Zuckerberg thinks Apple is making aggressive moves now to control the metaverse
Meta CEO Mark Zuckerberg sat down for an hour-long discussion and held court on Facebook's future, the new Meta Quest Pro — and the moves Apple is making that have hurt his company.The Meta Quest Pro, in simulated useAn interview with Meta CEO Mark Zuckerberg was held in the shadow of the release of the $1499 Meta Quest Pro, the company's first mixed reality headset intended for enterprise and professionals. The hour-long discussion ranged far, with the social media giant's CEO opining on a wide array of topics — including Apple. Read more...

Read more »

USB-C iPhones will offer some benefits, but don’t expect crazy charging speeds
Next-gen iPhones are expected to move from Lightning to USB-C which will offer some benefits, but don't expect a big leap in charging speeds… The post appeared first on MacDailyNews.

Read more »

Fake Joe Rogan interviews fake Steve Jobs in an AI-powered podcast
Voice synthesis PR stunt calls upon the dead to help sell an AI product.

Read more »

87% of American teens own an iPhone; 88% expect an iPhone to be their next phone
Piper Sandler finds that 87% of American teens own an iPhone and 88% expect an iPhone to be their next phone… The post appeared first on MacDailyNews.

Read more »

Mythic Quest season 3 trailer sets up battle of deeply dysfunctional game companies
Mythic Quest season three is just weeks away, and Apple TV+ ramped up fan excitement on Tuesday with a trailer for the new season. The new episodes will pit the gaming company newly formed by Ian and Poppy against David and Mythic Quest. Watch the trailer now. Mythic Quest season 3: The struggle is real Mythic […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Sonnet Echo Dual NVMe Dock review: Port extension & storage for your desktop Mac
The Sonnet Echo Dual NVMe Thunderbolt Dock promises fast storage and expanded connectivity for your Mac, but a lack of enough power to the host computer pares down the overall utility a bit.Sonnet's Echo Dual NVMe DockThunderbolt 3 is great, but most modern Macs just don't have enough ports, and that's aggravated on the lower-end of the product line. And, if your Mac is at the center of your desk because of aesthetics, cables snaking in five different directions looks cluttered. Read more...

Read more »

Twitter might be about to ruin how users interact with hashtags
Hashtags are everywhere these days. But when it comes to Twitter, they’re an essential part of how the social network functions. However, it seems that Twitter has been considering changing how users interact with hashtags – and that might ruin them. more… The post appeared first on 9to5Mac.

Read more »

What Does SOS in the iPhone Status Bar Mean?
What does it mean when SOS appears in your iPhone’s status bar? (Hint: it’s not an iPhone cry for help.) Adam Engst explains this new status indicator in iOS 16.

Read more »

Prime Day has nothing on this Microsoft Office and finance training bundle
The job market can be daunting, but when equipped with the proper tools, there’s room to progress in your career confidently and find a professional fit. Regardless of your age or experience, new lessons and fresh insights always exist. For those seeking the next step on their professional path, this Microsoft Office Professional 2021 and […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How to edit a Strong Password in iOS 16
The Strong Password that Apple offers you in iOS 16 when creating an account is intended to be secure, but can also be hard to remember or type on other devices. Here's how to edit those passwords when they are offered to you."With iCloud Keychain, your passwords and credit card information are securely stored and available on all your devices, so navigating password-protected sites or auto-filling during transactions is simple and secure," Apple said when unveiling the feature.Here is how to understand what a Strong Password does, how to edit them, and how to turn off and on AutoFill Passwords if you want to. Read more...

Read more »

Bose busts out compact, affordable new soundbar with AirPlay 2
Bose took a further step into the compact, affordable soundbar market Monday with release of its new Smart Soundbar 600. It looks set to compete in a growing pool of home-theater audio products that don’t break the bank. Featuring Dolby Atmos, Bose “TrueSpace” and AirPlay 2 technology, the slender speaker goes for $499, Bose said. […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

‘Peanuts’ Halloween, Thanksgiving, and Christmas specials will be available on Apple TV+ to non-subscribers free for a limited time
Apple TV+ offers a lineup of new special episodes of Apple Original series and the streaming debut of classic holiday Peanuts specials… The post appeared first on MacDailyNews.

Read more »

TP-Link's new Wi-Fi 6E mesh router uses 6GHz bands for speed
TP-Link has announced a quad-band Wi-Fi 6E router and a tri-band AI-powered mesh networking system that can cover up to 6,500 square feet.Left: Archer router. Right: Deco mesh systemAnnounced on Tuesday, TP-Link's latest networking devices are the Wi-Fi 6E Archer AXE16000 quad-band router and Deco AXE11000 tri-band Wi-Fi system. Both systems offer fast speeds, wide network coverage, and a lot of bandwidth. Read more...

Read more »

Holiday Peanuts specials will not air on PBS this year, streaming exclusively on Apple TV+ alongside new festive originals
Apple’s overall deal with WildBrain sees Apple TV+ as the exclusive streaming destination for all things Snoopy and Peanuts, including archive classics and wholly new specials and series. For the last two years, Apple allowed PBS to air the iconic Halloween, Thanksgiving and Christmas Peanuts specials. This year, they are Apple exclusive however. Apple will stream them for free for everyone — no subscription needed — for a limited time (dates below). The service is also premiering brand new holiday specials and original movies for the festive season … more… The post appeared first on 9to5Mac.

Read more »

Apple in October: New MacBook Pro, iPad Pro, and more expected
Even though 2022 is quickly coming to an end, there are still some other announcements we expect from Apple before then. While it’s unlikely that Apple will hold another special event in October, it can still make announcements via press releases. This month, we’re expecting updates to the MacBook Pro, new iPad hardware, and more. more… The post appeared first on 9to5Mac.

Read more »

The new AirPods Pro are already $25 off for Prime Day
Apple’s 2nd-generation AirPods Pro earbuds have only been on the market for a few weeks, but they’re already on sale for Amazon’s Prime Early Access Sale. Amazon is selling the 2nd-generation AirPods Pro for $224, a savings of $25 and the lowest price we’ve ever seen. The 2nd-generation AirPods Pro look nearly identical to the original model, but they’re been dramatically improved on the inside. Battery life is longer (6 hours vs 4.5 hours), noise cancelation is better, they include Apple’s new Adaptive Transparency feature that only blocks loud sounds, and the audio quality has been significantly improved. You’ll also get a new charging case that has a speaker and a lanyard loop, and can be charged with an Apple Watch charger.  In our 4.5-star review, we called the AirPods Pro “the best choice for those who use Apple products.” So go grab a pair and treat your ears to something special Headphones

Read more »

Apple TV+ Brings New Christmas Special With Jony Ive as Executive Producer
It seems Jony Ive and Apple TV+ are strangely teaming up. Apple Original Films has announced a new animated short, The Boy, the Mole, The Fox and the Horse, which is based on the titular story by author and illustrator Charlie Mackesy. The short film stars Tom Hollander, Idris Elba, Gabriel Byrne and Jude Coward Nicoll. The films premieres on Apple TV+, Christmas Day. Most surprisingly, former Apple employee Jony Ive is making an appearance as an executive producer. Apple TV+ Brings Christmas Special Featuring Jony Ive as Executive Producer The new short film, The Boy, the Mole, the Fox and the Horse, is not only based on the best-selling book by Mackesy, but will also feature the illustrations of Mackesy in full color with hand-drawn animation. The short film stars Tom Hollander (The Night Manager) as The Mole, Idris Elba (Luther) as The Fox, Gabriel Byrne (All Things Bright and Beautiful) as The Horse, and Jude Coward Nicoll as The Boy. Apple TV+ is presenting the film alongside the BBC. According to an Apple TV+ press release, A story of kindness, friendship, courage and hope for viewers of all ages in a heartwarming, classically animated film based on Charlie Mackesy’s book, “The Boy, the Mole, the Fox and the Horse.” The poignant and heartfelt journey follows the unlikely friendship of a boy, a mole, a fox and a horse travelling together in the boy’s search for home. While Matthew Freud is presenting the story, Cara Speller and J.J. Abrams are set to produce. Peter Baynton is set to direct, but most interestingly, Jony Ive and Woody Harrelson are set to executive produce. What makes Ive surprising to see is that he went separate ways from Apple in 2019. However, while Ive no longer was an employee for Apple, Ive continued to work with Cupertino through his design firm LoveFrom. Though, even this relationship severed back in July of this year.  The Boy, the Mole, the Fox and the Horse will begin streaming on Apple TV+ Christmas Day. What are you watching on Apple TV+ right now? Let us know in the comments.

Read more »

Old and dying AirPods: 7 options for replacing, selling, and recycling
AirPods launched back in 2016 with AirPods Pro arriving in 2019. If you have had first or second-gen AirPods or first-gen AirPods Pro for several years, the batteries are probably wearing out. Let’s look at a range of options for what to do with dying old AirPods including replacing, selling, and recycling. more… The post appeared first on 9to5Mac.

Read more »

A Tale of Two Quarters and Bumble-ing into Bantr
Mac shipments are up, according to one analysis. Oh, but wait, they're really down, according to another. Apple's squishing more bugs, another Apple TV+ series is blurring the lines between reality and fiction, and yet another entry in the streaming service's catalog. All of that and more, from today's viewpoint on the Observation Deck. A Tale of Two Quarters IDC: Mac Shipments Soar as Remainder of Computers Slip Early in the day on Monday, IDC hit with computer numbers that looked absolutely amazing for Apple. Late in the evening on Monday, Gartner hit with numbers that looked as bad for Apple as every other computer maker out there.  Last quarter was a bad quarter for laptops, notebooks, and computers of all sorts according to market tracker IDC — the Mac not included. CNET had the firm reporting sliding computer sales. According to IDC, the September-quarter saw global computer shipments slip to 74.3-million machines. That was a little bit better than the June-quarter, but nowhere near as good as the same quarter a year earlier. Shipments for the third quarter of 2022 were down 15% versus the third quarter of 2021, according to IDC.  I know what you’re thinking: Economic uncertainty, right? That might be part of the problem. The CNET piece lists a couple factors for the fall: Lower demand and problems in the supply chain. Another piece on the numbers from Cult of Mac says the supply chain issues were tied to a wave of COVID lockdowns implemented in China in late spring and early summer of this year. As for the slower demand, while today’s economic uncertainty may play a part, the PC space was also up against a really tough compare. “Shipments reached their highest volume in almost a decade in 2021,” according to the CNET report.  The Good News, According to IDC Let us get to the good news, as far as Apple is concerned — at least according to one firm. IDC says sales of Apple computers were way up year-on-year. According to the firm, the Cupertino-company saw Mac shipments rise 40.2% in the September-quarter, versus the same quarter a year earlier.  Just as the PC market’s fall was focused on a few factors, so was the Mac’s rise. Cult of Mac says the recently released MacBook Air played a part. Additionally, Apple was able to spend the September-quarter catching up to demand that had built after the COVID lockdowns in the supply chain in China earlier in the year.  Going through IDC’s numbers, the Cult says “Apple shipped 10.1 million Macs in the September-quarter…” That was way up from the 4.7 million machines it shipped in the June-quarter, and way up from the 7.2-million shipped in the September-quarter of 2021. Of the top-five computer makers tracked, IDC says only Apple was able to show growth last quarter. Running down those five: Lenovo saw shipments drop 16.1% HP saw shipments drop 27.8% Dell saw shipments drop 21.2% Apple saw shipments rise 40.2% Asus saw shipments drop 7.8% The grey group of others fared no better. The “and the rest” crew saw shipments decline 19.4%, according to IDC.  Gartner: Apple Falls Just as Hard as Rest of PC Market Much, much later in the day on Monday — so late we call it “night” in most parts, IDC competitor Gartner hit with numbers that were largely inline with IDC’s with one major exception: That firm says Mac shipments fell about as hard last quarter as the rest of the personal computer space. It’s really pretty amazing. While IDC saw Mac shipments of 10.1 million units — up 40% year-on-year, Gartner saw shipments of 5.8-million units — down 15.6% from the same quarter a year earlier.  Otherwise, it’s kind of amazing how close they were. According to Gartner:  Lenovo shipments were down 15.3% HP shipments were down 27.9% Dell shipments were down 21.1% Apple shipments were down 15.6% Asus shipments were down 7.5% Acer shipments were down 25.6% “And the rest” were down 17.3% Seriously — the furthest off the two firms were besides the wild divergence on Apple was two percentage points on the “others” category and the surprise inclusion of Acer.  I first spotted the Gartner numbers on Philip Elmer-DeWitt’s Apple 3.0. There, he posed an interesting question:  Up 40% year over year in one estimate and down 15.6% in the other. Why do these guys have so much trouble with Apple — and only with Apple? Wouldn’t it be nice to know. Bug Busting Updates for iPhone and Apple Watch Apple hit with a couple of small but important OS updates on Monday. First, a piece from MacRumors says the Cupertino-crew let fly with iOS 16.0.3. Issues addressed include: A problem where iPhone 14 Pro and iPhone 14 Pro Max were not getting incoming call and app notifications in a timely fashion (or at all in some cases) A problem where the mic volume was too low on CarPlay calls on using one of the iPhone 14 models A problem where the Camera on Apple’s latest Pro phones was slow to launch or switch between modes An issue where a malformed email could make the Mail app go crashy-crash at launch The other OS update was for one of Apple’s wearables. A separate piece from MacRumors had Apple releasing watchOS 9.0.2 on Monday. Issues addressed with this one include: One where Spotify would not stream properly from the Spotify app for Apple Watch One where the Snooze alarm kept piping back up for AssistiveTouch users even after the alarm was deleted One where Fitness and Wallet data wasn’t syncing completely for a newly paired watch One where audio on the mic was working intermittently for some Apple Watch Ultra and Apple Watch Series 8 users Bumble Harnesses Power of ‘Ted Lasso’ for In-App “Bantr Live” Promotion The Apple TV+ smash Ted Lasso keeps blurring the line between AFC Richmond and reality. On his recent trip to the UK, Apple CEO Tim Cook was photographed in the stands of the fictitious football club cheering with some of the show’s actors (or characters, maybe). The club will be featured in FIFA 23, a football/soccer video game that features managers, coaches, players, and teams from the real world. And now, the series is part of a promotion for a dating app that parallels a story line from Ted Lasso season two.  TechCrunch says “Bumble, the women-focused dating app, has now partnered with ‘Ted Lasso’ to bring the experience of Bantr to its users.” “Bantr” was a fictitious app featured on Ted Lasso.  Promoted by one of the characters on the show, the app lets users chat and get to know each other but will not let them see pictures first. It led to a rather interesting relationship on the show (no spoilers). Now, TechCrunch says: …Bumble is launching a weekly “Bantr Live” experience, which mimics blind dating by having the user connect via chat without seeing what the potential match looks like. Olivia Yu, Global VP of Partnerships for Bumble, says this is a thing Bumle users have been asking for. The piece has her saying in a statement: The premise of Bantr is a dating experience many of our members have expressed interest in over the years. Bantr Live enables our community to connect with someone unexpectedly and learn more about a person before seeing them. We look forward to people on Bumble having fun with Bantr Live and connecting and dating in a new and exciting way… “Bantr Live” on Bumble starts this Thursday and runs every Thursday through the end of the year. I assume there’s more info in the Bumble app. “Also,” the piece says, “as part of the partnership, Bumble users can redeem a two-month subscription to Apple TV+.” Because — you know… what good’s a promotion without promotion? Apple TV+ Announces Trailer and Release Date for Selena Gomez Documentary And finally today, the start of November stands to be kind of heavy on Apple TV+. We heard last week that the Jennifer Lawrence/Brian Tyree Henry drama Causeway will release the first weekend of the month. Now, a piece from 9to5Mac says the Selena Gomez documentary, My Mind and Me, will premier on the same day. According to the report: The intimate documentary film follows Gomez over the last six years of her life, confronting her mental health challenges. Behind the scenes of her celebrity status, she battled with bipolar disorder and the skin condition lupus. Her lupus was treated with a course of chemotherapy. If you want to make a night of it, maybe send the kids to bed early. Both Causeway and the Gomez documentary are rated R. Both hit Apple TV+ on Friday 4 November. Trailers for both the drama and the documentary are available now on YouTube.

Read more »

KeyBanc: Apple’s iPhone revenue will top consensus on strong demand for Pro models
Sales of iPhone 14 Pro and iPhone 14 Pro Max will help boost the top line for Apple’s hardware products as the Cupertino Colossus… The post appeared first on MacDailyNews.

Read more »

Apple TV+ gains Skydance film 'The Gorge' starring Miles Teller
Genre-bending action and love story "The Gorge" is coming to Apple TV+ thanks to Apple's first-look partnership with Skydance.Apple TV+ to distribute 'The Gorge'Apple's production studio, Apple Original Films, has picked up the distribution rights to another of Skydance's upcoming feature films. "The Gorge" will be streamed on Apple TV+ once it releases. Read more...

Read more »

Quest Pro is Meta's new $1,499 mixed reality headset
Meta announced the Quest Pro virtual reality headset at its Meta Connect 2022 conference, with it aimed at enterprise and the professional market.Meta's Quest Pro headsetThe company will offer Quest Pro alongside its already-existing, and more affordable $399 Quest 2 device. Meta says that the new Quest Pro targets professionals and those in enterprise for whom a higher price tag may be justifiable. Read more...

Read more »

AI Generates ‘Interview’ Between Steve Jobs and Joe Rogan Thanks to New Podcast
A new Podcast has posted quite the fascinating interview, which features an AI conversation between “Steve Jobs” and “Joe Rogan”. While the technology is certainly phenomenal, users may be taken aback by the uncanniness of the interview. Podcast.ai Broadcasts Steve Jobs and Joe Rogan 'Interview' Made by AI The new Podcast, known as a Podcast.ai, is a weekly occurring series that uses artificial intelligence to generate topics and interviews to create podcasts. Within the first episode, Joe Rogan “interviews” Steve Jobs. According to Podcast.ai’s website, it implements Play.ht to generate the voices. According to 9to5Mac, Podcast.ai is able to generate transcripts using language models. Sources for 9to5Mac indicate that Podcast.ai chose Steve Jobs for the first interview because, We wanted to push the boundaries of what is possible in current state of the art speech synthesis, we wanted to create content that can inspire others to do the same, and there was no one who inspired and impacted the technology world more than Steve Jobs, that’s why in the first episode we brought his voice back to life. Listening to the podcast, it certainly sounds like Joe Rogan and Steve Jobs having a discussion. However, it sounds more like they are talking “at” each other, rather than “with” each other. In particular, Jobs sounds more like he is delivering a speech to an audience rather than having a conversation with Rogan. This likely due to how the website sourced the voice of Jobs. (You can really hear it in Jobs' line "Your audience is just so different from your normal Apple users, and that's a good thing!" at the 1:55 mark). Looking at Artificial Intelligence It’s an interesting, albeit creepy listen, and for Apple fans, it’s certainly worth checking out. As a listener, it couldn’t help but remind me of the time the band Crass did something somewhat similar, though for far more mischievous reasons. Known as “Thatchergate”, the Anarcho-Punk band Crass spliced together a phony conversation between Ronald Reagan and Margaret Thatcher, suggesting that Margaret Thatcher had allowed the attack of the HMS Sheffield to further escalate the Falklands War. At one point, Thatcher herself considered going on Television to declare the tape a hoax. According to CBC, both the CIA and MI6 spent months looking for those responsible for the tape. https://youtu.be/QmfLP1IOip8 While not entirely similar situations, it does bring to question the ethics of AI. While the podcast is obviously lighthearted and announces itself as a creation through AI, obviously not all content will be this obvious and straight forward. Of course, those that have been on the internet long enough know that almost anything they see should be taken with a grain of salt. For now, it’s fascinating and wonderful to watch AI evolve, though ‘how’ and ‘why’ are certainly questions that should often be discussed. You can listen to the full "interview" here. What do you think about the Steve Jobs/Joe Rogan “interview”? Who would you like to see on the show? Let us know in the comments.

Read more »

How to install macOS Ventura beta
If you don’t want to wait for the next version of macOS, macOS Ventura, which will be released to the public this autumn, it is possible to download the developer beta if you are a registered developer, and the public beta version for everyone else. In this article, we’ll run through what you need to do to get your hands on the beta of the next version of the Mac operating system, how to install it, and what you should bear in mind if you don’t want to end up in a pickle. Want to know more about macOS Ventura before you install? Read our guide to macOS Ventura’s release date and latest version. You may also be interested to read about how macOS Ventura compares to macOS Monterey. Updated 10/11/22: Apple has released macOS Ventura beta 11 to developers. The public beta will probably come within the next day or so. If you would prefer to wait for the full version of Ventura here’s how to update to macOS Ventura on your Mac. macOS Ventura beta release date The first version of the developer beta of Ventura arrived after the WWDC keynote on June 6, 2022. It is normal for Apple to release the first beta following the keynote so that developers can start work on testing their apps. The public beta was then released on July 11, 2022. The latest version of the macOS Ventura developer beta is version 11, it arrived on October 11, 2022.macOS Ventura beta 10 arrived on October 4, 2022.Who can get the macOS beta? Apple lets developers get their hands on beta versions of its operating system early so that they can make sure that their software works – and so they can use new tools in the next version of the macOS to enhance their own programs ready for launch when the final version of macOS is ready. But it’s not just developers who get an early look, though. Back at WWDC 2015 Apple announced that it was going to let members of the public test the upcoming new version of its Mac operating system as part of a free beta program. That means that anyone can get their hands on the new version of macOS before it is released to the general public later in the year. If you want to get the beta the first thing you need to do, if you haven’t already, is join Apple’s beta programs read this for more information: How to become an Apple beta tester. As we explained, there are two types of Apple beta program. One for developers who need to test their apps, and one for members of the public willing to test early versions of Apple’s software. If you want to be a public beta tester, you can sign up to join the Apple Beta Software Program here. There’s more information on signing up below in the article mentioned above. If you’re after the beta because you are an Apple Developer you need to go to enroll in the program here. We have more information on signing up in the ‘How to become an Apple beta tester’ article linked above. Public vs Developer preview – what’s the difference? The public beta is not the same as the beta being released through the developer program, developers tend to receive more frequent updates, including new features not in the public beta.  Is it safe to install the macOS beta? Before we start, a word of warning… By its nature, a beta has the potential to be unstable. Therefore it’s not advised that you install it on your Mac if you are relying on it. If you have a second Mac that isn’t mission-critical then install it there. We strongly recommend that you don’t risk all by making it your primary macOS, especially not in the early days of the beta development.  If you don’t have a second Mac there are a couple of ways you could run macOS beta on your Mac without running the risk of losing data or finding your Mac stops working: We recommend installing it on a partition – which these days is really a volume (and is so much easier to create than a partition was). Read about how to do that here: How to dual-boot Mac: Run two versions of macOS on a Mac.Alternatively, you could install the macOS beta on an external drive and run it on that.We discuss the safety of the macOS beta and the risks you might be taking in more detail in a separate article. You may prefer to wait until the final version is out, in which case read: How to update your Mac. How to prepare for the beta Apple gives clear instructions about how to prepare your Mac for the installation on the Enroll your Mac page. First Apple advises users to make a backup of their data and files before installing any beta versions of macOS, stating. You can find out how to use Time Machine to back up your Mac. We also have a round-up of suitable backup solutions. You’ll need to have the latest full version of macOS installed and we’d recommend at least 15GB of available space because the macOS betas tend to be very large. In fact last year a lot of people had problems installing macOS Big Sur because it required a lot of space to move things around. If you end up requiring more space read: How to free up space on Mac. Note that we always recommend that you have at least 10% space free on your Mac at any time, so if you don’t have that expect problems! How to get the macOS Ventura developer beta Here’s how to download and install a beta version of macOS on your Mac. If you haven’t yet registered as a developer you need to enroll in the program – here. Go to developer.apple.comClick on Account and log in.If you aren’t signed up for the Apple Developer program you can do so here: Click on Join the Apple Developer Program and then click on Enroll (top right). Then click on Start Your Enrolment. Enrolment in the Apple Developer Program costs $99.Once you are enrolled in the Developer Program, click on Discover > macOS > Download and sign in with your developer account or Apple ID.Click on Install Profile to download the new macOS Ventura Developer Beta Access Utility to your Mac.Go to Downloads on your Mac and click on the new macOS Developer Beta Access Utility to open it.Double click on the macOSDeveloperBetaAccessUtility.pkg and the installer will run.Once the new macOS beta is installed Software Update (in System Preferences) will check to see if there are any updates. Click Update and the latest version will download.You’ll see a prompt to install Ventura beta, click on Continue.Agree to the Ts&Cs (more on them below).Click Install.How to get the macOS beta if you aren’t a developer If you aren’t a developer you can intall the public beta. We recommend that you wait for the public beta, but, if you want to take your chances and download the macOS beta access utility from a third-party site this is likely to be possible. Doing so is a risky business, though. Read on for more information about getting hold of the macOS Developer Beta Access Utility. Last year after the Monterey beta launched various websites were offering the profile required to install the developer beta as a free download. For example, BetaInstaller.com offered the profiles required to download the macOS beta. You might also be able to get the iOS beta from one of these sites – again, we warn against it, but there is more information here. If you need another reminder of why it’s not a good idea to download the betas this way, here are a couple of reasons to steer clear: Apple does not support or control these sites and could decide to take legal action against these sites and their users.We cannot provide any guarantee that the content found on these sites is harmless. Downloading is very much at your own risk.We recommend that you become an official Public Beta tester. Find out how to become an Apple Beta Tester here. However, if you’re undeterred in your potentially dangerous mission, here’s what you need to do to install the macOS beta is you aren’t a developer: Open the website on your Mac and find the link to download the macOS beta profile (on betainstaller.com you’ll find the link here).Download the profile (you’ll need to confirm on your Mac that you want to allow the download).Open your Downloads folder and click on the macosDeveloperBetaAccessUtility.DMG file.Now click on the macosDeveloperBetaAccessUtility.pkg.A wizard will open indicating that it will guide you through the steps to install the software. Click Continue.Click Continue again and then Agree to the terms of the software license agreement.Now click Install.Enter your password and click on Install Software.When the installation of the profile is complete open System Preferences on your Mac. And click on Software Update. It will start to check for updates and eventually, you will see the message that MacOS Beta is there to download.Please note: Beta software is not yet final and may contain errors that lead to crashes or data loss. In addition, apps may stop working because they are not designed for the new macOS. Therefore, you should always back up your data before installing any beta software. How to get the macOS Ventura public beta Follow these steps to install the public beta of macOS. If you were already running an earlier macOS Public Beta you’ll find the new macOS beta as an upgrade via Software Update. Just click on Upgrade Now. You may have to update to the latest version of your current beta before you can do so. Before you install the beta make sure you back up your Mac – if you decide to stop using the beta you will need to revert to this backup version.Go to Apple’s beta webpage.Click on Sign In and enter your Apple ID and password (or Sign Up if you haven’t yet – in which case return to the section above for those steps).Click on Enrol Your Devices.Click on the macOS tab.You’ll have backed up your Mac, as we advised above, so now click on Download the macOS Public Beta Access Utility. The installer should open automatically, but if not, open the download in your Downloaded items folder, it’s called macOSPublicBetaAccessUtility.dmg. Double click on the dmg file. Go through the steps to install it, including signing in to the Feedback Assistant.Once you have downloaded the Beta Access Utility you will be able to download the beta via Software Update (which you can get to by clicking on the Apple logo).You will either see Software Update prompting you to download the Public Beta, or the Mac App Store will open on the macOS Beta Page. Click on Download and the public beta version will download. You’ll be able to continue to use your Mac while this takes place (it usually takes over half an hour for us).Once the beta has been downloaded you will see an invitation to install it. When you click to install, your Mac will shut down, so finish what you are doing as your Mac will be out of action for another half hour or so.Finally, your Mac will restart.Click on Continue.Sign in with your Apple ID and password.How to update macOS beta versions Once you are running the beta the updates will come through to your Mac automatically, you just need to click to install. You will receive a notification when the next update to the beta is available.Updates will be available via System Preferences > Software Update.Everything else you need to know about beta testing That covers how to get the betas, but once you have them what can you do, and what should you do? We’ll cover that below. How to send feedback to Apple Should you come across an error or a bug you should use the Feedback Assistant app to provide feedback to Apple. Launch the app and follow the appropriate steps, selecting the area about which you’re providing feedback and then any specific sub-area. Then describe your issue in a single sentence, before providing a more detailed description, including any specific steps that reproduce the issue. You’ll also be able to attach other files. You’ll also have to give permission for the Feedback Assistant app to collect diagnostic information from your Mac. It won’t always be obvious whether something is a bug or just not as easy to use as you might have hoped. Either way, if your feedback is that something appears to work in an illogical way, Apple will want to know that. If you are having trouble with a third-party app you can let Apple know by reporting it through the 3rd-party Application Compatibility category in the Feedback Assistant. However, we’d suggest that you also provide feedback to the app’s developer who will no doubt be grateful. Will I be able to update from macOS beta to the final version? Beta users will be able to install the final build of the OS on release day without needing to reformat or reinstall. Can I talk about the beta publicly? According to Apple and the license agreement all beta testers must agree to, the beta is “Apple confidential information”. By accepting those terms, you agree not to discuss your use of the software with anyone who isn’t also in the Beta Software Program. That means you can’t “blog, post screenshots, tweet, or publicly post information about the public beta software.” However, you can discuss any information that Apple has publicly disclosed; the company says that information is no longer considered confidential. How to downgrade from the macOS beta You can always revert to an earlier version of macOS, though depending on how you back up, it’s not necessarily a painless process. Start by making sure the data on your drive is backed up, then erase the drive and install the latest public version of macOS. When you first startup your Mac you can use the Migration Assistant to import your data from the backup. Here’s a more detailed tutorial on downgrading from the macOS beta we also have a tutorial on downgrading to an older version of the Mac OS. Personal Software

Read more »

Amazon’s Top Apple Deals During Prime Early Access Sale
Even though the holiday shopping season hasn’t officially started, Amazon’s second Prime Day event of the year has. Called the Amazon Prime Early Access Sale, it gives us the first chance to score big savings from a major retailer for holiday shopping. With that, we see even more discounts on Apple products and related gear. From the latest AirPods to MacBooks, here are Amazon’s top Apple deals for its Prime Early Access sale. MacBook Prices Slashed by Up to $400 Off To start off, Amazon has every model of its 2021 MacBook Pro heavily discounted. Whether you’re looking for a 14-inch or 16-inch MacBook Pro, you can get $400 off the regular price. 14-Inch MacBook Pro Savings 16-Inch MacBook Pro Models Discounted $400 If you’re looking for the most powerful MacBook Pro you can get your hands on right now, that would be this 10-core M1 Max 16-inch MacBook Pro. It offers 1TB of storage and is, you guessed it, $400 cheaper than usual. Deals on M1 and M2 MacBook Air Laptops It’s not just the MacBook Pro enjoying the discount. Amazon is also offering slashed prices on both the M1 and M2 MacBook Air models. M1 MacBook Air: $799, down from its regular retail price of $999. M2 MacBook Air, $150 off retail at $1,049. Amazon’s Prime Early Access Sale Discounts on iPad Tablets You can also score some hefty discounts on iPad tablets, as we’ve noted before. Whether you want an entry-level iPad or the latest iPad Air, there are savings to be had. $60 Off a 2021 iPad $80 Savings on 2022 M1 iPad Air Apple TV 4K, Apple Watch Series 8 and More Rounding things out, Amazon is offering discounted prices on Apple TV 4K, AirPods and even the just released Apple Watch Series 8. Lowest Apple TV 4K Price We’ve Seen in a While Amazon’s Prime Early Access Sale has us seeing the lowest price I may have ever seen on the Apple TV 4K. Taking $70 off the retail price, you can get yours for as low as $109. [Update: Amazon has slashed its price on the 64GB Apple TV even further. During Prime Early Access, pick one up for just $123.49, a 38% discount. Continued Discounted Apple Watch Series 8 Prices We reported several times that Amazon was already offering a discount on the Apple Watch Series 8. That discount continues this week on certain models. AirPods Pricing Slashed Finally, we’ve got Apple’s AirPods still seeing savings through Amazon. Prices begin at a $39 savings for the AirPods 2, bringing the accessory down to $89.99. Amazon also has the AirPods Pro 2 priced at $223.24, a $26 savings. If you'd rather enjoy your tunes through the Beats Fit Pro, Amazon's Prime Early Access Sale has those at 20% off, priced at just $159.95.

Read more »

9to5Mac Daily: October 11, 2022 – iOS 16.0.3 new features, iPadOS 16 release date
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by WaterMinder: WaterMinder is the ultimate water tracking tool that will help you stay hydrated during the day, with dedicated apps for iPhone, Apple Watch, and Mac.  more… The post appeared first on 9to5Mac.

Read more »

Apple Watch Activity Challenge set for Veterans Day, here are the exclusive stickers
Apple has set its next Apple Watch Activity Challenge for Veterans Day on November 11. If you complete this challenge, you can unlock exclusive stickers and GIFs that can be used in the Messages app ad during FaceTime calls. Head below to see them in action… more… The post appeared first on 9to5Mac.

Read more »

Ask Apple promises one-on-one coding help for developers
Ask Apple is a new way for iPhone and Mac developers to get support and feedback. It will include interactive question-and-answer sessions and one-on-one consultations. “If you’re a developer, you don’t want to miss out on Ask Apple,” says Greg Joswiak the company’s global head of marketing. ‘Ask Apple’ invites devs to bring their problems […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple seeds macOS 13 Ventura beta 11 to developers
Apple on Tuesday seeded macOS 13 Ventura beta 11 to developers for testing one week after Apple provided the tenth beta to developers… The post appeared first on MacDailyNews.

Read more »

Ad-Free Instagram Experience ‘OG App’ Removed From Google Play Store, Developers Determine Next Step
A new Instagram client, known as OG App, has seen removal from the Apple Store at the end of September due to issues using Meta’s Instagram API, and the new app has now seen removal from the Google Play Store. Offering an ad-free Instagram experience, the creators of the app, Un1feed, stated it is no longer able to provide services to their users due to the removal from both stores. OG App Sees Removal From Apple App Store, Now Google Play Store In a report from TechCrunch, Un1feed took to Twitter to announce that the OG App has seen removal from the Google Play Store. For the Apple App Store, the OG App made it only a couple of days before seeing removal from the Store. According to Apple, the OG App used Instagram’s API in a way that breaks both Meta’s and Apple’s TOS. On Twitter, the OG App account stated, Our goal with OG was to give users a glimpse of this within the current paradigm. However, following our removal from the Google Play Store and Apple App Store - OG will be unable to continue serving users through our mobile app. On the OG App’s official website, there is now a banner at the top of the page that states, “OG has been taken down from the App Store & Play Store. Click here to join the waitlist for iOS/Android/Windows/Mac”. According to TechCrunch, Meta has been going through several security mishaps, many of which we here at TMO have reported on as well. However, due to these issues, Meta has made the rules around using their API’s even more restrictive. Considering that the OG App was attempting to offer an ad-free Instagram experience, one may see why this night not gel well with Meta. However, many are still not happy with the current direction Meta is attempting to take Instagram. At the end of July, Instagram was host to a wave of criticism after making several changes that users thought were too obvious to TikTok. The largest feature that received criticism was a feature implementing an algorithm showing users more videos from accounts they do not follow. Concerning this change, Criticism arrived from Kylie Jenner, Kim Kardashian and even the Daily Show’s Trevor Noah. While Instagram’s CEO Adam Mosseri attempted to double-down on adding videos to Instagram, the company eventually relented. What do you think about the OG App seeing removal from both App Stores? Let us know in the comments.

Read more »

Microsoft Patch Tuesday, October 2022 Edition
Microsoft today released updates to fix at least 85 security holes in its Windows operating systems and related software, including a new zero-day vulnerability in all supported versions of Windows that is being actively exploited. However, noticeably absent from this month's Patch Tuesday are any updates to address a pair of zero-day flaws being exploited this past month in Microsoft Exchange Server.

Read more »

Vulnerability Summary for the Week of October 3, 2022
Original release date: October 11, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info actian -- psql If folder security is misconfigured for Actian Zen PSQL BEFORE Patch Update 1 for Zen 15 SP1 (v15.11.005), Patch Update 4 for Zen 15 (v15.01.017), or Patch Update 5 for Zen 14 SP2 (v14.21.022), it can allow an attacker (with file read/write access) to remove specific security files in order to reset the master password and gain access to the database. 2022-09-30 8.8 CVE-2022-40756 MISC MISC apache -- airflow In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API. 2022-10-07 8.1 CVE-2022-41672 CONFIRM CONFIRM apache -- commons_jxpath Those using JXPath to interpret untrusted XPath expressions may be vulnerable to a remote code execution attack. All JXPathContext class functions processing a XPath string are vulnerable except compile() and compilePath() function. The XPath expression can be used by an attacker to load any Java class from the classpath resulting in code execution. 2022-10-06 9.8 CVE-2022-41852 MISC arubanetworks -- instant There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS 6.5.x: 6.5.4.23 and below; Aruba InstantOS 8.6.x: 8.6.0.18 and below; Aruba InstantOS 8.7.x: 8.7.1.9 and below; Aruba InstantOS 8.10.x: 8.10.0.1 and below; ArubaOS 10.3.x: 10.3.1.0 and below; Aruba has released upgrades for Aruba InnstantOS that address these security vulnerabilities. 2022-10-06 9.8 CVE-2022-37888 MISC asus -- rt-ax56u_firmware A stack overflow vulnerability exists in the httpd service in ASUS RT-AX56U Router Version 3.0.0.4.386.44266. This vulnerability is caused by the strcat function called by "caupload" input handle function allowing the user to enter 0xFFFF bytes into the stack. This vulnerability allows an attacker to execute commands remotely. The vulnerability requires authentication. 2022-10-06 8.8 CVE-2021-40556 CONFIRM MISC autodesk -- autocad A maliciously crafted X_B, CATIA, and PDF file when parsed through Autodesk AutoCAD 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution. 2022-10-03 7.8 CVE-2022-33885 MISC autodesk -- autocad A maliciously crafted MODEL and SLDPRT file can be used to write beyond the allocated buffer while parsing through Autodesk AutoCAD 2023 and 2022. The vulnerability exists because the application fails to handle crafted MODEL and SLDPRT files, which causes an unhandled exception. An attacker can leverage this vulnerability to execute arbitrary code. 2022-10-03 7.8 CVE-2022-33886 MISC autodesk -- autocad A maliciously crafted PDF file when parsed through Autodesk AutoCAD 2023 causes an unhandled exception. An attacker can leverage this vulnerability to cause a crash or read sensitive data or execute arbitrary code in the context of the current process. 2022-10-03 7.8 CVE-2022-33887 MISC autodesk -- autocad A malicious crafted Dwg2Spd file when processed through Autodesk DWG application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2022-10-03 7.8 CVE-2022-33888 MISC autodesk -- autocad Parsing a maliciously crafted X_B file can force Autodesk AutoCAD 2023 and 2022 to read beyond allocated boundaries. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2022-10-03 7.5 CVE-2022-33884 MISC autodesk -- autodesk_desktop Under certain conditions, an attacker could create an unintended sphere of control through a vulnerability present in file delete operation in Autodesk desktop app (ADA). An attacker could leverage this vulnerability to escalate privileges and execute arbitrary code. 2022-10-03 9.8 CVE-2022-33882 MISC autodesk -- design_review A maliciously crafted GIF or JPEG files when parsed through Autodesk Design Review 2018, and AutoCAD 2023 and 2022 could be used to write beyond the allocated heap buffer. This vulnerability could lead to arbitrary code execution. 2022-10-03 7.8 CVE-2022-33889 MISC autodesk -- design_review A maliciously crafted PCT or DWF file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2022-10-03 7.8 CVE-2022-33890 MISC autodesk -- moldflow_synergy A malicious crafted file consumed through Moldflow Synergy, Moldflow Adviser, Moldflow Communicator, and Advanced Material Exchange applications could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2022-10-03 7.8 CVE-2022-33883 MISC autodesk -- subassembly_composer A maliciously crafted PKT file when consumed through SubassemblyComposer.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process. 2022-10-03 7.8 CVE-2022-41301 MISC axiosys -- bento4 Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBits function in mp4mux. 2022-10-03 8.8 CVE-2022-41428 MISC axiosys -- bento4 Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_Atom::TypeFromString function in mp4tag. 2022-10-03 8.8 CVE-2022-41429 MISC axiosys -- bento4 Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadBit function in mp4mux. 2022-10-03 8.8 CVE-2022-41430 MISC backdropcms -- backdrop_cms Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. 2022-10-07 7.2 CVE-2022-42092 MISC billing_system_project_project -- billing_system_project Billing System Project v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/createProduct.php. 2022-09-30 7.2 CVE-2022-41437 MISC billing_system_project_project -- billing_system_project Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php. 2022-09-30 7.2 CVE-2022-41439 MISC billing_system_project_project -- billing_system_project Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php. 2022-09-30 7.2 CVE-2022-41440 MISC bookingultrapro -- booking_ultra_pro_appointments_booking_calendar Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Booking Ultra Pro plugin Components - > DiscoTOC - > Check for Updates). Alternatively, admins can temporarily disable the DiscoTOC theme component. 2022-10-06 5.4 CVE-2022-39270 MISC CONFIRM dnnsoftware -- dotnetnuke Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. 2022-09-30 4.9 CVE-2022-2922 MISC CONFIRM donation_thermometer_project -- donation_thermometer The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) 2022-10-03 4.8 CVE-2022-3128 MISC dsgvo-for-wp -- dsgvo_all_in_one_for_wp The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) 2022-10-03 4.8 CVE-2022-2628 MISC goolytics_project -- goolytics The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. 2022-10-03 4.8 CVE-2022-3132 MISC heartex -- label_studio A Server Side Request Forgery (SSRF) in the Data Import module in Heartex - Label Studio Community Edition versions 1.5.0 and earlier allows an authenticated user to access arbitrary files on the system. Furthermore, self-registration is enabled by default in these versions of Label Studio enabling a remote attacker to create a new account and then exploit the SSRF. 2022-10-03 6.5 CVE-2022-36551 MISC MISC MISC ibm -- cics_tx IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437. 2022-10-07 5.5 CVE-2022-34308 CONFIRM XF CONFIRM ibm -- infosphere_information_server IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. 2022-10-07 6.5 CVE-2022-36772 XF CONFIRM ibm -- infosphere_information_server IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699. 2022-10-07 6.5 CVE-2022-41291 XF CONFIRM ibm -- qradar_security_information_and_event_manager IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366. 2022-10-07 5.5 CVE-2022-30613 XF CONFIRM ibm -- robotic_process_automation IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807. 2022-10-06 6.5 CVE-2022-41294 XF CONFIRM ibm -- robotic_process_automation IBM Robotic Process Automation 21.0.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 227125. 2022-10-06 6.1 CVE-2022-22503 XF CONFIRM ibm -- robotic_process_automation IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575. 2022-10-06 5.3 CVE-2022-36774 XF CONFIRM ibm -- robotic_process_automation_for_cloud_pak IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291. 2022-10-06 6.1 CVE-2022-38709 XF CONFIRM lief-project -- lief A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. 2022-10-03 6.5 CVE-2022-40922 MISC lief-project -- lief A vulnerability in the LIEF::MachO::SegmentCommand::virtual_address function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. 2022-09-30 6.5 CVE-2022-40923 MISC linux -- linux_kernel roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report- >value is in progress. 2022-09-30 4.7 CVE-2022-41850 MISC linux -- linux_kernel drivers/char/pcmcia/synclink_cs.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling ioctl, aka a race condition between mgslpc_ioctl and mgslpc_detach. 2022-09-30 4.2 CVE-2022-41848 MISC MISC linux -- linux_kernel drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect. 2022-09-30 4.2 CVE-2022-41849 MISC linuxfoundation -- dex Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances) are affected by this vulnerability if they are running a version prior to 2.35.0. An attacker can exploit this vulnerability by making a victim navigate to a malicious website and guiding them through the OIDC flow, stealing the OAuth authorization code in the process. The authorization code then can be exchanged by the attacker for a token, gaining access to applications accepting that token. Version 2.35.0 has introduced a fix for this issue. Users are advised to upgrade. There are no known workarounds for this issue. 2022-10-06 6.5 CVE-2022-39222 CONFIRM MISC mojoportal -- mojoportal mojoPortal v2.7 was discovered to contain a path traversal vulnerability via the "f" parameter at /DesignTools/CssEditor.aspx. This vulnerability allows authenticated attackers to read arbitrary files in the system. 2022-10-03 6.5 CVE-2022-40123 MISC MISC moodle -- moodle The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to. 2022-09-30 4.3 CVE-2022-40316 MISC MISC najeebmedia -- frontend_file_manager The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server 2022-10-03 5.3 CVE-2022-3124 MISC nasm -- netwide_assembler nasm v2.16 was discovered to contain a stack overflow in the Ndisasm component 2022-10-03 5.5 CVE-2022-41420 MISC octopus -- octopus_server In affected versions of Octopus Server it was identified that the same encryption process was used for both encrypting session cookies and variables. 2022-10-06 5.3 CVE-2022-2781 MISC octopus -- octopus_server In affected versions of Octopus Server it was identified that a session cookie could be used as the CSRF token 2022-10-06 5.3 CVE-2022-2783 MISC online_diagnostic_lab_management_system_project -- online_diagnostic_lab_management_system Two cross-site scripting vulnerabilities were fixed in Bodhi 5.6.1. 2022-10-07 6.1 CVE-2020-15855 MISC orchardcore -- orchardcore In OrchardCore rc1-11259 to v1.2.2 vulnerable to HTML injection, allow an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. 2022-10-03 5.4 CVE-2022-32173 MISC MISC pfsense -- pfsense pfSense v2.5.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the browser.php component. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name. 2022-10-03 6.1 CVE-2022-42247 MISC MISC pingidentity -- pingcentral PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information. 2022-09-30 4.9 CVE-2022-23726 MISC CONFIRM pulsesecure -- pulse_connect_secure Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. 2022-09-30 5.4 CVE-2022-21826 MISC pyup -- dependency_parser Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticated user may not be allowed to access. This vulnerability can be used to expose the following information: Estimating database row counts from tables with a sequential primary key or Exposing staff user and customer email addresses and full name through the `assignNavigation()` mutation. This issue has been patched in main and backported to multiple releases (3.7.17, 3.6.18, 3.5.23, 3.4.24, 3.3.26, 3.2.14, 3.1.24). Users are advised to upgrade. There are no known workarounds for this issue. 2022-10-06 4.3 CVE-2022-39275 CONFIRM MISC quizandsurveymaster -- quiz_and_survey_master Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin 4.4.3, ISC DHCP 4.1-ESV-R1 - > 4.1-ESV-R16-P1 a system with access to a DHCP server, sending DHCP packets crafted to include fqdn labels longer than 63 bytes, could eventually cause the server to run out of memory. 2022-10-07 not yet calculated CVE-2022-2929 CONFIRM johnson_controls -- metasys_adx_server   On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI. 2022-10-07 not yet calculated CVE-2022-21936 CERT CONFIRM liferay -- liferay_portal An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and pages. 2022-10-07 not yet calculated CVE-2022-41414 MISC linux -- kernel A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the component IPv4 Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-210357 was assigned to this vulnerability. 2022-10-08 not yet calculated CVE-2022-3435 N/A N/A mediatek -- cpu_dvfs In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07139405; Issue ID: ALPS07139405. 2022-10-07 not yet calculated CVE-2022-32592 MISC mediatek -- ims In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319095; Issue ID: ALPS07319095. 2022-10-07 not yet calculated CVE-2022-26472 MISC mediatek -- isp In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262305; Issue ID: ALPS07262305. 2022-10-07 not yet calculated CVE-2022-26452 MISC mediatek -- ril   In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07257259; Issue ID: ALPS07257259. 2022-10-07 not yet calculated CVE-2022-32591 MISC mediatek -- sensorhub In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07129717; Issue ID: ALPS07129717. 2022-10-07 not yet calculated CVE-2022-26474 MISC mediatek -- telephony In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07319121; Issue ID: ALPS07319121. 2022-10-07 not yet calculated CVE-2022-26471 MISC mediatek -- vdec_fmt In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342197; Issue ID: ALPS07342197. 2022-10-07 not yet calculated CVE-2022-26473 MISC mediatek -- vowe   In vowe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07138493; Issue ID: ALPS07138493. 2022-10-07 not yet calculated CVE-2022-32593 MISC mediatek -- wi-fi_driver   In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07030600; Issue ID: ALPS07030600. 2022-10-07 not yet calculated CVE-2022-32589 MISC mediatek -- wlan In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07310743; Issue ID: ALPS07310743. 2022-10-07 not yet calculated CVE-2022-26475 MISC mediatek -- wlan   In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425; Issue ID: ALPS07299425. 2022-10-07 not yet calculated CVE-2022-32590 MISC nps -- nps NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters. 2022-10-06 not yet calculated CVE-2022-40494 MISC MISC online_leave_management_system -- online_leave_management_system An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. 2022-10-07 not yet calculated CVE-2022-41379 MISC panini -- panini_everest_engine  Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%PaniniEverest EngineEverestEngine.exe and therefore a Trojan horse %PROGRAMDATA%PaniniEverest.exe may be executed instead of the intended vendor-supplied EverestEngine.exe file. 2022-10-07 not yet calculated CVE-2022-39959 MISC MISC perforce -- puppet Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise. 2022-10-07 not yet calculated CVE-2022-3276 MISC perforce -- puppet   Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise. 2022-10-07 not yet calculated CVE-2022-3275 MISC picuploader -- picuploader PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php. 2022-10-07 not yet calculated CVE-2022-41442 MISC MISC samsung -- cocktailbarservice Improper access control vulnerability in CocktailBarService prior to SMR Oct-2022 Release 1 allows local attacker to bind service that require BIND_REMOTEVIEWS permission. 2022-10-07 not yet calculated CVE-2022-39851 MISC samsung -- dynamic_lockscreen Improper authorization in Dynamic Lockscreen prior to SMR Sep-2022 Release 1 in Android R(11) and 3.3.03.66 in Android S(12) allows unauthorized use of javascript interface api. 2022-10-07 not yet calculated CVE-2022-39862 MISC samsung -- facm Improper access control vulnerability in FACM application prior to SMR Oct-2022 Release 1 allows a local attacker to connect arbitrary AP and Bluetooth devices. 2022-10-07 not yet calculated CVE-2022-39855 MISC samsung -- factorycamera Unprotected Receiver in AtBroadcastReceiver in FactoryCamera prior to version 3.5.51 allows attackers to record video without camera privilege. 2022-10-07 not yet calculated CVE-2022-39861 MISC samsung -- libagifencoder.quram.so_library A heap-based overflow vulnerability in makeContactAGIF in libagifencoder.quram.so library prior to SMR Oct-2022 Release 1 allows attacker to perform code execution. 2022-10-07 not yet calculated CVE-2022-39852 MISC samsung -- mobile Use after free vulnerability in set_nft_pid and signal_handler function of NFC driver prior to SMR Oct-2022 Release 1 allows attackers to perform malicious actions. 2022-10-07 not yet calculated CVE-2022-39847 MISC samsung -- mousenkeyhiddevice Improper restriction of broadcasting Intent in MouseNKeyHidDevice prior to SMR Oct-2022 Release 1 leaks MAC address of the connected Bluetooth device. 2022-10-07 not yet calculated CVE-2022-36868 MISC samsung -- perf-mgr_driver A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault. 2022-10-07 not yet calculated CVE-2022-39853 MISC samsung -- quickshare Improper access control vulnerability in QuickShare prior to version 13.2.3.5 allows attackers to access sensitive information via implicit broadcast. 2022-10-07 not yet calculated CVE-2022-39860 MISC samsung -- samsung_account Intent redirection vulnerability in Samsung Account prior to version 13.5.01.3 allows attackers to access content providers without permission. 2022-10-07 not yet calculated CVE-2022-39863 MISC samsung -- samsung_account Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. 2022-10-07 not yet calculated CVE-2022-39874 MISC samsung -- samsung_account Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. 2022-10-07 not yet calculated CVE-2022-39875 MISC samsung -- samsung_checkout Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast. 2022-10-07 not yet calculated CVE-2022-39878 MISC samsung -- sharelive Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. 2022-10-07 not yet calculated CVE-2022-39872 MISC samsung -- smartthings Improper access control vulnerability in WifiSetupLaunchHelper in SmartThings prior to version 1.7.89.25 allows attackers to access sensitive information via implicit intent. 2022-10-07 not yet calculated CVE-2022-39864 MISC samsung -- smartthings Improper access control vulnerability in ContentsSharingActivity.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast. 2022-10-07 not yet calculated CVE-2022-39865 MISC samsung -- smartthings Improper access control vulnerability in RegisteredEventMediator.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast. 2022-10-07 not yet calculated CVE-2022-39866 MISC samsung -- smartthings Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via SHOW_PERSISTENT_BANNER broadcast. 2022-10-07 not yet calculated CVE-2022-39867 MISC samsung -- smartthings Improper access control vulnerability in GedSamsungAccount.kt SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcast. 2022-10-07 not yet calculated CVE-2022-39868 MISC samsung -- smartthings Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via REMOVE_PERSISTENT_BANNER broadcast. 2022-10-07 not yet calculated CVE-2022-39869 MISC samsung -- smartthings Improper access control vulnerability in cloudNotificationManager.java SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via PUSH_MESSAGE_RECEIVED broadcast. 2022-10-07 not yet calculated CVE-2022-39870 MISC samsung -- smartthings Improper access control vulnerability cloudNotificationManager.java in SmartThings prior to version 1.7.89.0 allows attackers to access sensitive information via implicit broadcasts. 2022-10-07 not yet calculated CVE-2022-39871 MISC samsung -- sreminder Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. 2022-10-07 not yet calculated CVE-2022-39876 MISC sourcecodester -- student_clearance_system   A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been rated as problematic. Affected by this issue is the function prepare of the file /Admin/add-student.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210356. 2022-10-08 not yet calculated CVE-2022-3434 N/A N/A tiny-csrf -- tiny-csrf   tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were transmitted in the clear. This issue has been addressed in commit `8eead6d` and the patch with be included in version 1.1.0. Users are advised to upgrade. There are no known workarounds for this issue. 2022-10-07 not yet calculated CVE-2022-39287 CONFIRM MISC totaljs -- totaljs A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website name text field under Main Settings. 2022-10-07 not yet calculated CVE-2022-41392 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function 2022-10-06 not yet calculated CVE-2022-41517 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. 2022-10-06 not yet calculated CVE-2022-41518 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function. 2022-10-06 not yet calculated CVE-2022-41520 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function. 2022-10-06 not yet calculated CVE-2022-41521 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. 2022-10-06 not yet calculated CVE-2022-41522 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function. 2022-10-06 not yet calculated CVE-2022-41523 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function. 2022-10-06 not yet calculated CVE-2022-41524 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. 2022-10-06 not yet calculated CVE-2022-41525 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. 2022-10-06 not yet calculated CVE-2022-41526 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. 2022-10-06 not yet calculated CVE-2022-41527 MISC totolink -- totolink TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. 2022-10-06 not yet calculated CVE-2022-41528 MISC vmware -- multiple_products   The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server. 2022-10-07 not yet calculated CVE-2022-31680 MISC MISC vmware -- multiple_products   VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host. 2022-10-07 not yet calculated CVE-2022-31681 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 is vulnerable to has arbitrary code execution. 2022-10-07 not yet calculated CVE-2022-42075 MISC zkteco -- zkbiosecurity An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. 2022-10-07 not yet calculated CVE-2022-36634 MISC MISC MISC zkteco -- zkbiosecurity ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. 2022-10-07 not yet calculated CVE-2022-36635 MISC MISC MISC zoneminder -- zoneminder ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying the request supplied to the Zoneminder web application. These modifications include replacing HTTP POST with an HTTP GET and removing the CSRF key from the request. An attacker can take advantage of this by using an HTTP GET request to perform actions with no CSRF protection. This could allow an attacker to cause an authenticated user to perform unexpected actions on the web application. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. 2022-10-07 not yet calculated CVE-2022-39290 CONFIRM MISC zoneminder -- zoneminder   ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS) by backing out of the current "tr" "td" brackets. This then allows a malicious user to provide code that will execute when a user views the specific log on the "view=log" page. This vulnerability allows an attacker to store code within the logs that will be executed when loaded by a legitimate user. These actions will be performed with the permission of the victim. This could lead to data loss and/or further exploitation including account takeover. This issue has been addressed in versions `1.36.27` and `1.37.24`. Users are advised to upgrade. Users unable to upgrade should disable database logging. 2022-10-07 not yet calculated CVE-2022-39285 MISC MISC CONFIRM zoneminder -- zoneminder   ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as possible. Users unable to upgrade should disable database logging. 2022-10-07 not yet calculated CVE-2022-39289 MISC CONFIRM zoneminder -- zoneminder   ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows users with "View" system permissions to inject new data into the logs stored by Zoneminder. This was observed through an HTTP POST request containing log information to the "/zm/index.php" endpoint. Submission is not rate controlled and could affect database performance and/or consume all storage resources. Users are advised to upgrade. There are no known workarounds for this issue. 2022-10-07 not yet calculated CVE-2022-39291 MISC MISC MISC CONFIRM MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Report: Big U.S. Banks Are Stiffing Account Takeover Victims
When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation's largest banks, reimbursing account takeover victims has become more the exception than the rule.

Read more »

The EU Mandates USB-C Ports – Intego Mac Podcast Episode 260
The European Union is mandating a common charging port on portable electronic devices. Is forcing manufacturers to use USB-C a good thing, or are there downsides? The post appeared first on The Mac Security Blog.

Read more »

Glut of Fake LinkedIn Profiles Pits HR Against the Bots
A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities — which pair AI-generated profile photos with text lifted from legitimate accounts — are creating major headaches for corporate HR departments and for those managing invite-only LinkedIn groups.

Read more »

Vulnerability Summary for the Week of September 26, 2022
Original release date: October 3, 2022 | Last revised: October 5, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info acer -- altos_t110_f3 There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version FUN_0007db78 function with the request /goform/SetNetControlList/ 2022-09-23 7.2 CVE-2022-40861 MISC tenda -- ac18 Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set 2022-09-23 9.8 CVE-2022-40854 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40106 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formexeCommand function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40107 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40105 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function. 2022-09-23 9.8 CVE-2022-40100 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40102 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40101 MISC tenda -- i9 Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string. 2022-09-23 7.5 CVE-2022-40104 MISC tenda -- tx3 Tenda TX3 US_TX3V1.0br_V16.03.13.11 is vulnerable to stack overflow via compare_parentcontrol_time. 2022-09-28 9.8 CVE-2022-40942 MISC tenda -- w20e Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with request /goform/setDebugCfg/ 2022-09-23 9.8 CVE-2022-40866 MISC tenda -- w20e Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with the request /goform/delIpMacBind/ 2022-09-23 9.8 CVE-2022-40867 MISC tenda -- w20e Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the request /goform/delDhcpRules/ 2022-09-23 9.8 CVE-2022-40868 MISC tenda -- w20e Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows attackers to cause a Denial of Service (DoS) or Remote Code Execution (RCE) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters. 2022-09-23 9.8 CVE-2022-40855 MISC toaruos -- toaruos readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file. 2022-09-27 7.8 CVE-2022-38932 MISC tp-link -- archer_ax10_v1 TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file. 2022-09-28 8.8 CVE-2022-40486 MISC MISC MISC trendmicro -- deep_security A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2022-09-28 7.8 CVE-2022-40710 N/A N/A trudesk_project -- trudesk The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service. 2022-09-29 7.5 CVE-2022-1718 CONFIRM MISC ui -- desktop A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM. 2022-09-23 7.8 CVE-2022-35257 MISC vim -- vim Use After Free in GitHub repository vim/vim prior to 9.0.0614. 2022-09-29 7.8 CVE-2022-3352 CONFIRM MISC vim -- vim Use After Free in GitHub repository vim/vim prior to 9.0.0579. 2022-09-25 7.8 CVE-2022-3297 MISC CONFIRM vim -- vim Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. 2022-09-25 7.8 CVE-2022-3296 MISC CONFIRM vim -- vim Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598. 2022-09-27 7.8 CVE-2022-3324 CONFIRM MISC wayland -- wayland An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time. 2022-09-23 9.8 CVE-2021-3782 MISC wazuh -- wazuh Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint. 2022-09-28 8.8 CVE-2022-40497 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php. 2022-09-26 9.8 CVE-2022-40483 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php. 2022-09-26 9.8 CVE-2022-40485 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php. 2022-09-26 7.2 CVE-2022-40403 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php. 2022-09-26 9.8 CVE-2022-40484 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php. 2022-09-26 8.8 CVE-2022-40402 MISC wedding_planner -- wedding_planner Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php. 2022-09-26 8.8 CVE-2022-40404 MISC wordpress -- wordpress The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file 2022-09-26 8.8 CVE-2021-24890 MISC CONFIRM wordpress -- wordpress Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin

Read more »

Microsoft: Two New 0-Day Flaws in Exchange Server
Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.

Read more »

Fake CISO Profiles on LinkedIn Target Fortune 500s
Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.

Read more »

The Dangers of Expired Domains and Old Email Addresses – Intego Mac Podcast Episode 259
When domain names expire, anyone can take them over, and not only confuse people used to a company name, but also access any emails sent to that domain. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of September 19, 2022
Original release date: September 26, 2022 | Last revised: September 27, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no high vulnerabilities recorded this week. Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no medium vulnerabilities recorded this week. Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no low vulnerabilities recorded this week. Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 10-strike -- network_inventory_explorer 10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function. 2022-09-23 not yet calculated CVE-2022-38573 MISC MISC acer -- multiple_products There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit this vulnerability to escalate privilege from ring 3 to ring 0, and hijack control flow during UEFI DXE execution. This affects Altos T110 F3 firmware version

Read more »

Accused Russian RSOCKS Botmaster Arrested, Requests Extradition to U.S.
A 36-year-old Russian man recently identified by KrebsOnSecurity as the likely proprietor of the massive RSOCKS botnet has been arrested in Bulgaria at the request of U.S. authorities. At a court hearing in Bulgaria this month, the accused hacker requested and was granted extradition to the United States, reportedly telling the judge, "America is looking for me because I have enormous information and they need it."

Read more »

Buy a new Apple iPhone 14 or 13 at Visible, and get a free $300 Amazon Gift Card, Oct 11 and 12 only
To celebrate Amazon's Prime Early Access sale, Visible will include a free $300 Amazon Gift Card plus a free set of Beats Studio Buds with the purchase of a any new 2022 Apple iPhone 14 & a new line of service. The $300 gift card is also available with the purchase of an iPhone 13 or SE and will be made available to customers after 3 months of service. Free overnight delivery is available on all new phones. Offer is only available on October 11th and 12th. The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: 10.2-inch Apple iPads for $60 off MSRP, only $269
Amazon has Apple's 9th generation 10.2" 64GB WiFi iPads on sale for $269.99 shipped as part of their Prime Early Access Sale. This particular deal is exclusive to Prime members during the sale. Their price is $60 off Apple's MSRP, and it's the lowest price currently available for one of these iPads... The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: 13″ Apple M1 MacBook Airs for only $799
Amazon has Apple 13" M1 MacBook Airs on sale for $200 off MSRP as part of their Prime Early Access Sale, starting at only $799. Their prices are the lowest available for new MacBook Airs today. Stock may come and go, so check their site frequently. However, at the time of this post, all models were in stock with free shipping... The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: Apple TVs for up to $60 off MSRP
Amazon has 2nd generation 32GB and 64GB 4K Apple TVs with Siri remotes and 32GB Apple TV HDs on sale for $30-$60 off MSRP as part of their Prime Early Access Sale. Shipping is free: (1) 32GB 4K Apple TV: $149.99, $30 off, (2) 64GB 4K Apple TV: $169.99, $30 off, (3) 32GB HD Apple TV: $99, $60 off (34%). Their prices are the lowest available for these TVs among the retailers we track. For the latest prices and deals, see our Apple TV Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: Apple 12.9″ M1 iPad Pros for up to $500 off MSRP
Amazon has 12" iPad Pros with Apple M1 processors on sale for up to $500 off MSRP as part of their Prime Early Access Sale, each including free shipping. Their prices are the lowest available for new M1 12" iPad Pros among the Apple retailers we track... The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: Apple 11-inch iPad Pros for up to $250 off MSRP
Amazon has 11" iPad Pros with Apple M1 processors on sale for up to $250 off MSRP as part of their Prime Early Access Sale, each including free shipping. Their prices are the lowest available for new M1 11" iPad Pros from any Apple reseller. Note that some sale prices may be restricted to either Space Gray or Silver colors, depending on configuration. Most models are in stock today and ready to ship... The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: Apple Watch Series 8 GPS models for $50 off MSRP
Amazon has Apple Watch Series 8 GPS models on sale for $50 off MSRP as part of their Prime Early Access Sale, each including free shipping. Their prices are the lowest currently available for Series 8 GPS Watches: (1) 41mm Apple Watch Series 8 GPS (Midnight, Starlight, Silver, Red): $349, save $50, (2) 45mm Apple Watch Series 8 GPS (Midnight, Starlight, Silver, Red): $379, save $50. Note that their sale prices may be restricted to certain band colors, and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

Amazon Prime Early Access Sale: Apple 13″ M2 MacBook Airs for $100-$150 off MSRP
Amazon has 13" MacBook Airs with M2 CPUs in stock today and on sale for $100-$150 off MSRP as part of their Prime Early Access Sale. Shipping is free. They are the lowest prices available for these M2-powered MacBook Airs... The post first appeared on MacPrices.net.

Read more »

Clearance sale: 1st-generation Apple AirPods Pro available for $169, $80 off original MSRP
Amazon has clearance, first-generation, Apple AirPods Pro in stock and on sale today for $80 off original MSRP. Shipping is free: AirPods Pro (2021): $169.99 $80 off MSRP. Amazon's price is the lowest available anywhere for AirPods Pro. See our AirPods Price Tracker for the latest prices and deals from Apple and its resellers. The post first appeared on MacPrices.net.

Read more »

Apple has clearance previous-generation iPad Airs available starting at $469
Apple has Certified Refurbished 2020 10.9" WiFi iPad Airs available in their online store in a variety of configurations. Models start at $469 and range up to $150 off Apple's original MSRP. Each iPad Air comes with Apple's standard one-year warranty, features a new outer case, and is in like-new condition. These iPads might be the right thing for you if you're looking to save money on an iPad Air and don't need the M1 processor found in the '21 models. See Apple's site for the latest stock status... The post first appeared on MacPrices.net.

Read more »

Apple Studio Displays on sale for $100 off MSRP
Apple retailer Expercom has . Neither model is in stock today, but you can order at the discounted price, and Expercom will ship it for free once they receive stock (estimated 7-14 day wait): (1) Studio Display (Standard glass): $1499 $100 off MSRP, (2) Studio Display (Nano glass): $1799 $100 off MSRP. Their prices are the lowest available for Studio Displays among the retailers we track. For the latest prices and sales, see our Studio Display Price Tracker, updated daily. The post first appeared on MacPrices.net.

Read more »

16-inch MacBook Pros with Apple M1 Max CPUs on sale for $200-$400 off MSRP, plus get free 1-2 day shipping
B&H is offering a $200-$400 discount on 16" MacBook Pros with Apple M1 Max CPUs. They're all in stock today with free 1-2 day shipping to most US addresses. Their prices are among the lowest available for these configurations from any of the Apple retailers we track: (1) 16" MacBook Pro (10-Core M1 Max CPU/24-Core GPU/32GB RAM/512GB SSD): $2699 $400 off MSRP, (2) 16" MacBook Pro (10-Core M1 Max CPU/32-Core GPU/32GB RAM/512GB SSD): $2899 $400 off MSRP, (3) 16" MacBook Pro (10-Core M1 Max CPU/32-Core GPU/32GB RAM/1TB SSD): $3299 $200 off MSRP. The post first appeared on MacPrices.net.

Read more »