1Password 7.9 Adds Secure Password Sharing
It’s a terrible idea to share passwords with colleagues in email, and the solution for years has been sites like One-Time Secret and 1ty.me that embed a password in a link that can be viewed only once. 1Password has finally gotten into the game, letting users securely share passwords from within the app.

Read more »

Apple’s new 140W USB-C Mac Power Adapter remains offensively huge
Apple's new 140W charger enables fast-charging up to 50% in a mere 30 minutes, but the charging brick that enables it is comically large (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

From Tensor to Live HDR+ Video, Google’s Pixel 6 Pro is going & taking after the iPhone 13 Pro
Compared to previous generations, Google is going after Apple (and Samsung) much more aggressively with the Pixel 6 and Pixel 6 Pro. Google this morning fully detailed the Pixel 6 and Pixel 6 after teasing key aspects several weeks ago. more… The post From Tensor to Live HDR+ Video, Google’s Pixel 6 Pro is going & taking after the iPhone 13 Pro appeared first on 9to5Mac.

Read more »

Compared: Google Pixel 6 Pro versus Apple iPhone 13 Pro Max
Google has launched a new lineup of high-end Pixel devices equipped with chips of its own design. Here's how the highest tier model, the Pixel 6 Pro, stacks up against Apple's iPhone 13 Pro Max.Credit: AppleInsiderWhile the Google Pixel 6 Pro comes in at a lower price point of $899, the device packs some premium features that bring it into competition with Apple's iPhone 13 Pro Max, which retails for $1,099. Here's what the two devices have in common, and how they differ as far as features, cameras, performance, and more. Read more...

Read more »

Apple dodges global supply chain woes with new MacBook Pro and AirPods launches
One day after unveiling all-new powerful MacBook Pro models and new third gen. AirPods, seemingly dodging global supply chain woes … The post appeared first on MacDailyNews.

Read more »

Latest Apple Arcade games for iPhone, Mac, Apple TV [New: NBA 2K22 Arcade Edition]
Apple Arcade launched with close to 100 titles and the service is seeing new games added regularly with over 200 games now in the library. Follow along with our guide on the latest from Apple’s gaming service. New for 10/19: The latest NBA 2K title has arrived on Apple Arcade. more… The post appeared first on 9to5Mac.

Read more »

Oops, some of Apple’s own apps don’t support new MacBook Pro screen notch
The just-launched MacBook Pro models are the first with a screen notch. And this apparently came as a surprise to many of Apple’s own software developers as some of its professional apps don’t support the screen cutouts. Which means they can’t fill the new displays and have to leave blank areas. This won’t make it […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iOS Allows You to Easily See Your Shazam History
Since iOS 14.2, we’ve been able to use Shazam right from the Control Center. This is courtesy of Apple purchasing the music discovery service and integrating it deeply into the mobile operating system. Not only can you use the feature to find out what song you’re listening to, but in iOS 15.1 you can also see your Shazam history. Wait, I Can Shazam From the Control Center? If you don’t already see the Shazam icon in your Control Center, it’s easy to add. Just follow these steps. Go to Settings. Choose Control Center. Scroll down until you see Music Recognition, then tap the green Plus sign to add the control. Now, when you want your iPhone to identify a song, just go to Control Center and tap the Shazam button. Get Your Shazam History from Control Center, Too Once that’s done, you can use the same button to access your Shazam search history. Just go back to Control Center, but this time tap and hold on the Shazam button. After a second, your search history will appear. If you tap on a song in the list, you can open it in the Shazam App Clip. If you have the full Shazam app installed, your song opens there, instead. Once you’ve opened the song in Shazam’s App Clip or full app, you’ll be able to view the lyrics or open it in Apple Music. It’s important to note that the displayed history only seems to include discoveries made from the Control Center icon. If you ask Siri to identify a song, it won’t be included in the search history. This may, of course, change in future versions of iOS.

Read more »

All the sounds and hardware used in the ‘Start Up’ song
Apple began its "Unleashed" event with a music video featuring A.G. Cook, and a host of famous sounds from Apple's history. Here's what was used - and which shot in the video was reversed. I thought this was a fun way to start the event.∞ Read this on The Loop

Read more »

Meryl Streep to head cast of Apple TV+ ‘Extrapolations’ climate change anthology
Apple TV+ has lined up a star-studded cast, including Meryl Streep and David Schwimmer, for a climate change anthology series… The post appeared first on MacDailyNews.

Read more »

Poll: What’s your favorite announcement from Apple’s ‘Unleashed’ event?
Apple held its “Unleashed” event yesterday. With a new Apple Music plan, new HomePod mini colors, redesigned AirPods 3, and new Macs with the powerful M1 Pro and M1 Max chips, what was your favorite announcement? more… The post appeared first on 9to5Mac.

Read more »

Apple TV+ anthology 'Extrapolations' adds Meryl Streep, Matthew Rhys
Apple TV+ added several new additions to the cast of "Extrapolations," including big names like Meryl Streep and Matthew Rhys.The eight-episode series will tell "intimate stories of how the upcoming changes to our planet will affect love, faith, work and family on a personal and human scale." The stories will be interwoven through the season and follow the "worldwide battle for our mutual survival spanning the 21st century."Nine actors in total have been added to the cast of the upcoming climate change anthology. The list includes Meryl Streep, Gemma Chan, Matthew Rhys, Sienna Miller, Kit Harrington, Tahar Rahim, Daveed Digs, David Schwimmer, and Adarsh Gourav, according to The Wrap. Read more...

Read more »

Comment: Why the worst thing about the MacBook Pro is good news for everyone
There’s a lot to love about Apple’s M1 Pro and M1 Max MacBook Pro. The return of ports, MagSafe charging, and even ProMotion are worthy upgrades before you even consider the performance gains and boosted battery life. We haven’t had the chance to test drive these notebooks yet, but it’s hard to imagine what could go wrong based on our experience with Apple’s standard M1 Macs. Based on what we know so far, it’s actually rather difficult to land a joke about these Macs. I would argue that’s an effective test for predicting the overall reception of this generation of MacBook Pro. more… The post appeared first on 9to5Mac.

Read more »

Keep your iPhone 13 charged for days with $20 off the MagSafe Battery Pack
The iPhone 13 and 13 Pro have incredible battery life, but we could always use a little more. That’s where Apple’s MagSafe Battery Pack comes in, adding an extra 1,460mAh to keep your iPhone powered on well into a second day and maybe even a third. And today, Amazon is selling the MagSafe Battery Pack […]

Read more »

Here’s how the new 14″ and 16″ MacBook Pro compare to other MacBook models
The highly anticipated MacBook Pro updates are officially here. Powered by the new M1 Pro and M1 Max Apple Silicon, the hardware features big CPU and GPU improvements, increased RAM, all-new displays, expanded I/O, and much more. Read on for an in-depth comparison of the 14 and 16″ new MacBook Pro vs the 13″ M1 and 16″ Intel machines. more… The post appeared first on 9to5Mac.

Read more »

Apple’s new MacBook Pro models have HDMI 2.0, not HDMI 2.1
Apple's newly announced 14- and 16-inch M1 Pro and M1 Max MacBook Pro models sport and SD card slot and an HDMI 2.0, not 2.1, port… The post appeared first on MacDailyNews.

Read more »

Apple TV+ “Snoopy in Space” season 2 trailer lifts off in search of life
Apple TV+ released its trailer on Tuesday for season two of it Daytime-Emmy-nominated series “Snoopy in Space.” After the first season’s visits to the moon and the International Space Station, Snoopy and the Peanuts gang get ready for a journey across the universe in search of life. Season 2 of “Snoopy in Space” premieres all […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

I got Sherlocked at Apple’s ‘Unleashed’ event!
Like most of you, I sat glued to my screen Monday during Apple’s “Unleashed” event. I was tickled to see the new MacBook Pros finally revealed — laptops that resurrect tons of useful ports, bring massive performance improvements, and benefit from great battery life (thanks in part to a slightly thicker design). Excited, I fumbled […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How to move data to a new MacBook Pro
Apple has a Migration Assistant app to help you move your data to a new MacBook Pro, except it isn't always smooth, isn't always easy — and isn't your only choice.Apple tries to make it easy to move your data to a new MacIf only Macs were as easy to transition between as iPhones. When you upgrade an iPhone, you put the new one next to the old and it practically transfers itself. Read more...

Read more »

Future iMacs Unleashed – TMO Daily Observations 2021-10-19
Dave Hamilton and Bryan Chaffin join host Kelly Guimont to discuss the Unleashed event and what new processors mean for iMacs and more.

Read more »

Apple Developer app updated with picture-in-picture, Accessibility improvements, more
Apple is rolling out a notable update to the Apple Developer application for iPhone, iPad, and Mac. Today’s update brings the app to version 9.3, and it includes accessibility improvements, sorting improvements, and system-wide picture-in-picture support. more… The post appeared first on 9to5Mac.

Read more »

Rewatch The ‘Unleashed’ Apple Event Unveiling New MacBook Pro Models
Between a new Apple Music subscription tier, new AirPods, and new MacBook Pro models, there was a lot to take in at the 'Unleased' Apple Event. You can watch it all back on YouTube or on the company's events page.

Read more »

Google launches Pixel 6, Pixel 6 Pro with Tensor processor
Google has launched its Pixel 6 and Pixel 6 Pro smartphones, complete with its self-designed "Tensor" chip and a 50-megapixel Octa PD Quad Bayer wide camera.Previously teased by the search giant during Google I/O and at the start of October, the event for the Pixel 6 and Pixel 6 Pro launch on Tuesday had Google providing firm details and specifications for its new smartphone lineup.The Pixel 6 sports a 6.4-inch display with a 1,080 by 2,340-resolution OLED panel, complete with a 20:9 aspect ratio and 411ppi pixel density. Protected by Corning Gorilla Glass Victus cover glass, the screen has a contrast ratio greater than 1,000,000:1, with HDR support, and 90Hz refresh rate. Read more...

Read more »

Bidding on super-rare Chaffey College Apple-1 computer starts at $200,000
As many Apple fans knows, the company’s first products was the Apple-1 personal computer, initially put together in a garage by Steve Wozniak and Steve Jobs in 1976. Now one unit in their early run of 200, known as the “Chaffey College Apple-1” because its first owner taught there, is going up for auction November […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Combat MacBook Pro Notch Envy With This App
One feature of the new MacBook Pros, unveiled at the 'Unleashed' event on Monday, that caused a bit of stir was...a notch! For those of us living a notchless existence, help is at hand. The developer behind Hourly and Solitainment, Chris Jones, aka imadethis, has a new product that adds the feature to your older device.

Read more »

The MacBook Pro May Not Get a Cellular Model Until 2024
For now, photographers and other people in the field will have to tether their MacBook Pro to their iPhone to actually upload their content. Apple's 5G laptop strategy right now is to tell you to buy an iPhone. The math is pretty simple: Qualcomm's modems, which Apple has a deal to use at least through 2022, are a big cost on Apple's ledger both financially and politically. Sure, Apple could price Qualcomm-packing laptops so it makes a profit, but the company doesn't want to be even more dependent on its longtime frenemy as a supplier.

Read more »

Apple’s branded Polishing Cloth costs $19
Apple new $19 Polishing Cloth is made of a soft, nonabrasive material and cleans any Apple display, including nano-texture glass, safely and… The post appeared first on MacDailyNews.

Read more »

Apple Goes Pro in Second Homegrown Silicon Salvo
Apple has announced new MacBook Pro models with the second generation of their in-house processors. The post appeared first on The Mac Security Blog.

Read more »

How to choose the right Mac for your use case
If you want to buy a new Mac, you have several options. This guide looks at the pros and cons of each type of Mac. The post appeared first on The Mac Security Blog.

Read more »

Apple Watch Series 7 Review: A Larger Display, but No Essential Changes
This minor upgrade to the Apple Watch will be a big upgrade for those with watches a few years old, but there's not enough difference with the Series 6 to recommend it. The post appeared first on The Mac Security Blog.

Read more »

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million, and vowed his administration would seek to prosecute and investigate the "hackers" and anyone who aided the publication in its "attempt to embarrass the state and sell headlines for their news outlet."

Read more »

What the heck is Apple doing?? – Intego Mac Podcast Episode 209
Apple has released a security update for an actively exploited vulnerability, but only for iOS 15, not iOS 14? What are they doing? We also discuss how Apple sometimes offers security updates for older versions of macOS, but not always. The post appeared first on The Mac Security Blog.

Read more »

How Coinbase Phishers Steal One-Time Passwords
A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. It also shows that phishers are attempting to sign up for new Coinbase accounts by the millions as part of an effort to identify email addresses that are already associated with active accounts.

Read more »

How to Delete Your Social Media Accounts: Facebook, Instagram, YouTube, Twitter, and More
If you want to delete social media accounts, here's how to do it on the 10 most popular social media services. The post appeared first on The Mac Security Blog.

Read more »

Patch Tuesday, October 2021 Edition
Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited in active attacks. This month's Patch Tuesday also includes security fixes for the newly released Windows 11 operating system.

Read more »

Vulnerability Summary for the Week of October 4, 2021
Original release date: October 11, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 7.5 CVE-2021-41553 MISC aviatorscript_project -- aviatorscript AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL). 2021-10-02 7.5 CVE-2021-41862 MISC commonwl -- cwlviewer cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Untrusted Data vulnerability. Commit number f6066f09edb70033a2ce80200e9fa9e70a5c29de (dated 2021-09-30) contains a patch. There are no available workarounds aside from installing the patch. The SnakeYaml constructor, by default, allows any data to be parsed. To fix the issue the object needs to be created with a `SafeConstructor` object, as seen in the patch. 2021-10-01 7.5 CVE-2021-41110 MISC MISC CONFIRM corel -- pdf_fusion Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 9.3 CVE-2021-38096 MISC MISC corel -- pdf_fusion Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 9.3 CVE-2021-38097 MISC MISC corel -- photopaint_2020 CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38101. 2021-10-01 9.3 CVE-2021-38099 MISC MISC corel -- presentations_2020 IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 9.3 CVE-2021-38103 MISC MISC dell -- isilon_insightiq_firmware Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker to take complete control of InsightIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity. 2021-10-01 7.5 CVE-2021-36298 MISC galera -- galera_webtemplate Galera WebTemplate 1.0 is affected by a directory traversal vulnerability that could reveal information from /etc/passwd and /etc/shadow. 2021-10-01 7.5 CVE-2021-40960 MISC MISC getcomposer -- composer Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue. 2021-10-05 7.5 CVE-2021-41116 MISC CONFIRM hotel_and_lodge_booking_management_system_project -- hotel_and_lodge_booking_management_system Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details. 2021-10-01 7.5 CVE-2020-21012 MISC lodging_reservation_management_system_project -- lodging_reservation_management_system The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to bypass authentication. 2021-10-04 7.5 CVE-2021-41511 MISC MISC MISC online-shopping-system-advanced_project -- online-shopping-system-advanced An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input. 2021-10-01 7.5 CVE-2021-41649 MISC ptcl -- hg150-ub_firmware An issue in the administrator authentication panel of PTCL HG150-Ub v3.0 allows attackers to bypass authentication via modification of the cookie value and Response Path. 2021-10-04 7.5 CVE-2021-35296 MISC qnap -- qvr A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later 2021-10-01 7.5 CVE-2021-34352 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 3xlogic -- infinias_access_control An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and Prox card credentials. Also, an authorized user of one zone can send API requests to unlock electronic locks associated with zones they are unauthorized to have access to. They can also create new user logins for zones they were not authorized to access, including the root zone of the software. 2021-10-01 6.5 CVE-2021-41847 MISC MISC MISC 53kf -- 53kf Cross site scripting vulnerability in 53KF < 2.0.0.2 that allows for arbitrary code to be executed via crafted HTML statement inserted into chat window. 2021-10-04 4.3 CVE-2020-28119 MISC afian -- filerun Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs. 2021-10-05 4.3 CVE-2021-35503 MISC MISC afian -- filerun Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action. 2021-10-05 4.3 CVE-2021-35506 MISC MISC alfred-spotify-mini-player -- alfred_spotify_mini_player Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter. 2021-10-01 4.3 CVE-2021-40927 MISC MISC archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), XSS occurs in /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr because the data received as input from clients is re-included within the HTTP response returned by the application without adequate validation. In this way, if HTML code or client-side executable code (e.g., Javascript) is entered as input, the expected execution flow could be altered. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 4.3 CVE-2021-41555 MISC archibus -- web_central ** UNSUPPORTED WHEN ASSIGNED ** ARCHIBUS Web Central 21.3.3.815 (a version from 2014) does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw, /archibus/schema/ab-core/views/process-navigator/ab-my-user-profile.axvw. By not verifying the permissions for access to resources, it allows a potential attacker to view pages that are not allowed. Specifically, it was found that any authenticated user can reach the administrative console for user management by directly requesting access to the page via URL. This allows a malicious user to modify all users' profiles, to elevate any privileges to administrative ones, or to create or delete any type of user. It is also possible to modify the emails of other users, through a misconfiguration of the username parameter, on the user profile page. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020. 2021-10-05 6.5 CVE-2021-41554 MISC bosch -- rexroth_indramotion_mlc_l20_firmware The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL. 2021-10-04 4.3 CVE-2021-23856 CONFIRM canonical -- apport An information disclosure via path traversal was discovered in apport/hookutils.py function read_file(). This issue affects: apport 2.14.1 versions prior to 2.14.1-0ubuntu3.29+esm8; 2.20.1 versions prior to 2.20.1-0ubuntu2.30+esm2; 2.20.9 versions prior to 2.20.9-0ubuntu7.26; 2.20.11 versions prior to 2.20.11-0ubuntu27.20; 2.20.11 versions prior to 2.20.11-0ubuntu65.3; 2021-10-01 4.7 CVE-2021-3710 MISC MISC MISC MISC canonical -- multipass The Windows version of Multipass before 1.7.0 allowed any local process to connect to the localhost TCP control socket to perform mounts from the operating system to a guest, allowing for privilege escalation. 2021-10-01 4.6 CVE-2021-3626 MISC canonical -- multipass The MacOS version of Multipass, version 1.7.0, fixed in 1.7.2, accidentally installed the application directory with incorrect owner. 2021-10-01 4.6 CVE-2021-3747 MISC codesolz -- better_find_and_replace The Better Find and Replace WordPress plugin before 1.2.9 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue 2021-10-04 4.3 CVE-2021-24676 MISC coinmarketstats -- woo-altcoin-payment-gateway The Bitcoin / AltCoin Payment Gateway for WooCommerce WordPress plugin before 1.6.1 does not escape the 's' GET parameter before outputting back in the All Masking Rules page, leading to a Reflected Cross-Site Scripting issue 2021-10-04 4.3 CVE-2021-24679 MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter. 2021-10-01 4.3 CVE-2021-41463 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter. 2021-10-01 4.3 CVE-2021-41465 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter. 2021-10-01 4.3 CVE-2021-41464 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter. 2021-10-01 4.3 CVE-2021-41462 MISC MISC concrete5-legacy_project -- concrete5-legacy Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter. 2021-10-01 4.3 CVE-2021-41461 MISC MISC corel -- coreldraw_2020 CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file. 2021-10-02 4.3 CVE-2021-38107 MISC MISC corel -- coreldraw_2020 Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CDR file. 2021-10-02 4.3 CVE-2021-38109 MISC MISC corel -- pdf_fusion Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PDF file. 2021-10-01 6.8 CVE-2021-38098 MISC MISC corel -- photopaint_2020 Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. 2021-10-01 6.8 CVE-2021-38100 MISC MISC corel -- photopaint_2020 CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious CPT file. This is different from CVE-2021-38099. 2021-10-01 6.8 CVE-2021-38101 MISC MISC corel -- presentations_2020 IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38102. 2021-10-01 4.3 CVE-2021-38105 MISC MISC corel -- presentations_2020 IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 4.3 CVE-2021-38104 MISC MISC corel -- presentations_2020 UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. 2021-10-01 4.3 CVE-2021-38106 MISC MISC corel -- presentations_2020 IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious PPT file. This is different from CVE-2021-38105. 2021-10-01 4.3 CVE-2021-38102 MISC MISC corel -- wordperfect_2020 Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file. 2021-10-02 4.3 CVE-2021-38108 MISC MISC corel -- wordperfect_2020 Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious DOC file. 2021-10-01 6.8 CVE-2021-38110 MISC MISC dell -- enterprise_sonic_os Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACSRadius credentials stored to read sensitive information and use it in further attacks. 2021-10-01 4 CVE-2021-36309 MISC detector_project -- detector Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or HTML via the cid parameter. 2021-10-01 4.3 CVE-2021-40921 MISC docker -- command_line_interface Docker CLI is the command line interface for the docker container runtime. A bug was found in the Docker CLI where running `docker login my-private-registry.example.com` with a misconfigured configuration file (typically `~/.docker/config.json`) listing a `credsStore` or `credHelpers` that could not be executed would result in any provided credentials being sent to `registry-1.docker.io` rather than the intended private registry. This bug has been fixed in Docker CLI 20.10.9. Users should update to this version as soon as possible. For users unable to update ensure that any configured credsStore or credHelpers entries in the configuration file reference an installed credential helper that is executable and on the PATH. 2021-10-04 5 CVE-2021-41092 MISC CONFIRM ecommerce-codeigniter-bootstrap_project -- ecommerce-codeigniter-bootstrap Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter. 2021-10-01 4.3 CVE-2021-40975 MISC emlog -- emlog emlog v6.0.0 contains a SQL injection via /admin/comment.php. 2021-10-01 6.5 CVE-2020-21013 MISC emlog -- emlog emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php. 2021-10-01 5.5 CVE-2020-21014 MISC esri -- portal_for_arcgis There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker to impersonate another account. 2021-10-01 6.5 CVE-2021-29108 CONFIRM esri -- portal_for_arcgis A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-10-01 4.3 CVE-2021-29109 CONFIRM faveohelpdesk -- faveo Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter. 2021-10-01 4.3 CVE-2021-40925 MISC MISC getid3 -- getid3 Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter. 2021-10-01 4.3 CVE-2021-40926 MISC MISC gitlab -- gitlab The project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addresses 2021-10-05 4 CVE-2021-22258 CONFIRM MISC MISC gitlab -- gitlab A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. 2021-10-04 4 CVE-2021-22259 MISC CONFIRM gitlab -- gitlab In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation which may lead to unnecessary sensitive info disclosure. 2021-10-05 4 CVE-2021-39891 MISC CONFIRM gitlab -- gitlab In all versions of GitLab EE since version 14.1, due to an insecure direct object reference vulnerability, an endpoint may reveal the protected branch name to a malicious user who makes a crafted API call with the ID of the protected branch. 2021-10-05 4 CVE-2021-39889 MISC MISC CONFIRM gitlab -- gitlab Permissions rules were not applied while issues were moved between projects of the same group in GitLab versions starting with 10.6 and up to 14.1.7 allowing users to read confidential Epic references. 2021-10-05 4 CVE-2021-39886 MISC CONFIRM gitlab -- gitlab A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware. 2021-10-05 4 CVE-2021-39880 CONFIRM MISC MISC gitlab -- gitlab In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by an attacker making a crafted API call. 2021-10-05 4 CVE-2021-39870 MISC MISC CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. The route for /user.keys is not restricted on instances with public visibility disabled. This allows user enumeration on such instances. 2021-10-05 5 CVE-2021-22257 MISC CONFIRM gitlab -- gitlab Missing access control in GitLab version 13.10 and above with Jira Cloud integration enabled allows Jira users without administrative privileges to add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page 2021-10-05 5 CVE-2021-22262 CONFIRM MISC MISC gitlab -- gitlab A potential DOS vulnerability was discovered in GitLab starting with version 9.1 that allowed parsing files without authorisation. 2021-10-05 5 CVE-2021-39893 MISC CONFIRM gitlab -- gitlab An issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.4, all versions starting from 14.2 before 14.2.2. Under specialized conditions, an invited group member may continue to have access to a project even after the invited group, which the member was part of, is deleted. 2021-10-05 4.3 CVE-2021-22264 CONFIRM MISC glimmrtv -- flextv Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF parameter. 2021-10-01 4.3 CVE-2021-40928 MISC MISC google -- android In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-179289753 2021-10-06 4.6 CVE-2021-0692 MISC google -- android In the SELinux policy configured in system_app.te, there is a possible way for system_app to gain code execution in other processes due to an overly-permissive SELinux policy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-188554048 2021-10-06 4.6 CVE-2021-0691 MISC google -- android When extracting the incorrectly formatted avi file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion: Android-10Android ID: A-189392423 2021-10-06 6.8 CVE-2021-0636 MISC google -- android In ParsedIntentInfo of ParsedIntentInfo.java, there is a possible parcel serialization/deserialization mismatch due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-191055353 2021-10-06 4.6 CVE-2021-0685 MISC google -- android In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-179839665 2021-10-06 4.6 CVE-2021-0684 MISC google -- android When extracting the incorrectly formatted flv file, the memory is damaged, the playback interface shows that the video cannot be played, and the log is found to be crashed. This problem may lead to hacker malicious code attacks, resulting in the loss of user rights.Product: Androidversion:Android-10Android ID: A-189402477 2021-10-06 6.8 CVE-2021-0635 MISC google -- android In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-185398942 2021-10-06 4.6 CVE-2021-0683 MISC google -- android In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-182152757 2021-10-06 4.3 CVE-2021-0690 MISC google -- android In lockAllProfileTasks of RootWindowContainer.java, there is a possible way to access the work profile without the profile PIN, after logging in. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-177457096 2021-10-06 4.6 CVE-2021-0595 MISC google -- android In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180422108 2021-10-06 4.4 CVE-2021-0598 MISC google -- android In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-161149543 2021-10-06 4.4 CVE-2021-0688 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1008 in the nhmldmx_send_sample() function szXmlFrom parameter which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41459 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmx_nhml.c:1004 in the nhmldmx_send_sample() function szXmlTo parameter which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41456 MISC gpac -- mp4box There is a stack buffer overflow in MP4Box 1.1.0 at src/filters/dmx_nhml.c in nhmldmx_init_parsing which leads to a denial of service vulnerability. 2021-10-01 5 CVE-2021-41457 MISC grafana -- grafana Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey. Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss. This issue has been resolved in versions 8.1.6 and 7.5.11. If for some reason you cannot upgrade you can use a reverse proxy or similar to block access to the literal paths: /api/snapshots/:key, /api/snapshots-delete/:deleteKey, /dashboard/snapshot/:key, and /api/snapshots/:key. They have no normal function and can be disabled without side effects. 2021-10-05 6.8 CVE-2021-39226 MISC MISC CONFIRM MISC MLIST hkurl -- i-panel_administration_system A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button. 2021-10-04 4.3 CVE-2021-41878 MISC MISC ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to perform actions that they should not be able to access due to improper access controls. IBM X-Force ID: 202169. 2021-10-06 4 CVE-2021-29758 CONFIRM XF ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to download unauthorized files through the dashboard user interface. IBM X-Force ID: 202213. 2021-10-06 4 CVE-2021-29760 CONFIRM XF ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 6.1.1.0 could allow an authenticated user to obtain sensitive information from the dashboard that they should not have access to. IBM X-Force ID: 202265. 2021-10-06 4 CVE-2021-29761 CONFIRM XF jizhicms -- jizhicms JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie. 2021-10-01 4.3 CVE-2020-21228 MISC MISC MISC justwriting_project -- justwriting Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter. 2021-10-01 4.3 CVE-2021-41467 MISC MISC linux -- linux_kernel prealloc_elems_and_freelist in kernel/bpf/stackmap.c in the Linux kernel through 5.14.9 allows unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write. 2021-10-02 4.6 CVE-2021-41864 MISC MISC FEDORA maccms -- maccms A Cross-Site Request Forgery (CSRF) in the component admin.php/admin/type/info.html of Maccms 10 allows attackers to gain administrator privileges. 2021-10-04 6.8 CVE-2020-21386 MISC maccms -- maccms A cross-site scripting (XSS) vulnerability in the parameter type_en of Maccms 10 allows attackers to obtain the administrator cookie and escalate privileges via a crafted payload. 2021-10-04 4.3 CVE-2020-21387 MISC mcafee -- drive_encryption Privilege Escalation vulnerability in a Windows system driver of McAfee Drive Encryption (DE) prior to 7.3.0 could allow a local non-admin user to gain elevated system privileges via exploiting an unutilized memory buffer. 2021-10-01 4.6 CVE-2021-23893 CONFIRM meowapps -- media_file_renamer_-_auto_&_manual_rename Cross-Site Request Forgery (CSRF) vulnerability in WordPress Media File Renamer – Auto & Manual Rename plugin (versions

Read more »

The Complete Guide to Apple MagSafe Chargers, Cases, and Accessories
Apple's MagSafe technology provides a great way to charge your iPhone, but also some interesting accessories. The post appeared first on The Mac Security Blog.

Read more »

iPad mini 6, Facebook’s Time-Out, and a Contactless iPhone Rip-Off – Intego Mac Podcast Episode 208
Facebook's downtime shows how risky it is to use social media services to log into other services. An interesting proof of concept can steal money from Visa cards on iPhones. And we discuss the new iPad mini 6, and the Apple Watch 7 that goes on sale Friday. The post appeared first on The Mac Security Blog.

Read more »

MacPrices.net launches new Apple 14″ MacBook Pro Price Tracker
Apple introduced the new 14″ M1 MacBook Pros yesterday with an updated design, new 10- to 32-Core M1 Pro and M1 Max CPUs, magic keyboards, edge-to-edge displays, and more. Apple and its resellers are starting to accept preorders on these new MacBook Pros today, and as a result, we have launched a new 14″ MacBook Pro Price Tracker tracking the latest prices, sales, and deals […] The post first appeared on MacPrices.net.

Read more »

Base 21″ 2.3GHz iMac on sale for $990, plus take $30 off AppleCare+
Expercom has the base 21″ 2.3GHz Dual-Core Intel-based iMac on sale for $990.85 shipped. Their price is $109 off Apple’s MSRP, and it’s the cheapest price for a new iMac from any Apple reseller. You must be signed into Expercom’s website, using a free account, to see the discounted price. Expercom has AppleCare+ Plans available for $30 off MSRP, $139, as an optional extra. Delivery […] The post first appeared on MacPrices.net.

Read more »

On sale again: MagSafe Chargers for up to $25% off MSRP at Verizon
Verizon has Apple MagSafe Chargers and Apple’s MagSafe Battery on sale again for up to 25% off MSRP. Verizon service is not required to take advantage of these savings. With the discount, Verizon’s sale prices are among the lowest prices anywhere for MagSafe gear: – MagSafe Charger: $29.99, regularly $39 – MagSafe Duo Charger: $96.74, regularly $129 – MagSafe Battery: $74.24, regularly $99 Shipping is […] The post first appeared on MacPrices.net.

Read more »

Expercom is offering 14″ and 16″ M1 MacBook Pro preorder discounts ranging up to $305 off MSRP
Apple reseller Expercom is offering discounts on new M1 Pro and M1 Max 14″ and 16″ MacBook Pros ranging up to $305 off Apple’s MSRP. Preorders start today. Order now, and Expercom estimates free shipping in as little as three weeks for these new models. At the moment, Expercom’s prices are the lowest available from any Apple reseller. – 14″ M1 Pro/M1 Max MacBook Pros: […] The post first appeared on MacPrices.net.

Read more »

Expercom offers $50 AppleCare+ discount when purchased alongside new 14″ or 16″ M1 MacBook Pros
Apple reseller Expercom is offering a $50 discount on the purchase of an AppleCare+ Plan alongside a new 2021 14″ MacBook Pro or 16″ MacBook Pro with an Apple M1 Pro or M1 Max CPU. Their discount reduces the price of an AppleCare+ Plan for 14″ M1 MacBook Pros to $229 and new 16″ M1 MacBook Pros to $349. Expercom is currently offering preorders of […] The post first appeared on MacPrices.net.

Read more »

Expercom offers $50 AppleCare+ discount when purchased alongside new 14″ or 16″ M1 MacBook Pros
Apple reseller Expercom is offering a $50 discount on the purchase of an AppleCare+ Plan alongside a new 2021 14″ MacBook Pro or 16″ MacBook Pro with an Apple M1 Pro or M1 Max CPU. Their discount reduces the price of an AppleCare+ Plan for 14″ M1 MacBook Pros to $229 and new 16″ M1 MacBook Pros to $349. Expercom is currently offering preorders of […] The post first appeared on MacPrices.net.

Read more »

Apple drops prices on Certified Refurbished 16-inch MacBook Pros with models now available starting at only $1949
With the introduction of the 2021 M1 Pro and M1 Max 16″ MacBook Pros, Apple has dropped prices on Certified Refurbished 2020 16″ 6-Core & 8-Core MacBook Pros, with models now available for up to $510 off original MSRP. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently […] The post first appeared on MacPrices.net.

Read more »

Apple to introduce new Macs today, perhaps more
Apple is widely anticipated to introduce several new Macs at their special fall event today. Watch their presentation here, at 10am PT. We’re expecting new MacBooks and maybe some new desktops. It’s also possible that Apple releases updated accessories, such as AirPods. After the presentation, come back here and check out prices for the new Macs as well as discounts on previous-generation models. We’ll have […] The post first appeared on MacPrices.net.

Read more »

Apple to introduce new Macs today, perhaps more
Apple is widely anticipated to introduce several new Macs at their special fall event today. Watch their presentation here, at 10am PT. We’re expecting new MacBooks and maybe some new desktops. It’s also possible that Apple releases updated accessories, such as AirPods. After the presentation, come back here and check out prices for the new Macs as well as discounts on previous-generation models. We’ll have […] The post first appeared on MacPrices.net.

Read more »

Are The Days Upon Us When Apple (Inc., Not The Fruit) Keeps The Doctor Away?
FEATURE: 10.16.21 – Don’t be surprised if at your next doctor’s appointment, your physician tells you to take two AirPods and call them in the morning. Back in June — in a story from Macworld magazine — the publication reported on a new concept in healthcare from Apple that would create an AppleCare-like service for diagnosing and repairing (as it were) our ailments. According to […] The post first appeared on MacPrices.net.

Read more »

In stock today: Clearance 2020 13″ MacBook Airs starting at only $719 at Apple, Certified Refurbished
Apple has clearance, Certified Refurbished, 2020 13″ Intel-based MacBook Airs in stock today starting at only $719 and up to $370 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air […] The post first appeared on MacPrices.net.

Read more »

In stock: Clearance 2020 7.9″ iPad mini 5 models at Apple starting at $339, Certified Refurbished
Apple has Certified Refurbished 2020 7.9″ WiFi iPad mini 5 models in stock for up to $80 off original MSRP, starting at only $339. Each iPad comes with Apple’s standard one-year warranty and includes a new outer case. Shipping is free. Apple’s prices are the cheapest available for these models anywhere: – 7.9″ 64GB WiFi iPad mini: $339 $60 off MSRP – 7.9″ 256GB WiFi […] The post first appeared on MacPrices.net.

Read more »