported that LG Electronics might exit the smarphone market entirely, having lost US$4.5 billion over the last five years. “Since the competition in the global market for mobile devices is getting fiercer, it is about time for LG to make a cold judgment and the best choice,” an LG official commented. “The company is considering all possible measures, including sale, withdrawal and downsizing of the smartphone business.”

Read more »

Rebranded Paramount+ streaming service launches on March 4
The upcoming Paramount+ streaming service, a rebranding of CBS All Access with an expansion of available content, is set to officially launch on March 4, 2021.Credit: ViacomCBSParamount+ will go live in the U.S. and Latin America on March 4, ViacomCBS said Wednesday. The company said a more detailed overview of the streaming plans will be revealed at its fourth quarter earnings call on Feb. 24. Read more...

Read more »

ViacomCBS Replaces CBS All Access With Paramount+
CBS All Access is going away and a new service will take its place. ViacomCBS announced the launch of Paramount+ (via ArsTechnica). Paramount+ The new service will offer content from the CBS TV Network, MTV, BET, Comedy Central, VH1, Nickelodeon, and movies from Paramount Pictures. So far, planned original content includes a series based on “The Godfather” and a return of “Behind the Music” from VH1. Paramount+ will launch on March 4 in the U.S. and Latin America, and March 25 for Nordic countries. It expands to Australia mid-2021 and Canada late-2021.

Read more »

New Charges Derail COVID Release for Hacker Who Aided ISIS
A hacker serving a 20-year sentence for stealing personal data on 1,300 U.S. military and government employees and giving it to an Islamic State hacker group in 2015 has been charged once again with fraud and identity theft. The new charges have derailed plans to deport him under compassionate release because of the COVID-19 pandemic.

Read more »

Joker’s Stash Carding Market to Call it Quits
Joker's Stash, by some accounts the largest underground shop for selling stolen credit card and identity data, says it's closing up shop effective mid-February 2021. The announcement came on the heels of a turbulent year for the major cybercrime store, and just weeks after U.S. and European authorities seized a number of its servers.

Read more »

How iTunes Changed Apple – Intego Mac Podcast Episode 170
iTunes is 20 years old. Even if, on the Mac, that name has been eclipsed, the iTunes brand still exists, and iTunes is one of the reasons that Apple is such a strong services company. We also look at some new AppleScript malware, how some millionaires are losing Bitcoin because they forgot their passwords, and […] The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, January 2021 Edition
Microsoft today released updates to plug more than 80 security holes in its Windows operating systems and other software, including one that is actively being exploited and another which was disclosed prior to today. Ten of the flaws earned Microsoft's most-dire "critical" rating, meaning they could be exploited by malware or miscreants to seize remote control over unpatched systems with little or no interaction from Windows users.

Read more »

SolarWinds: What Hit Us Could Hit Others
New research into the malware that set the stage for the megabreach at IT vendor SolarWinds shows the perpetrators spent months inside the company's software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the research suggests the insidious methods used by the intruders to subvert the company's software development pipeline could be repurposed against many other major software providers.

Read more »

Ubiquiti: Change Your Password, Enable 2FA
Ubiquiti, a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud provider may have exposed customer account information and credentials used to remotely manage Ubiquiti gear.

Read more »

Vulnerability Summary for the Week of January 4, 2021
Original release date: January 11, 2021 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1234n -- minicms Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter. 2021-01-05 7.5 CVE-2020-36052 MISC asciitable.js_project -- asciitable.js The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. 2021-01-04 7.5 CVE-2020-7771 MISC MISC asus -- dsl-n17u_firmware The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to Advanced_System_Content.asp with the uiViewTools_username=admin&uiViewTools_Password= and uiViewTools_PasswordConfirm= substrings. 2021-01-04 10 CVE-2020-35219 MISC MISC chatter-social -- creeper Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean. 2021-01-04 7.5 CVE-2020-26292 CONFIRM clickhouse-driver_project -- clickhouse-driver clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow. 2021-01-06 7.5 CVE-2020-26759 MISC MISC cse_bookstore_project -- cse_bookstore CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database on which the web application is running. 2021-01-04 7.5 CVE-2020-36112 MISC dell -- emc_isilon_onefs Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges. 2021-01-05 7.2 CVE-2020-26181 MISC djv_project -- djv This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine. 2021-01-04 10 CVE-2020-28464 MISC MISC MISC drivergenius -- drivergenius_firmware MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \.MyDrivers0_0_1. 2021-01-03 7.1 CVE-2020-28841 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. 2021-01-06 7.5 CVE-2020-36185 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. 2021-01-06 7.5 CVE-2020-36181 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36182 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. 2021-01-07 7.5 CVE-2020-36183 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. 2021-01-06 7.5 CVE-2020-36184 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36179 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. 2021-01-06 7.5 CVE-2020-36186 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. 2021-01-06 7.5 CVE-2020-36187 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. 2021-01-06 7.5 CVE-2020-36188 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. 2021-01-06 7.5 CVE-2020-36189 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36180 MISC MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. The Mali GPU driver allows out-of-bounds access and a device reset. The Samsung ID is SVE-2020-19174 (January 2021). 2021-01-05 7.1 CVE-2021-22495 MISC ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges. IBM X-Force ID: 172452. 2021-01-05 9 CVE-2019-4728 XF CONFIRM ipeak -- ipeakcms ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page. 2021-01-05 7.5 CVE-2021-3018 MISC MISC MISC MISC MISC ispconfig -- ispconfig ISPConfig before 3.2.2 allows SQL injection. 2021-01-05 7.5 CVE-2021-3021 MISC MISC linux -- linux_kernel mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332. 2021-01-05 8.3 CVE-2020-36158 MISC MISC MISC MISC proofpoint -- inside_threat_management rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arbitrary code as SYSTEM because of improper deserialization over named pipes. 2021-01-06 9 CVE-2020-8884 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10658 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10656 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10655 MISC CONFIRM redlion -- crimson A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the device running Crimson 3.1 (Build versions prior to 3119.001). 2021-01-06 7.8 CVE-2020-27279 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20004 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20001 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20002 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20005 MISC thecodingmachine -- gotenberg A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution. 2021-01-07 7.5 CVE-2020-13450 MISC MISC thecodingmachine -- gotenberg An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. 2021-01-07 7.5 CVE-2020-13451 MISC MISC thecodingmachine -- gotenberg In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution. 2021-01-07 7.5 CVE-2020-13452 MISC MISC thedaylightstudio -- fuel_cms FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 2021-01-05 7.5 CVE-2020-26045 MISC MISC MISC uclouvain -- openjpeg A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. 2021-01-05 7.1 CVE-2020-27843 MISC uclouvain -- openjpeg A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 2021-01-05 8.3 CVE-2020-27844 MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access. 2021-01-04 7.5 CVE-2020-36155 MISC MISC MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges. 2021-01-04 7.5 CVE-2020-36157 MISC MISC MISC win911 -- mobile-911_server An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite the service executable and execute arbitrary code with System privileges or replace other files within the installation folder that could lead to local privilege escalation. 2021-01-05 7.2 CVE-2020-13541 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1234n -- minicms Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter. 2021-01-05 5 CVE-2020-36051 MISC advancedcustomfields -- advanced_custom_fields The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. 2021-01-06 4.3 CVE-2020-36172 MISC apache -- flink Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master. 2021-01-05 5 CVE-2020-17518 MLIST MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST MLIST apache -- flink A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master. 2021-01-05 5 CVE-2020-17519 MISC MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST broadcom -- ca_service_catalog CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition. 2021-01-05 5 CVE-2020-29478 CONFIRM dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29502 MISC dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29501 MISC dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29500 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. 2021-01-04 5.8 CVE-2020-29498 MISC dell -- wyse_thinos Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station. 2021-01-04 6.4 CVE-2020-29492 MISC dell -- wyse_thinos Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients. 2021-01-04 5 CVE-2020-29491 MISC digisol -- dg-hr3400_firmware Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter. 2021-01-06 4.3 CVE-2020-35262 MISC MISC MISC dovecot -- dovecot An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). 2021-01-04 6.5 CVE-2020-24386 MISC FULLDISC CONFIRM MISC CONFIRM MISC GENTOO DEBIAN dovecot -- dovecot Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. 2021-01-04 5 CVE-2020-25275 MISC FULLDISC CONFIRM CONFIRM MISC GENTOO DEBIAN expresstech -- quiz_and_survey_master An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files). 2021-01-01 6.4 CVE-2020-35951 MISC MISC ffmpeg -- ffmpeg decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations. 2021-01-04 5 CVE-2020-35965 MISC MISC MISC ffmpeg -- ffmpeg track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. 2021-01-03 4.3 CVE-2020-35964 MISC MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20313 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. 2021-01-07 6.8 CVE-2018-20312 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20315 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20314 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. 2021-01-07 6.8 CVE-2018-20316 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20311 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20309 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20310 MISC gigamon -- gigavue-os GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. 2021-01-05 4 CVE-2020-23249 MISC gjson_project -- gjson GJSON out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35493 MISC FEDORA gnu -- binutils There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35495 MISC FEDORA gnu -- binutils There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35507 MISC gnu -- glibc The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. 2021-01-04 5 CVE-2019-25013 MISC MISC golang -- go In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) 2021-01-02 5 CVE-2020-28851 MISC golang -- go In x/text in Go 1.15.4, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) 2021-01-02 5 CVE-2020-28852 MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The quram library allows attackers to execute arbitrary code or cause a denial of service (memory corruption) during dng decoding. The Samsung ID is SVE-2020-18811 (January 2021). 2021-01-05 6.8 CVE-2021-22493 MISC google -- android An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. When a screen protector is used, the required image compensation is not present. Consequently, inversion can occur during fingerprint enrollment, and a high False Recognition Rate (FRR) can occur. The Samsung ID is SVE-2020-19216 (January 2021). 2021-01-05 4.3 CVE-2021-22494 MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) software. The Bluetooth UART driver has a buffer overflow. The Samsung ID is SVE-2020-18731 (January 2021). 2021-01-05 5.8 CVE-2021-22492 MISC hp -- integrated_lights-out_4 A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information. 2021-01-05 5 CVE-2020-7202 MISC htmlsanitizer_project -- htmlsanitizer HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `` tag so there is no risk if you have not explicitly allowed the `` tag. The problem has been fixed in version 5.0.372. 2021-01-04 4.3 CVE-2020-26293 MISC MISC CONFIRM MISC ibm -- api_connect IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive information across the network. IBM X-Force ID: 190990. 2021-01-05 6.4 CVE-2020-4899 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391. 2021-01-04 6.8 CVE-2020-4917 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705. 2021-01-04 4.6 CVE-2020-4928 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287. 2021-01-04 6.5 CVE-2020-4912 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395. 2021-01-04 5.5 CVE-2020-4919 XF CONFIRM ibm -- curam_social_program_management IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942. 2021-01-04 6.8 CVE-2020-4942 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984. 2021-01-07 4.3 CVE-2020-4893 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989. 2021-01-07 5 CVE-2020-4898 XF CONFIRM ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896. 2021-01-05 6.5 CVE-2020-4762 XF CONFIRM ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895. 2021-01-05 5 CVE-2020-4761 XF CONFIRM invisioncommunity -- ips_community_suite Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. 2021-01-05 4.3 CVE-2021-3026 MISC kamadak-exif_project -- kamadak-exif kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected. 2021-01-06 4.3 CVE-2021-21235 MISC MISC CONFIRM lanproxy_project -- lanproxy ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet. 2021-01-05 5 CVE-2021-3019 MISC MISC limit_login_attempts_project -- limit_login_attempts The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts. 2021-01-06 5 CVE-2012-10001 MISC loopring -- loopring The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation. 2021-01-03 5 CVE-2020-35962 MISC MISC mcafee -- network_security_management Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request. 2021-01-05 4.3 CVE-2020-7336 CONFIRM mikrotik -- routeros In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. 2021-01-04 4.3 CVE-2021-3014 MISC MISC mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI. 2021-01-03 4 CVE-2021-3005 MISC MISC mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI. 2021-01-04 6.8 CVE-2021-21495 MISC MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. 2021-01-06 5 CVE-2020-36175 MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. 2021-01-06 5 CVE-2020-36173 MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. 2021-01-06 4.3 CVE-2020-36174 MISC nxlog -- nxlog The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.) 2021-01-05 4.3 CVE-2020-35488 MISC orangehrm -- orangehrm SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint. 2021-01-05 5.5 CVE-2020-29437 MISC MISC CONFIRM MISC pagelayer -- pagelayer An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur. 2021-01-01 6.5 CVE-2020-35947 MISC MISC pagelayer -- pagelayer An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS. 2021-01-01 6.8 CVE-2020-35944 MISC MISC proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker (with admin or config-admin privileges in the console) to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 6.5 CVE-2020-10657 MISC CONFIRM redlion -- crimson An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations. 2021-01-06 5 CVE-2020-27283 MISC redlion -- crimson The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. 2021-01-06 6.4 CVE-2020-27285 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20008 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20003 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20006 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20007 MISC seal_finance_project -- seal_finance The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021. 2021-01-03 5 CVE-2021-3006 MISC MISC seopanel -- seo_panel Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. 2021-01-01 4.3 CVE-2021-3002 MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. 2021-01-06 4.9 CVE-2019-16954 MISC MISC MISC stableyieldcredit_project -- stableyieldcredit The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should. 2021-01-03 5 CVE-2021-3004 MISC MISC thecodingmachine -- gotenberg A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files. 2021-01-07 5 CVE-2020-13449 MISC MISC thedaylightstudio -- fuel_cms FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors. 2021-01-05 4.3 CVE-2020-26046 MISC MISC treasuredata -- fluent_bit flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. 2021-01-03 6.8 CVE-2020-35963 MISC MISC MISC uclouvain -- openjpeg There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27845 MISC uclouvain -- openjpeg There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27842 MISC uclouvain -- openjpeg There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27841 MISC ultimatemember -- ultimate_member The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. 2021-01-06 5 CVE-2020-36170 MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges. 2021-01-04 6.5 CVE-2020-36156 MISC MISC MISC veno_file_manager_project -- veno_file_manager Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server. 2021-01-04 5 CVE-2020-22550 MISC MISC veritas -- desktop_and_laptop_option Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did not require authentication. 2021-01-05 5 CVE-2020-36159 MISC vikisolutions -- vera An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in. 2021-01-05 5.5 CVE-2019-20484 MISC webform_report_project -- webform_report The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2019-25012 MISC win911 -- win-911 An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911 Mobile Runtime” service. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the privileges when executed. 2021-01-05 4.6 CVE-2020-13539 MISC MISC win911 -- win-911 An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the privileges when executed. 2021-01-05 4.6 CVE-2020-13540 MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info beetel -- 777vr1_firmware Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter. 2021-01-06 3.5 CVE-2020-25498 MISC MISC MISC MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user. 2021-01-05 2.1 CVE-2020-26199 MISC dell -- unisphere Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions. 2021-01-05 3.5 CVE-2020-35170 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 2021-01-04 3.5 CVE-2020-29496 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code under the device tag. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 2021-01-04 3.5 CVE-2020-29497 MISC electronjs -- zonote zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true). 2021-01-01 3.5 CVE-2020-35717 MISC MISC MISC MISC gigamon -- gigavue-os GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. 2021-01-05 2.1 CVE-2020-23250 MISC google -- android An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-200028 (January 2021). 2021-01-05 2.1 CVE-2021-3022 MISC ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274. 2021-01-04 3.5 CVE-2020-4910 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273. 2021-01-04 3.5 CVE-2020-4909 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288. 2021-01-04 2.1 CVE-2020-4913 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392. 2021-01-04 2.1 CVE-2020-4918 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191390. 2021-01-04 3.5 CVE-2020-4916 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986. 2021-01-07 3.5 CVE-2020-4895 XF CONFIRM mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly. 2021-01-04 3.5 CVE-2021-21494 MISC MISC semperplugins -- all_in_one_seo_pack An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS. 2021-01-01 3.5 CVE-2020-35946 MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. 2021-01-04 3.5 CVE-2019-16960 MISC MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. 2021-01-04 3.5 CVE-2019-16956 MISC MISC MISC tenda -- f3_firmware Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior. 2021-01-01 3.3 CVE-2020-35391 MISC vikisolutions -- vera An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application. 2021-01-05 3.5 CVE-2019-20483 MISC zohocorp -- manageengine_desktop_central Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. 2021-01-06 3.5 CVE-2019-16962 MISC MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info actionpack_gem_for_ruby_on_rails -- actionpack_gem_for_ruby_on_rails In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. 2021-01-06 not yet calculated CVE-2020-8264 MISC MISC advanced_webhost_billing_system -- advanced_webhost_billing_system   Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page. 2021-01-08 not yet calculated CVE-2020-25950 MISC asp.net -- cute_editor   Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. 2021-01-07 not yet calculated CVE-2020-24903 MISC barco -- multiple_products   Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result in unauthenticated remote code execution in the username and password fields of the logon prompt. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. 2021-01-07 not yet calculated CVE-2020-17500 MISC CONFIRM MISC barco -- transform_n   Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules, ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17502 MISC CONFIRM MISC barco -- transform_n   The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "locking" is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17503 MISC CONFIRM MISC barco -- transform_n   The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17504 MISC CONFIRM MISC bssi -- web-sesame   A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension (code review). Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contain sources used to generate the bundle, configuration settings (e.g., API keys), and developers' comments. 2021-01-06 not yet calculated CVE-2020-29041 MISC MISC buns -- buns   This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule). 2021-01-08 not yet calculated CVE-2020-7794 MISC cairosvg -- cairosvg   CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information. 2021-01-06 not yet calculated CVE-2021-21236 MISC MISC CONFIRM MISC ceph -- ceph A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible. 2021-01-08 not yet calculated CVE-2020-25678 MISC MISC cisco -- jabber   Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. 2021-01-07 not yet calculated CVE-2020-26085 CISCO citrix -- secure_mail Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. 2021-01-06 not yet calculated CVE-2020-8275 MISC citrix -- secure_mail   Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. 2021-01-06 not yet calculated CVE-2020-8274 MISC cockpit -- cockpit   Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. 2021-01-08 not yet calculated CVE-2020-35131 MISC MISC MISC d-link -- dsl-2888a_devices   An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI. 2021-01-08 not yet calculated CVE-2020-24577 MISC CONFIRM MISC dell -- client_and_commerical_consumer_platforms   Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication. 2021-01-04 not yet calculated CVE-2020-5361 MISC dell -- inspiron_5675_bios   Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM). 2021-01-08 not yet calculated CVE-2020-26186 MISC dell -- multiple_products   Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system file. A local authenticated attacker with access to the system files may use the exposed password to gain access with the privileges of the compromised user. 2021-01-05 not yet calculated CVE-2020-29489 MISC dell -- multiple_products   Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service (Storage Processor Panic) by sending specially crafted UDP requests. 2021-01-05 not yet calculated CVE-2020-29490 MISC drupal -- aes_encryption   The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from decrypting data, aka SA-CONTRIB-2017-027. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 not yet calculated CVE-2017-20001 MISC drupal -- kcfinder_integration   uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 not yet calculated CVE-2018-25002 MISC MISC MISC eaton -- easysoft   Eaton's easySoft software v7.20 and prior are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion. 2021-01-07 not yet calculated CVE-2020-6656 MISC MISC MISC MISC eaton -- easysoft   The Eaton's easySoft software v7.20 and prior are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application. 2021-01-07 not yet calculated CVE-2020-6655 MISC MISC evolucare -- ecsimaging   ** UNSUPPORTED WHEN ASSIGNED ** EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2021-01-07 not yet calculated CVE-2021-3029 MISC MISC formstone -- formstone   Formstone

Read more »

iTunes at 20: How One App Changed Apple’s Course
It's been 20 years since iTunes was released. This app was the cornerstone of Apple's development. The post appeared first on The Mac Security Blog.

Read more »

Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the U.S. Courts.

Read more »

All Aboard the Pequod!
Like countless others, I frittered away the better part of Jan. 6 doomscrolling and watching television coverage of the horrifying events unfolding in our nation's capital, where a mob of President Trump supporters and QAnon conspiracy theorists was incited to lay siege to the U.S. Capitol. For those trying to draw meaning from the experience, might I suggest consulting the literary classic Moby Dick, which simultaneously holds clues about QAnon's origins and offers an apt allegory about a modern-day Captain Ahab and his ill-fated obsessions.

Read more »

How to Uninstall Flash Player
Flash Player is dead. It's time to uninstall it from your Mac. Here's how to do this. The post appeared first on The Mac Security Blog.

Read more »

Boost Mobile continues to offer no contract Apple iPhone SE ...
Boost Mobile is offering 2020 Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249.99. 128GB models are offered at a $50 discount: $399.99. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is the cheapest no-contract 2020 iPhone we’ve seen available anywhere. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

B&H launches Apple iMac sale with 21″ and 27″ models...
B&H Photo has Apple 21″ and 27″ iMacs on sale today for up to $150 off MSRP with prices starting at $1049. Shipping is free. These are the same iMacs sold by Apple in their retail and online stores. B&H’s prices are among the lowest available for these models from any Apple reseller; – 21″ 2.3GHz 2-Core iMac: $1049 $50 off MSRP – 21″ 3.6GHz 4-Core 4K iMac: $1249 $50 off MSRP – 21″ 3.0GHz 6-Core 4K iMac: $1349 $150 off MSRP – 27″ 3.1GHz 6-core iMac: $1699 $100 off MSRP – 27″ 3.3GHz 6-core iMac: $1879 $120 off MSRP – 27″ 3.8GHz 8-core iMac: $2299 $0 off MSRP For the latest prices and sales, see our iMac Price Tracker, → Read More...

Read more »

Select 11″ WiFi iPad Pros on sale today for $50 off Apple�...
B&H Photo has select 2020 Apple 11″ WiFi iPad Pros on sale today for $50 off Apple’s MSRP, each including free expedited shipping to most addresses in the US: – 11″ 256GB WiFi iPad Pro: $849 $50 off – 11″ 512GB WiFi iPad Pro: $1049 $50 off – 11″ 1TB WiFi iPad Pro: $1249 $50 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Clearance 8-core iMac Pro available again for $3819 at Apple...
Apple has Certified Refurbished, clearance, 27″ 3.2GHz 8-Core iMac Pros available $3819 including free shipping. Their price is $1180 off the original MSRP of new models. A standard Apple one-year warranty is included. Apple’s refurbished price is the cheapest currently available for an iMac Pro from any reseller. For the latest prices and sales, see our iMac Pro Price Tracker, → Read More...

Read more »

B&H launches 16″ MacBook Pro sale with models availabl...
B&H has Apple’s 16″ MacBook Pros on sale for $200-$250 off Apple’s MSRP with prices starting at $2199. Expedited shipping is free to many addresses in the US. Their prices are among the lowest available for new 16″ MacBook Pros from Apple resellers: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2549 $250 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2599 $200 off MSRP These are all the same MacBook Pros sold by Apple in their retail and online stores. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

B&H launches 16″ MacBook Pro sale with models availabl...
B&H has Apple’s 16″ MacBook Pros on sale for $200-$250 off Apple’s MSRP with prices starting at $2199. Expedited shipping is free to many addresses in the US. Their prices are among the lowest available for new 16″ MacBook Pros from Apple resellers: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2549 $250 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2599 $200 off MSRP These are all the same MacBook Pros sold by Apple in their retail and online stores. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

At only $809, these are the cheapest MacBooks for sale today...
Apple has restocked at full line of Certified Refurbished 2020 13″ Intel-based MacBook Airs available starting at only $809 and up to $280 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Silver: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Gold: $809 $190 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Space Gray: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Silver: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Gold: $1019 $280 off MSRP Check Apple’s site for the latest stock status, and note that Apple may sell out at any time. The dual-core models are the cheapest MacBooks you can purchase today at Apple. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Find the best price on an Apple iPhone MagSafe Charger using...
Looking for an Apple MagSafe Charger for your new iPhone 12, or perhaps an Apple MagSafe Duo Charger for your new iPhone and Apple Watch? Check out our new MagSafe Charger Price Tracker. We scan the lowest prices on Apple’s new iPhone chargers from at least 13 major Apple retailers on a daily basis, and we’ll be adding more products and resellers to the tracker as these new products become available. Current sale prices include the MagSafe Charger for $35.99 ($4 off MSRP) at Abt Electronics, Amazon, and Walmart’s → Read More...

Read more »

Save $67 on 13″ M1 MacBook Pros at Expercom, plus take $40...
Apple reseller Expercom has 2020 13″ M1 MacBook Pros on sale for $67 off Apple’s MSRP with prices starting at $1232. In addition to their MacBook Pro sale prices, take $40 off AppleCare+ when purchased along with the MacBook Pro ($229, regularly $269): – 2020 13″ MacBook Pro M1 CPU/256GB SSD: $1232.65 $67 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD: $1432.65 $67 off MSRP Discounts are also available on various build-to-order options. Note that some configurations might require 3-5 days for shipping. For the latest prices & sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Back in stock! 16″ MacBook Pros starting at only $2039 at ...
After a long absence, Apple has restocked a full line of Certified Refurbished 16″ MacBook Pros for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Saturday Steal! Clearance 2020 Mac mini for only $549!
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $549 this weekend, $250 off Apple’s original MSRP. These are new, unopened, factory-sealed models: – 3.6GHz 4-core Mac mini: $549 $250 off original MSRP This is the cheapest new 2020 Apple Mac for sale anywhere right now. Available while supplies last! For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Save up to $112 on 13″ Intel-based MacBook Pros at Experco...
Apple reseller Expercom has 2020 13″ 2.0GHz Intel-based MacBook Pros on sale for $100-$112 off Apple’s MSRP with prices starting at $1699. In addition to their MacBook Pro sale prices, take $70 off AppleCare+ when purchased along with the MacBook Pro ($199, regularly $269): – 2020 13″ MacBook Pros 2.0GHz Intel CPU/512GB SSD: $1699 $100 off MSRP – 2020 13″ MacBook Pros 2.0GHz Intel CPU/1TB SSD: $1888.80 $112 off MSRP Discounts are also available on various build-to-order options. Note that some configurations might require a week or so for shipping. For the latest prices & sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »