Join the PowerPage staff at 9 PM EST tonight for an Apple OG Club chat
It’s somewhat short notice, but the PowerPage staff will be holding an Apple OG Club chat tonight at 9 PM EST via the Clubhouse app. Just use the link below to bypass the need for an invitation, sign in, chat live, and geek out! Via Clubhouse Source

Read more »

Physical’s endless cliches won’t get your blood pumping [Apple TV+ review]
Apple TV+ went fishing for its own Glow but instead landed the transparent, overcooked and overdetermined Physical, which debuts today. Star Rose Byrne tries as hard as she can to enliven this mishmash of cliches. However, its grotesque, fetishistic anti-nostalgia goes nowhere fast. This post contains affiliate links. Cult of Mac may earn a commission when you […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Sketchy rumor claims Samsung courting former Apple engineers for custom chip project
A sketchy rumor that's making the rounds online suggests that Samsung is attempting to hire former Apple and AMD engineers for a custom chip architecture project.Credit: AppleThe rumor, which appeared on South Korean-language forum Clien.net, claims that Samsung is in talks with former architecture engineers from Apple and AMD. The end goal, the forum posts claim, is a custom architecture of Samsung's own. Read more...

Read more »

Have You Subscribed To The Mac Geek Gab Podcast Yet?
In this clip, John and I explain a little more about Mac Geek Gab, why we got started, and why your support means so much to us! Want to keep learning with us? Make sure you Subscribe!

Read more »

‘Boring’ iOS 15 shows just how far iPhone has come
iOS 15 is kind of boring. It brings some welcome new features, but nothing that will change the way you use your iPhone forever. Some people might find the lack of earth-shaking new features dull. But the bottom line is, when it comes to something as integral to our daily lives as the way you […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Last Chance for the All-Star Mac Bundle Featuring Parallels Pro
The All-Star Mac Bundle is drawing to a close. This is a collection of five Mac apps for contact Management, cyber security and VPN, PDF navigation, productivity, and it features Parallels Pro. The whole bundle is $49.99, but coupon code ALLSTARMAC at checkout brings it down to $25!

Read more »

Goldman Sachs’ Rod Hall claims China iPhone 12 cycle was 12% weaker than iPhone X
Bucking talk of a super cycle, Goldman Sachs analyst Rod Hall claims that current iPhone shipments in China are 12% lower than the iPhone X… The post appeared first on MacDailyNews.

Read more »

YouTube relents, allows picture-in-picture video on iPhone
YouTube will reportedly soon allow all iPhone users to watch video from its application in a small window while another app is open. This feature has come and gone several times since Picture in Picture support debuted in iOS 14. Now it’s apparently coming back to stay. YouTube told MacRumors, “Picture-in-Picture (PiP) allows users to […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

AirPods vs AirPods Pro buying guide: Which should you buy in 2021?
AirPods and AirPods Pro have proven to be incredibly popular truly wireless headphone options from Apple. With three different variations to choose from, making a buying decision could be tricky. Read on as we compare the AirPods vs AirPods Pro, plus some tips on the best accessories to complement your purchase. more… The post appeared first on 9to5Mac.

Read more »

9to5Mac Happy Hour 334: Spatial Audio, Beats Studio Buds, and Apple hardware rumors
This week 9to5Mac’s Benjamin and Zac discuss the awaited release of Apple Podcasts, Spatial Audio in Apple Music, the new Beats Studio Buds, and upcoming new Apple devices. Sponsored by WALTR PRO for Mac: Make it easy to transfer virtually any file (in any format) to your iPhone, iPad, iPod and now, HomePod. Get 30% off now. Sponsored by BetterHelp: As a listener, you’ll get 10% off your first month by visiting our sponsor at BetterHelp.com/MacHappyHour. Sponsored by Mint Mobile: To get your new wireless plan for just $15 a month and get the plan shipped to your door for FREE go to MintMobile.com/HappyHour. more… The post appeared first on 9to5Mac.

Read more »

The Best Mac Site-Specific Browser for Google Docs
If you’re a Mac user who wants to turn Google Docs into a standalone app using a site-specific browser, you have at least seven choices. However, as Adam Engst discovered, there’s a great deal of variability in the site-specific browser world, and a number of the options work poorly with Google Docs in particular.

Read more »

Smartwatch and phone data led husband to confess to murdering his wife Caroline Crouch
A 33-year-old Greek pilot has confessed to the killing of his young British wife, Caroline Crouch, police say, in a crime that shocked… The post appeared first on MacDailyNews.

Read more »

What’s New With AirPods!
Check everything new coming to AirPods covered in Mac Geek Gab 875 from Apple's WWDC21 Event!  

Read more »

All US iOS YouTube users will get picture-in-picture support soon
YouTube says it is rolling out support for iOS 14 picture-in-picture mode to Premium members, with a launch to all U.S. iOS users planned for the future.Credit: Google"Picture-in-Picture (PiP) allows users to watch YouTube videos in a small mini player while simultaneously browsing outside of the YouTube app on their mobile device," YouTube said in a statement. "We're starting to roll out PiP for YouTube Premium members on iOS and plan to launch PiP for all US iOS users as well." Read more...

Read more »

Future Drones Could Hunt You By Your Screams
Researchers at Germany’s Fraunhofer FKIE institute are building first responder drones that could track people by their screams. While it’s easy to imagine human-seeking drones in a sci-fi horror movie, Varela says the gadget would be ideal for post-disaster scenarios, such as earthquakes, hurricanes and wildfires. They could hover over an area that rescue crews have difficulty getting to and pinpoint where people may be trapped.

Read more »

Leaker claims new redesigned MacBook Pro will be launched in Q4 along with M1X Mac mini
Rumors about new redesigned MacBook Pros have been circulating on the internet for some time now, but there has been some uncertainty about when Apple will introduce these new machines. According to Dylandkt, who has correctly predicted details about unreleased products in the past, Apple will launch new versions of the MacBook Pro in Q4 2021, along with an updated Mac mini. more… The post appeared first on 9to5Mac.

Read more »

Ben Thompson Examines US Big Tech Legislation
Confused by what’s involved with the recent bills proposed by lawmakers in the US House of Representatives aimed at curbing the power of Big Tech? Ben Thompson of Stratechery breaks down each bill and evaluates the impact on different companies, including Apple.Read original article

Read more »

Incipio Releases SureView Folio Case for iPad 10.2-Inch
On Friday Incipio released its newest case called SureView and it’s designed for the iPad 10.2-inch (7th, 8th gen). It’s available to purchase for US$44.99. SureView Case for iPad The Incipio SureView folio includes an adjustable stand with strong, strategically positioned magnets that prevent the iPad from collapsing when used for hands-free landscape viewing. With four angle placements ranging from 40 to 70 degrees, the SureView folio’s new magnetic view-lock feature ensures the iPad is securely in place at the most convenient viewing position in any setting. In addition to the new magnetic stand, the Incipio SureView folio offers reliable everyday iPad protection against up to four-foot drops, an improved audio experience through tactically located sound channels that reroute audio toward the user, integrated Apple pencil storage, and more.

Read more »

TSMC and Foxconn to buy 10 million doses of COVID-19 vaccines for Taiwan
Taiwan will allow Taiwan Semiconductor Manufacturing Company (TSMC) and Foxconn to buy 10 million doses of COVID-19 vaccines on behalf… The post appeared first on MacDailyNews.

Read more »

Hands-on: Snapback Slim Air wallet packs a dedicated AirTag slot and can hold 6 cards and cash
AirTags are here and the accessory market around the new item tracker is expanding quickly. While there are lots of keychains, cases, and other similar options to attach an AirTag to things, we haven’t seen as many wallets that are compatible with it. With a super minimal design, the Snapback Slim Air wallet for AirTags caught our eye, here’s our review. more… The post appeared first on 9to5Mac.

Read more »

YouTube for iPhone and iPad rolling out Picture-in-Picture (PiP) for Premium users worldwide
With iOS 14 last year, Apple introduced Picture-in-Picture to let you watch video in a floating window while using other tasks. The YouTube app is finally adding support for PiP on iPhone and iPad.  more… The post appeared first on 9to5Mac.

Read more »

Apple’s WWDC21 Privacy Announcements in 10 Minutes
Listen along as we discuss all of Apple's Privacy Announcements from WWDC21 in this mini segment from Mac Geek Gab 875. Mail Privacy, Which Browsers work with iCloud+, and more

Read more »

China iPhone 12 Shipments 12 Percent Down on iPhone X
Current iPhone shipments in China are 12 percent down on the iPhone X series, according to a research note from Goldman Sachs seen by AppleInsider. It casts some doubt on the idea that we are in the midst of a so-called ‘super-cycle’. Analyst Rod Hall analyzes the latest China smartphone shipment data for the month of May, which was recently released by the state-run China Academy of Information and Communications Technology (CAICT). Total handset units during the period clocked in at 23 million units, down 32% year-over-year. Hall points out that this appears to be the lowest shipment numbers for China since at least May 2014. Hall also says that re-opening "seems to have pulled demand forward quite a bit out of April and May," but that the impact appears to have been short-lived. He suggests that China's re-opening story could be a blueprint for how other countries fare when they re-open.

Read more »

Apple Music in India Getting Spatial Audio and Lossless
Spatial Audio with Dolby Atmos and lossless quality tracks have rolled out for Apple Music users around the world. Shortly, those in India will be getting these features too, iMore reported. When Apple launched Spatial Audio and Lossless Audio for Apple Music last week, users of the music streaming service in India were disappointed to find that they were not included in the first batch of countries to receive the new features. Now, Apple has confirmed that, thankfully, that wait won't be for too long. The company has confirmed on the Apple Music website in the country that both Spatial Audio and Lossless Audio are "coming soon" to users in India. While this usually means that a launch is imminent, Apple has not put an exact date on when Apple Music subscribers can expect the features to drop.

Read more »

Stopping Apple from preinstalling apps might sound fair, but it’s a bad idea
As governments around the world scrutinize Apple’s App Store policies, the U.S. Congress is pondering legislation that could stop the company from preinstalling default apps on iPhones. Apple critics suggest that such a move would level the playing field and give smaller developers a chance to compete. But would it actually benefit consumers, the purported […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV+ is about to take off the training wheels
After launching the one-year free trial to Apple TV+ with select new Apple device purchases starting back in November 2019, Apple is… The post appeared first on MacDailyNews.

Read more »

Amazon Prime Day 2021 Takes Place on June 21 and 22
Amazon’s annual Prime Day event begins at midnight PDT Monday, June 21 and continues through June 22.  There will be deals in a range of categories available to Prime members in various countries. Which Countries Get Amazon Prime Day 2021 Offers U.S. UK United Arab Emirates Turkey Spain Singapore Saudi Arabia Portugal Netherlands Mexico Luxembourg Japan Italy Germany France China Brazil Belgium Austria Australia Amazon announced that there will be over two million deals over the Amazon Prime Day event. The Mac Observer team will be sure to share any good ones that we spot!

Read more »

22 New Actions Coming to Shortcuts in iOS 15
Matthew Cassinelli shared a post on his website sharing 22 new actions coming to shortcuts for iOS | iPadOS 15, and 21 Mac-only actions. The full post requires a subscription but he shared an image with details. With the release of iOS 15 and the associated betas across Apple’s platforms, the Shortcuts app has received 2 automation types and 22 new actions that work across iPhone, iPad, and macOS as well as 21 Mac-only actions. I think I’m most looking forward to Get Folder Contents, Rename File, Overlay Text, Extract Text From Image, and probably Get File From Folder.

Read more »

Apple should not kill the iPhone SE
Apple released the first generation iPhone SE in 2016, as a cheaper and compact version of the iPhone but with flagship grade internals. To ... Read more The post appeared first on iLounge.

Read more »

How to Stop Yourself From Activating Mac Hot Corners
Mac hot corners is a feature that lets you perform certain actions just by moving your cursor to one of four corners on the screen. Since all it takes is moving the cursor over, sometimes we accidentally activate this feature. But no more, because there's a better way. You can hear more about this tip on Monday's episode of Mac Geek Gab. Enhanced Hot Corners You can find this feature by going to System Preferences > Desktop & Screen Saver > Screen Saver > Hot Corners. Or, just search for hot corners. You can use hot corners for actions like starting/disabling your screen saver, opening Mission Control, going to the Desktop, putting your Mac to sleep, and more. A feature of hot corners that isn't obvious in the drop-down menu is that you can hold down a key, or a combination of keys, when you select an item. These keys can be command, option, shift, and control. It means that next time you want to use a hot corner you have to move your cursor and hold that key down. This will help stop you from hot corner accidents.

Read more »

First American Financial Pays Farcical $500K Fine
In May 2019, KrebsOnSecurity broke the news that the website of mortgage settlement giant First American Financial Corp. [NYSE:FAF] was leaking more than 800 million documents -- many containing sensitive financial data -- related to real estate transactions dating back more than 16 years. This week, the U.S. Securities and Exchange Commission settled its investigation into the matter after the Fortune 500 company agreed to pay a paltry penalty of less than $500,000.

Read more »

New Features Coming in macOS Monterey, iOS 15, and iPadOS 15 – Intego Mac Podcast Episode 192
Apple issued a security update for iOS 12, and we wonder why. Google backtracks on a Chrome address bar change. New stats show an increasing in phishing sites. And we discuss the new features in Apple's next operating systems, due out in the fall. The post appeared first on The Mac Security Blog.

Read more »

Ukrainian Police Nab Six Tied to CLOP Ransomware
Authorities in Ukraine this week charged six people alleged to have been part of the CLOP ransomware group, a cybercriminal gang said to have extorted more than half a billion dollars from victims. Some of CLOP's victims this year alone include Stanford University Medical School, the University of California, and University of Maryland.

Read more »

How Does One Get Hired by a Top Cybercrime Gang?
The U.S. Department of Justice (DOJ) last week announced the arrest of a 55-year-old Latvian woman who’s alleged to have worked as a programmer for Trickbot, a malware-as-a-service platform responsible for infecting millions of computers and seeding many of those systems with ransomware. Just how did a self-employed web site designer and mother of two come to work for one of the world’s most rapacious cybercriminal groups and then leave such an obvious trail of clues indicating her involvement with the gang? This post explores answers to those questions, as well as some of the ways Trickbot and other organized cybercrime gangs gradually recruit, groom and trust new programmers.

Read more »

Vulnerability Summary for the Week of June 7, 2021
Original release date: June 14, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info aomedia -- aomedia aom_dsp/noise_model.c in libaom in AOMedia before 2021-03-24 has a buffer overflow. 2021-06-04 7.5 CVE-2021-30475 MISC MISC broadcom -- sannav Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration; this is commonly referred to as Server-Side Request Forgery (SSRF). 2021-06-09 7.5 CVE-2020-15377 MISC chiyu-tech -- bf-430_firmware An authentication bypass in telnet server in BF-430 and BF431 232/422 TCP/IP Converter, BF-450M and SEMAC from CHIYU Technology Inc allows obtaining a privileged connection with the target device by supplying a specially malformed request and an attacker may force the remote telnet server to believe that the user has already authenticated. 2021-06-04 7.5 CVE-2021-31251 CONFIRM MISC MISC linux -- linux_kernel The eBPF RINGBUF bpf_ringbuf_reserve() function in the Linux kernel did not check that the allocated size was smaller than the ringbuf size, allowing an attacker to perform out-of-bounds writes within the kernel and therefore, arbitrary code execution. This issue was fixed via commit 4b81ccebaeee ("bpf, ringbuf: Deny reserve of buffers larger than ringbuf") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced via 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") (v5.8-rc1). 2021-06-04 7.2 CVE-2021-3489 MISC UBUNTU UBUNTU MISC MLIST linux -- linux_kernel The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. This issue was fixed via commit 049c4e13714e ("bpf: Fix alu32 const subreg bound tracking on bitwise operations") (v5.13-rc4) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. The AND/OR issues were introduced by commit 3f50f132d840 ("bpf: Verifier, do explicit ALU32 bounds tracking") (5.7-rc1) and the XOR variant was introduced by 2921c90d4718 ("bpf:Fix a verifier failure with xor") ( 5.10-rc1). 2021-06-04 7.2 CVE-2021-3490 UBUNTU MISC MISC UBUNTU MLIST linux -- linux_kernel The io_uring subsystem in the Linux kernel allowed the MAX_RW_COUNT limit to be bypassed in the PROVIDE_BUFFERS operation, which led to negative values being usedin mem_rw when reading /proc//mem. This could be used to create a heap overflow leading to arbitrary code execution in the kernel. It was addressed via commit d1f82808877b ("io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers") (v5.13-rc1) and backported to the stable kernels in v5.12.4, v5.11.21, and v5.10.37. It was introduced in ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") (v5.7-rc1). 2021-06-04 7.2 CVE-2021-3491 UBUNTU UBUNTU MISC MISC MLIST microsoft -- intune_management_extension Microsoft Intune Management Extension Remote Code Execution Vulnerability 2021-06-08 7.5 CVE-2021-31980 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31976. 2021-06-08 7.8 CVE-2021-31975 MISC microsoft -- windows_10 Server for NFS Information Disclosure Vulnerability This CVE ID is unique from CVE-2021-31975. 2021-06-08 7.8 CVE-2021-31976 MISC microsoft -- windows_10 Kerberos AppContainer Security Feature Bypass Vulnerability 2021-06-08 7.5 CVE-2021-31962 MISC qualcomm -- apq8009_firmware Out of bound read will happen if EAPOL Key length is less than expected while processing NAN shared key descriptor attribute in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking 2021-06-09 7.8 CVE-2020-11241 CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accela -- civic_platform In Accela Civic Platform through 21.1, the security/hostSignon.do parameter servProvCode is vulnerable to XSS. 2021-06-07 4.3 CVE-2021-33904 MISC MISC adiscon -- loganalyzer Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS. 2021-06-08 4.3 CVE-2021-31738 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Directory traversal vulnerability by inserting '../' payloads within the 'fileurl' parameter. 2021-06-04 4 CVE-2020-36142 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Unrestricted File Upload vulnerability via bypass MIME Type validation by inserting 'image/jpeg' within the 'Content-Type' header. 2021-06-04 6.5 CVE-2020-36141 MISC bloofox -- bloofoxcms BloofoxCMS 0.5.2.1 allows Cross-Site Request Forgery (CSRF) via 'mode=settings&page=editor', as demonstrated by use of 'mode=settings&page=editor' to change any file content (Locally/Remotely). 2021-06-04 4.3 CVE-2020-36140 MISC broadcom -- sannav Brocade SANNav before version 2.1.1 contains an information disclosure vulnerability. Successful exploitation of internal server information in the initial login response header. 2021-06-09 5 CVE-2020-15384 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. 2021-06-09 5 CVE-2020-15380 MISC broadcom -- sannav The OVA version of Brocade SANnav before version 2.1.1 installation with IPv6 networking exposes the docker container ports to the network, increasing the potential attack surface. 2021-06-09 5 CVE-2020-15378 MISC broadcom -- sannav Brocade SANnav before version 2.1.1 allows an authenticated attacker to list directories, and list files without permission. As a result, users without permission can see folders, and hidden files, and can create directories without permission. 2021-06-09 5.5 CVE-2020-15385 MISC chiyu-tech -- bf-430_firmware An open redirect vulnerability exists in BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, and SEMAC devices from CHIYU Technology that can be exploited by sending a link that has a specially crafted URL to convince the user to click on it. 2021-06-04 5.8 CVE-2021-31252 CONFIRM MISC MISC chiyu-tech -- bf-430_firmware A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components. 2021-06-04 6.4 CVE-2021-31249 MISC MISC MISC cisco -- webex_meetings_desktop A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system, which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account. 2021-06-04 6.9 CVE-2021-1536 CISCO ckeditor -- ckeditor A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --! > is mishandled. 2021-06-09 4.3 CVE-2021-33829 MISC cloverdx -- cloverdx A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10. 2021-06-09 4.3 CVE-2021-30133 CONFIRM MISC dino -- dino Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory Traversal (only for creation of new files) via URI-encoded path separators. 2021-06-07 5 CVE-2021-33896 CONFIRM MISC MLIST dlink -- dir-868l_firmware The D-Link router DIR-868L 3.01 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29321 MISC dlink -- dir-880l_firmware The D-Link router DIR-880L 1.07 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29322 MISC dlink -- dir-885l-mfc_firmware The D-link router DIR-885L-MFC 1.15b02, v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29323 MISC dlink -- dir-895l_mfc_firmware The DLink Router DIR-895L MFC v1.21b05 is vulnerable to credentials disclosure in telnet service through decompilation of firmware, that allows an unauthenticated attacker to gain access to the firmware and to extract sensitive data. 2021-06-04 5 CVE-2020-29324 MISC entrouvert -- lasso Lasso all versions prior to 2.7.0 has improper verification of a cryptographic signature. 2021-06-04 5 CVE-2021-28091 MISC MISC MISC DEBIAN MLIST FEDORA FEDORA esri -- arcgis_server A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed (not customer datasets). Web Services that use file based data sources (file Geodatabase or Shape Files or tile cached services) are unaffected by this issue. 2021-06-07 5 CVE-2021-29099 CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks. 2021-06-08 4.3 CVE-2021-22220 CONFIRM MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30517 MISC MISC google -- chrome Insufficient policy enforcement in PopupBlocker in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted iframe. 2021-06-07 4.3 CVE-2021-30533 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30532 MISC MISC google -- chrome Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30531 MISC MISC google -- chrome Use after free in Autofill in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30514 MISC MISC google -- chrome Type confusion in V8 in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30513 MISC MISC google -- chrome Out of bounds read in Tab Groups in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory read via a crafted HTML page. 2021-06-04 5.8 CVE-2021-30511 MISC MISC google -- chrome Use after free in Notifications in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30512 MISC MISC google -- chrome Insufficient policy enforcement in cookies in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass cookie policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30537 MISC MISC google -- chrome Out of bounds read in V8 in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30536 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 5.8 CVE-2021-30539 MISC MISC google -- chrome Use after free in Aura in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30510 MISC MISC google -- chrome Out of bounds write in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page and a crafted Chrome extension. 2021-06-04 6.8 CVE-2021-30509 MISC MISC google -- chrome Heap buffer overflow in Media Feeds in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to enable certain features in Chrome to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30508 MISC MISC google -- chrome Inappropriate implementation in Offline in Google Chrome on Android prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30507 MISC MISC google -- chrome Incorrect security UI in Web App Installs in Google Chrome on Android prior to 90.0.4430.212 allowed an attacker who convinced a user to install a web application to inject scripts or HTML into a privileged page via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30506 MISC MISC google -- chrome Insufficient policy enforcement in iFrameSandbox in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30534 MISC MISC google -- chrome Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30538 MISC MISC google -- chrome Heap buffer overflow in Reader Mode in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30518 MISC MISC google -- chrome Use after free in WebUI in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30527 MISC MISC google -- chrome Use after free in Payments in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious payments app to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30519 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 90.0.4430.212 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30520 MISC MISC google -- chrome Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30521 MISC MISC google -- chrome Use after free in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30522 MISC MISC MISC google -- chrome Use after free in WebRTC in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted SCTP packet. 2021-06-07 6.8 CVE-2021-30523 MISC MISC google -- chrome Use after free in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30524 MISC MISC google -- chrome Use after free in TabGroups in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30525 MISC MISC google -- chrome Out of bounds write in TabStrip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to perform an out of bounds memory write via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30526 MISC MISC google -- chrome Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30528 MISC MISC google -- chrome Use after free in File API in Google Chrome prior to 90.0.4430.212 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30515 MISC MISC google -- chrome Use after free in Bookmarks in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30529 MISC MISC google -- chrome Double free in ICU in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30535 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30542 MISC MISC google -- chrome Use after free in Tab Strip in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30543 MISC MISC google -- chrome Incorrect security UI in payments in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform domain spoofing via a crafted HTML page. 2021-06-07 4.3 CVE-2021-30540 MISC MISC google -- chrome Heap buffer overflow in History in Google Chrome prior to 90.0.4430.212 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-06-04 6.8 CVE-2021-30516 MISC MISC google -- chrome Out of bounds memory access in WebAudio in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. 2021-06-07 6.8 CVE-2021-30530 MISC MISC ibm -- datapower_gateway IBM DataPower Gateway 10.0.0.0 through 10.0.1.0 and 2018.4.1.0 through 2018.4.1.14 stores sensitive information in GET request parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 193033. 2021-06-07 5 CVE-2020-5008 CONFIRM XF ibm -- websphere_application_server_nd IBM WebSphere Application Server Network Deployment 8.5 and 9.0 could allow a remote authenticated attacker to traverse directories. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to read and delete arbitrary files on the system. IBM X-Force ID: 198435. 2021-06-07 6.5 CVE-2021-20517 CONFIRM XF inverse -- sogo SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.) 2021-06-04 5 CVE-2021-33054 MISC MISC MISC jnews -- jnews The JNews WordPress theme before 8.0.6 did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue. 2021-06-07 4.3 CVE-2021-24342 CONFIRM luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because requests related to Check-In State occur shortly after requests for Phone Number Registration. 2021-06-04 5 CVE-2021-33838 MISC MISC MISC MISC luca-app -- luca The server in Luca through 1.1.14 allows remote attackers to cause a denial of service (insertion of many fake records related to COVID-19) because Phone Number data lacks a digital signature. 2021-06-04 5 CVE-2021-33840 MISC MISC luca-app -- luca Luca through 1.7.4 on Android allows remote attackers to obtain sensitive information about COVID-19 tracking because the QR code of a Public Location can be intentionally confused with the QR code of a Private Meeting. 2021-06-04 5 CVE-2021-33839 MISC MISC MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31940. 2021-06-08 6.8 CVE-2021-31941 MISC MISC microsoft -- 365_apps Microsoft Office Graphics Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31941. 2021-06-08 6.8 CVE-2021-31940 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31942. 2021-06-08 6.8 CVE-2021-31943 MISC microsoft -- 3d_viewer 3D Viewer Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31943. 2021-06-08 6.8 CVE-2021-31942 MISC microsoft -- 3d_viewer 3D Viewer Information Disclosure Vulnerability 2021-06-08 4.3 CVE-2021-31944 MISC microsoft -- edge Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability 2021-06-08 5.1 CVE-2021-33741 MISC microsoft -- kubernetes_tools Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-31938 MISC microsoft -- malware_protection_engine Microsoft Defender Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31985 MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31945, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31946 MISC MISC microsoft -- paint_3d Paint 3D Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31946, CVE-2021-31983. 2021-06-08 6.8 CVE-2021-31945 MISC MISC microsoft -- sharepoint_enterprise_server Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31963, CVE-2021-31966. 2021-06-08 6.5 CVE-2021-26420 MISC microsoft -- vp9_video_extensions VP9 Video Extensions Remote Code Execution Vulnerability 2021-06-08 6.8 CVE-2021-31967 MISC microsoft -- windows_10 Windows Remote Desktop Services Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31968 MISC microsoft -- windows_10 Server for NFS Denial of Service Vulnerability 2021-06-08 5 CVE-2021-31974 MISC microsoft -- windows_10 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31969 MISC microsoft -- windows_10 Windows GPSVC Elevation of Privilege Vulnerability 2021-06-08 4.6 CVE-2021-31973 MISC microsoft -- windows_10 Windows HTML Platform Security Feature Bypass Vulnerability 2021-06-08 6.8 CVE-2021-31971 MISC microsoft -- windows_server_2008 Windows DCOM Server Security Feature Bypass 2021-06-08 4.3 CVE-2021-26414 MISC microsoft -- windows_server_2008 Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31199. 2021-06-08 4.6 CVE-2021-31201 MISC microsoft -- windows_server_2008 Windows Print Spooler Elevation of Privilege Vulnerability 2021-06-08 6.8 CVE-2021-1675 MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-23215 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in the DwaCompressor of OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. This is a different flaw from CVE-2021-23215. 2021-06-08 4.3 CVE-2021-26260 FEDORA MISC openexr -- openexr An integer overflow leading to a heap-buffer overflow was found in OpenEXR in versions before 3.0.1. An attacker could use this flaw to crash an application compiled with OpenEXR. 2021-06-08 4.3 CVE-2021-26945 MISC openexr -- openexr A heap-buffer overflow was found in the copyIntoFrameBuffer function of OpenEXR in versions before 3.0.1. An attacker could use this flaw to execute arbitrary code with the permissions of the user running the application compiled against OpenEXR. 2021-06-08 6.8 CVE-2021-23169 FEDORA MISC FEDORA openvpn -- openvpn_access_server OpenVPN Access Server 2.7.3 to 2.8.7 allows remote attackers to trigger an assert during the user authentication phase via incorrect authentication token data in an early phase of the user authentication resulting in a denial of service. 2021-06-04 5 CVE-2020-36382 MISC MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via the font-size parameter. 2021-06-07 4.3 CVE-2020-36383 MISC pagelayer -- pagelayer PageLayer before 1.3.5 allows reflected XSS via color settings. 2021-06-07 4.3 CVE-2020-36384 MISC qualcomm -- apq8009_firmware Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 6.9 CVE-2020-11233 CONFIRM qualcomm -- apq8009w_firmware Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking 2021-06-09 6.9 CVE-2020-11250 CONFIRM qualcomm -- apq8096au_firmware Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-06-09 4.6 CVE-2020-11160 CONFIRM refined-github_project -- refined-github The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to, in general, address XSS and other concerns. 2021-06-09 4.3 CVE-2021-34364 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33661 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated FLI file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33660 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated GIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-33659 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated TIF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27641 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27638 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated JT file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27639 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PSD file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27640 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated PCX file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27642 MISC MISC sap -- 3d_visual_enterprise_viewer SAP 3D Visual Enterprise Viewer, version - 9, allows a user to open manipulated IFF file received from untrusted sources which results in crashing of the application and becoming temporarily unavailable until the user restarts the application, this is caused due to Improper Input Validation. 2021-06-09 4.3 CVE-2021-27643 MISC MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_add_member". 2021-06-07 6.8 CVE-2020-18265 MISC simple-log_project -- simple-log Cross Site Request Forgery (CSRF) in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=act_edit_member". 2021-06-07 6.8 CVE-2020-18264 MISC tracefinanacial -- crestbridge Trace Financial CRESTBridge V1.1 and < V1.3.2), SIMATIC RF185C (All versions > V1.1 and < V1.3.2), SIMATIC RF186C (All versions > V1.1 and < V1.3.2), SIMATIC RF186CI (All versions > V1.1 and < V1.3.2), SIMATIC RF188C (All versions > V1.1 and < V1.3.2), SIMATIC RF188CI (All versions > V1.1 and < V1.3.2), SIMATIC RF360R (All versions), SIMATIC RF615R (All versions > V3.0), SIMATIC RF680R (All versions > V3.0), SIMATIC RF685R (All versions > V3.0). Affected devices do not properly handle large numbers of incoming connections. An attacker may leverage this to cause a Denial-of-Service situation. 2021-06-08 not yet calculated CVE-2021-31340 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27399. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12819) 2021-06-08 not yet calculated CVE-2021-27387 MISC simcenter -- femap   A vulnerability has been identified in Simcenter Femap 2020.2 (All versions < V2020.2.MP3), Simcenter Femap 2021.1 (All versions < V2021.1.MP3). The femap.exe application lacks proper validation of user-supplied data when parsing FEMAP files. This could result in an out of bounds write past the end of an allocated structure, a different vulnerability than CVE-2021-27387. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-12820) 2021-06-08 not yet calculated CVE-2021-27399 MISC smartstream -- transaction_lifecycle_management_reconciliation_premium   SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' in parser_parse_function_arguments in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23320 CONFIRM ubuntu -- ubuntu   Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25949 MISC MISC ubuntu -- ubuntu   Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. 2021-06-10 not yet calculated CVE-2021-25948 MISC MISC ubuntu -- ubuntu   It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO. 2021-06-11 not yet calculated CVE-2021-25684 MISC ubuntu -- ubuntu   There is a heap-buffer-overflow at lit-strings.c:431 in lit_read_code_unit_from_utf8 in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23321 CONFIRM ubuntu -- ubuntu   There is an Assertion in '(flags > > CBC_STACK_ADJUST_SHIFT) >= CBC_STACK_ADJUST_BASE || (CBC_STACK_ADJUST_BASE - (flags > > CBC_STACK_ADJUST_SHIFT)) stack_depth' in parser_emit_cbc_backward_branch in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23319 CONFIRM ubuntu -- ubuntu   There is an Assertion in 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23322 CONFIRM ubuntu -- ubuntu   There is an Assertion 'block_found' failed at js-parser-statm.c:2003 parser_parse_try_statement_end in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23314 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >next_scanner_info_p- >type == SCANNER_TYPE_FUNCTION' failed at js-parser-statm.c:733 in parser_parse_function_statement in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23310 CONFIRM ubuntu -- ubuntu   There is an Assertion 'scope_stack_p > context_p- >scope_stack_p' failed at js-scanner-util.c:2510 in scanner_literal_is_created in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23313 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_depth == context_p- >context_stack_depth' failed at js-parser-statm.c:2756 in parser_parse_statements in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23309 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >stack_top_uint8 == LEXER_EXPRESSION_START' at js-parser-expr.c:3565 in parser_parse_expression in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23308 CONFIRM ubuntu -- ubuntu   There is an Assertion 'context_p- >token.type == LEXER_RIGHT_BRACE || context_p- >token.type == LEXER_ASSIGN || context_p- >token.type == LEXER_COMMA' failed at js-parser-expr.c:3230 in parser_parse_object_initializer in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23311 CONFIRM ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32553 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32552 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32551 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32550 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32554 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32555 MISC ubuntu -- ubuntu   It was discovered that the get_modified_conffiles() function in backends/packaging-apt-dpkg.py allowed injecting modified package names in a manner that would confuse the dpkg(1) call. 2021-06-12 not yet calculated CVE-2021-32556 MISC ubuntu -- ubuntu   It was discovered that the process_report() function in data/whoopsie-upload-all allowed arbitrary file writes via symlinks. 2021-06-12 not yet calculated CVE-2021-32557 MISC ubuntu -- ubuntu   It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users. 2021-06-12 not yet calculated CVE-2021-32549 MISC ubuntu -- ubuntu   It was discovered that the get_pid_info() function in data/apport did not properly parse the /proc/pid/status file from the kernel. 2021-06-11 not yet calculated CVE-2021-25682 MISC ubuntu -- ubuntu   It was discovered that the get_starttime() function in data/apport did not properly parse the /proc/pid/stat file from the kernel. 2021-06-11 not yet calculated CVE-2021-25683 MISC ubuntu -- ubuntu   There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_string in JerryScript 2.2.0 2021-06-10 not yet calculated CVE-2020-23302 CONFIRM ubuntu -- ubuntu   There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_empty in JerryScript 2.2.0. 2021-06-10 not yet calculated CVE-2020-23303 CONFIRM unix -- symbolic_link   A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1. 2021-06-10 not yet calculated CVE-2021-25322 CONFIRM vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 2 of 2). 2021-06-08 not yet calculated CVE-2021-26472 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated Remote Code Execution by placing a command in a GET request (issue 1 of 2). 2021-06-08 not yet calculated CVE-2021-26471 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated file write via a GET request that specifies a file's name and content. 2021-06-08 not yet calculated CVE-2021-26473 MISC MISC MISC MISC MISC vembu -- bdr_suite   Vembu BDR Suite before 4.2.0 allows Unauthenticated SSRF via a GET request that specifies a hostname and port number. 2021-06-08 not yet calculated CVE-2021-26474 MISC MISC MISC MISC MISC vernemq_mqtt_broker -- vernemq_mqtt_broker   VerneMQ MQTT Broker versions prior to 1.12.0 are vulnerable to a denial of service attack as a result of excessive memory consumption due to the handling of untrusted inputs. These inputs cause the message broker to consume large amounts of memory, resulting in the application being terminated by the operating system. 2021-06-08 not yet calculated CVE-2021-33176 MISC welch_allyn -- multiple_devices   The affected product is vulnerable to an out-of-bounds read, which can cause information leakage leading to arbitrary code execution if chained to the out-of-bounds write vulnerability on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27408 MISC welch_allyn -- multiple_products   The affected product is vulnerable to an out-of-bounds write, which may result in corruption of data or code execution on the Welch Allyn medical device management tools (Welch Allyn Service Tool: versions prior to v1.10, Welch Allyn Connex Device Integration Suite – Network Connectivity Engine (NCE): versions prior to v5.3, Welch Allyn Software Development Kit (SDK): versions prior to v3.2, Welch Allyn Connex Central Station (CS): versions prior to v1.8.6, Welch Allyn Service Monitor: versions prior to v1.7.0.0, Welch Allyn Connex Vital Signs Monitor (CVSM): versions prior to v2.43.02, Welch Allyn Connex Integrated Wall System (CIWS): versions prior to v2.43.02, Welch Allyn Connex Spot Monitor (CSM): versions prior to v1.52, Welch Allyn Spot Vital Signs 4400 Device (Spot 4400) / Welch Allyn Spot 4400 Vital Signs Extended Care Device: versions prior to v1.11.00). 2021-06-11 not yet calculated CVE-2021-27410 MISC werkzeug -- werkzeug   This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False. 2021-06-11 not yet calculated CVE-2021-23393 MISC MISC western_digital -- edgerover   Western Digital EdgeRover before 0.25 has an escalation of privileges vulnerability where a low privileged user could load malicious content into directories with higher privileges, because of how Node.js is used. An attacker can gain admin privileges and carry out malicious activities such as creating a fake library and stealing user credentials. 2021-06-11 not yet calculated CVE-2021-33205 CONFIRM whatsapp -- business   A lack of filename validation when unzipping archives prior to WhatsApp for Android v2.21.8.13 and WhatsApp Business for Android v2.21.8.13 could have allowed path traversal attacks that overwrite WhatsApp files. 2021-06-11 not yet calculated CVE-2021-24035 CONFIRM windows -- mshtml_platform   Windows MSHTML Platform Remote Code Execution Vulnerability 2021-06-08 not yet calculated CVE-2021-33742 MISC wordpress -- wordpress   The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users 2021-06-07 not yet calculated CVE-2021-24336 MISC CONFIRM wordpress -- wordpress   The Easy Preloader WordPress plugin through 1.0.0 does not sanitise its setting fields, leading to authenticated (admin+) Stored Cross-Site scripting issues 2021-06-07 not yet calculated CVE-2021-24344 CONFIRM wordpress -- wordpress   The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones. 2021-06-07 not yet calculated CVE-2021-24340 CONFIRM MISC wordpress -- wordpress   The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. 2021-06-07 not yet calculated CVE-2021-24337 MISC CONFIRM wowonder -- wowonder   In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day. 2021-06-11 not yet calculated CVE-2021-27200 MISC MISC MISC wp-cli -- wp-cli   WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the communication content, including the ability to impersonate update servers and push malicious updates towards WordPress instances controlled by the vulnerable WP-CLI agent, or push malicious updates toward WP-CLI itself. The vulnerability stems from the fact that the default behavior of `WP_CLIUtilshttp_request()` when encountering a TLS handshake error is to disable certificate validation and retry the same request. The default behavior has been changed with version 2.5.0 of WP-CLI and the `wp-cli/wp-cli` framework (via https://github.com/wp-cli/wp-cli/pull/5523) so that the `WP_CLIUtilshttp_request()` method accepts an `$insecure` option that is `false` by default and consequently that a TLS handshake failure is a hard error by default. This new default is a breaking change and ripples through to all consumers of `WP_CLIUtilshttp_request()`, including those in separate WP-CLI bundled or third-party packages. https://github.com/wp-cli/wp-cli/pull/5523 has also added an `--insecure` flag to the `cli update` command to counter this breaking change. There is no direct workaround for the default insecure behavior of `wp-cli/wp-cli` versions before 2.5.0. The workaround for dealing with the breaking change in the commands directly affected by the new secure default behavior is to add the `--insecure` flag to manually opt-in to the previous insecure behavior. 2021-06-07 not yet calculated CVE-2021-29504 MISC MISC MISC MISC MISC MISC CONFIRM xen -- xen   HVM soft-reset crashes toolstack libxl requires all data structures passed across its public interface to be initialized before use and disposed of afterwards by calling a specific set of functions. Many internal data structures also require this initialize / dispose discipline, but not all of them. When the "soft reset" feature was implemented, the libxl__domain_suspend_state structure didn't require any initialization or disposal. At some point later, an initialization function was introduced for the structure; but the "soft reset" path wasn't refactored to call the initialization function. When a guest nwo initiates a "soft reboot", uninitialized data structure leads to an assert() when later code finds the structure in an unexpected state. The effect of this is to crash the process monitoring the guest. How this affects the system depends on the structure of the toolstack. For xl, this will have no security-relevant effect: every VM has its own independent monitoring process, which contains no state. The domain in question will hang in a crashed state, but can be destroyed by `xl destroy` just like any other non-cooperating domain. For daemon-based toolstacks linked against libxl, such as libvirt, this will crash the toolstack, losing the state of any in-progress operations (localized DoS), and preventing further administrator operations unless the daemon is configured to restart automatically (system-wide DoS). If crashes "leak" resources, then repeated crashes could use up resources, also causing a system-wide DoS. 2021-06-11 not yet calculated CVE-2021-28687 MISC xen -- xen   x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area of the i386 architecture was rarely used, which is why Xen was able to use it to implement paravirtualisation, Xen's novel approach to virtualization. In AMD64, Xen had to use a different implementation approach, so Xen does not use ring 1 to support 64-bit guests. With the focus now being on 64-bit systems, and the availability of explicit hardware support for virtualization, fixing speculation issues in ring 1 is not a priority for processor companies. Indirect Branch Restricted Speculation (IBRS) is an architectural x86 extension put together to combat speculative execution sidechannel attacks, including Spectre v2. It was retrofitted in microcode to existing CPUs. For more details on Spectre v2, see: http://xenbits.xen.org/xsa/advisory-254.html However, IBRS does not architecturally protect ring 0 from predictions learnt in ring 1. For more details, see: https://software.intel.com/security-software-guidance/deep-dives/deep-dive-indirect-branch-restricted-speculation Similar situations may exist with other mitigations for other kinds of speculative execution attacks. The situation is quite likely to be similar for speculative execution attacks which have yet to be discovered, disclosed, or mitigated. 2021-06-11 not yet calculated CVE-2021-28689 MISC xscreensaver -- xscreensaver   XScreenSaver 5.45 can be bypassed if the machine has more than ten disconnectable video outputs. A buffer overflow in update_screen_layout() allows an attacker to bypass the standard screen lock authentication mechanism by crashing XScreenSaver. The attacker must physically disconnect many video outputs. 2021-06-10 not yet calculated CVE-2021-34557 MISC MISC MISC MISC MLIST z-blogphp -- z-blogphp   Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." 2021-06-07 not yet calculated CVE-2020-18268 MISC MISC zoho_manageengine -- key_manager_plus   Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD. 2021-06-07 not yet calculated CVE-2021-28382 MISC MISC zope_foundation -- zope   Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.21 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only. 2021-06-08 not yet calculated CVE-2021-32674 CONFIRM MISC MISC MISC zte -- zte   A ZTE product has an information leak vulnerability. Due to improper permission settings, an attacker with ordinary user permissions could exploit this vulnerability to obtain some sensitive user information through the wizard page without authentication. This affects ZXHN H168N all versions up to V3.5.0_EG1T4_TE. 2021-06-10 not yet calculated CVE-2021-21735 MISC zte -- zte   A smart camera product of ZTE is impacted by a permission and access control vulnerability. Due to the defect of user permission management by the cloud-end app, users whose sharing permissions have been revoked can still control the camera, such as restarting the camera, restoring factory settings, etc.. This affects ZXHN HS562 V1.0.0.0B2.0000, V1.0.0.0B3.0000E 2021-06-10 not yet calculated CVE-2021-21736 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Is Apple’s iCloud Private Relay a VPN? Not Even Close—Here’s Why
Apple's iCloud Private Relay is not a VPN, but Intego Privacy Protection is. Compare the two, and learn why Intego Privacy Protection is the best VPN for Mac. The post appeared first on The Mac Security Blog.

Read more »

New Privacy Features in iOS 15 and macOS Monterey – Intego Mac Podcast Episode 191
Apple introduced its new operating systems this week, and there are plenty of privacy features to help users better control their data. We discuss these new features, and especially a number of important features that Apple didn't discuss at the keynote. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patches Six Zero-Day Security Holes
Microsoft today released another round of security updates for Windows operating systems and supported software, including fixes for six zero-day bugs that malicious hackers already are exploiting in active attacks.

Read more »

Apple Announces New Features in iOS 15, iPadOS 15, and macOS Monterey
Apple announced new features for all its operating systems, to be released this fall. Here's an overview of what to look forward to. The post appeared first on The Mac Security Blog.

Read more »

Apple’s New Privacy Features for iOS 15, iPadOS 15, and macOS Monterey
Apple's forthcoming operating systems - iOS 15, iPadOS 15, and macOS Monterey - feature a number of powerful new privacy features. The post appeared first on The Mac Security Blog.

Read more »

Justice Dept. Claws Back $2.3M Paid by Colonial Pipeline to Ransomware Gang
The U.S. Department of Justice said today it has recovered $2.3 million worth of Bitcoin that Colonial Pipeline paid to ransomware extortionists last month. The funds had been sent to DarkSide, a ransomware-as-a-service syndicate that disbanded after a May 14 farewell message to affiliates saying its Internet servers and cryptocurrency stash were seized by unknown law enforcement entities.

Read more »

Apple launches 2021 Back to School promotion: Free AirPods with select Macs and iPads, plus up to $400 off Macs, $100 off iPads
Apple has launched their Back to School promotion for 2021. As part of this promotion, Apple will include one free pair AirPods (with charging case) with the purchase of a MacBook Air, MacBook Pro, iMac, Mac mini, or Mac Pro. Apple will also include a free pair of Apple AirPods (with charging case) with the purchase of any new iPad Air or iPad Pro (iPad mini and 8th-gen iPad excluded). You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Promotion runs through September 27, 2021. In addition to the free AirPods, purchase a new Mac using Apple’s Education discount, and take up to $400 off MSRP. Purchase an iPad, and take up to $100 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. Parents may also purchase on behalf of a child who is currently in school. Apple’s discount applies to the new Macs & iPads with M1 Apple Silicon CPUs as well as models containing Intel processors. Education discounts are also available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards: – 16″ 2.3GHz 8-Core MacBook Pro: $2599 $200 off – 16″ 2.6GHz 6-Core MacBook Pro: $2199 $200 off – 13″ 2.0GHz/1TB 4-Core MacBook Pro: $1899 $100 off – 13″ 2.0GHz/512GB 4-Core MacBook Pro: $1699 $100 off – 13″ M1 MacBook Pro/512GB: $1399 $100 off – 13″ M1 MacBook Pro/256GB: $1199 $100 off – 13″ M1 MacBook Air/8-Core CPU/7-Core GPU/256GB: $899 $100 off – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB: $1149 $100 off – 8-Core Mac Pro: $5599 $400 off – Pro Display XDR (standard): $4599 $400 off – Pro Display XDR (nano glass): $5599 $400 off – Pro Stand: $5599 $100 off – 24″ 8-Core CPU/8-Core GPU/512GB iMac: $1599

Read more »

Apple’s new 11″ M1 iPad Pros are on sale for up to $100 off MSRP at Sams Club
Sams Club has new 11″ iPad Pros with Apple M1 processors on sale today for $50-$100 off MSRP. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): – 11″ M1 128GB WiFi iPad Pro: $749 $50 off – 11″ M1 256GB WiFi iPad Pro: $849 $50 off – 11″ M1 512GB WiFi iPad Pro: $1049 $50 off – 11″ M1 1TB WiFi iPad Pro: $1429 $70 off – 11″ M1 2TB WiFi iPad Pro: $1799 $100 off – 11″ M1 128GB WiFi + Cellular iPad Pro: $949 $50 off – 11″ M1 256GB WiFi + Cellular iPad Pro: $1049 $50 off – 11″ M1 512GB WiFi + Cellular iPad Pro: $1249 $50 off – 11″ M1 1TB WiFi + Cellular iPad Pro: $1629 $70 off – 11″ M1 2TB WiFi + Cellular iPad Pro: $1999 $100 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Get a pair of Apple AirPods today for $52 off Apple’s MSRP
Amazon has Apple AirPods on sale today for up to $52 off MSRP, starting at $119. Shipping is free: – AirPods Pro: $197 $52 off MSRP – AirPods with Wireless Charging Case: $149.99 $50 off MSRP – AirPods with Charging Case: $119 $40 off MSRP – AirPods Max headphones: As low as $499 $50 off MSRP Their prices are the lowest available for new AirPods anywhere. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Apple restocks M1 Mac minis for as low as $589, Certified Refurbished
Apple has restocked a full line of standard configuration M1 Mac minis in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Note that stock of these models will likely come and go, so be sure to check Apple’s site for the latest stock status. The $589 model is the cheapest M1 Mac currently for sale anywhere. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Apple 13″ M1 MacBook Pros are on sale today for $150-$200 off MSRP, prices start at $1149
Amazon has Apple’s 13″ MacBook Pros with M1 Apple Silicon CPUs on sale for $150-$200 off MSRP today, starting at $1149. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1149.99 $150 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1299.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1149.99 $150 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1299.99 $200 off MSRP Amazon’s prices are currently the lowest available for these models from any Apple reseller. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Amazon is blowing out clearance 2020 21″ 4K iMacs for $400 off Apple’s original MSRPs, starting at $899
Amazon has clearance 2020 21″ 4K 4-Core & 6-Core iMacs on sale today for $400 off Apple’s original MSRP. These are the same iMacs sold by Apple in their retail and online stores. Be sure to make your purchase from Amazon rather than a third-party seller, and note that Amazon’s prices can change at any moment. See their site for the latest stock status: – 21″ 4K 3.6GHz 4-Core iMac: $899.99 $400 off MSRP – 21″ 4K 3.0GHz 6-Core iMac: $1099.99 $400 off MSRP Amazon’s prices are the lowest we’ve ever seen for these models. For the latest prices and sales, see our iMac Price Tracker, → Read More...

Read more »

How iOS 15 Will Help Those Without Sight Interact With And ‘See’ More Details In Photos
FEATURE: 06.14.21 – Seeing the writing on the wall is never a good thing… unless you’re a visually impaired individual looking at a photograph of just that. iOS — Apple’s mobile operating system — will be getting a number of new features which will use, as the company described it, “on-device intelligence” (a.k.a., the Apple Neural Engine) to enhance the user experience while on an Apple smartphone. Announced and previewed by Apple senior Vice President of software engineering, Craig Federighi, at the Cupertino, California-based company’s annual worldwide developers conference, WWDC 2021, the updates are just one of many software-specific upgrades that users of the iPhone can expect to see when the next version, iOS 15, is released later this year. Live Text, which uses “on-device intelligence” to identify text contained within images, is a new feature coming later this year to iOS 15 designed to enhance the user experience while viewing photographs in the Photos app on an iPhone. (Photo: Apple, Inc.) While the new features coming later this year to iOS 15 were not classified by Federighi as being accessibility-oriented in nature, the software upgrades will equally enhance the user experience for sighted users of the iPhone as well as those without sight who also use an Apple smartphone to assist them in their daily lives. **AD: For the lowest prices, best deals, and latest discounts on all Apple products and accessories from Apple and Apple Authorized Resellers? Check out our exclusive and award winning price trackers at MacPrices.net . Pricing updated daily, seven days a week! See What’s In Your Photos These are the new features in iOS 15 that will allow users of the iPhone to interact with the information contained within the images in their camera roll while viewing photographs in the Photos app on their Apple smartphone: Live Text- users will be able to recognize words in photographs (e.g., capturing the phone number from a photograph of a business’s storefront → Read More...

Read more »

Sunday Sale: Clearance 2020 Intel-based Mac mini available for only $499
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $499. These are new, unopened, factory-sealed minis, and they are the cheapest new Mac we could find anywhere: – 3.6GHz 4-core Mac mini: $499 $300 off original MSRP For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Sunday Sale: Clearance 2020 Intel-based Mac mini available for only $499
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $499. These are new, unopened, factory-sealed minis, and they are the cheapest new Mac we could find anywhere: – 3.6GHz 4-core Mac mini: $499 $300 off original MSRP For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Apple’s 24″ M1 iMacs on sale for $50 off MSRP
Amazon has Apple’s new 24″ M1 iMacs on sale this weekend for $50 off MSRP with prices starting at $1249 shipped. At the moment, the $50 discount is restricted to certain colors & configurations, but we’ll update this post if their discount spreads to other colors: – 24″ M1 iMac 8-Core CPU/7-Core GPU Silver: $1249.99 $50 off MSRP – 24″ M1 iMac 8-Core CPU/7-Core GPU Blue: $1249.99 $50 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU Silver: $1449.99 $50 off MSRP For the latest prices & sales, see our iMac Price Tracker, → Read More...

Read more »

Sale! Apple AirPods Max for $499, save $50
Amazon has Silver and Blue AirPods Max on sale for $499 shipped. Their price is $50 off Apple’s MSRP, and it’s the lowest price we’ve seen so far for AirPods Max. For the latest prices & sales, see our Apple AirPods Price Tracker, → Read More...

Read more »

New Apple Canada promotion: Free $75 Apple Gift Card with iPhone 12 or iPhone 12 mini purchase
Apple Canada is offering a free $75 Apple Gift Card with the purchase of an iPhone 12 or iPhone 12 mini through June 28, 2021. Additional savings are available with the trade-in of an eligible device…get $40-$735 off iPhone 12 when trading in an iPhone 7 or newer. Full details are available at

Read more »