Apple’s 5G iPhone supercycle is big and long
Apple's fiscal Q321 (June quarter) report provided continuing evidence that its in the midst of a multi-year iPhone supercycle as the huge… The post appeared first on MacDailyNews.

Read more »

When is Apple releasing a new MacBook Pro, and should you buy now or wait?
Rumors have long suggested that Apple is working on a new MacBook Pro refresh with Apple Silicon on the inside, a new design, and much more. As rumors gain steam about a release later this year, many would-be MacBook Pro buyers are debating whether to buy now or wait. Here’s what we recommend. more… The post appeared first on 9to5Mac.

Read more »

LumaFusion brings video stabilization, external drive editing, more with version 3.0
The popular iPad video editor LumaFusion just got a major update with version 3.0. Keep reading to find everything new with the app, including video stabilization, external drive editing, and more. more… The post appeared first on 9to5Mac.

Read more »

OnePlus guns for AirPods Pro with new $149 ANC earbuds
OnePlus is rolling out another Apple-esque product at a lower price point — a new set of Buds Pro that improve on its original Buds with active noise cancellation (ANC) and some upgraded audio features. They look a lot like Airpods Pro, actually, except with silver stems rather than white ones. When the OnePlus Buds […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Tim Cook confirms employee return to Apple Park pushed to at least October
Apple employees won't be required to return to offices until at least October, says CEO Tim Cook.Apple return to work plan pushed to OctoberThe delta variant of COVID-19 has created a new wave of cases across the United States, so companies like Apple have pushed plans for a return to work back to October. The plan initially had employees returning in September, but health threats from the pandemic bring everything into question. Read more...

Read more »

Ted Lasso Scores Biggest Premiere Weekend on Apple TV+
The season two premiere of Ted Lasso scored the biggest opening weekend audience of any show on Apple TV+ since the service launched. While, naturally, we have no specific numbers, the company told Variety that the show’s performance over July 23-25 was bigger than any other previous launch. Ted Lasso Season Two Premiere Brings in Record Increase in New Users Apple also said that the breakout hit “increased its viewership by 6x over season one.” Just as important, it helped to “lift viewership and engagement” for that debut season, as well as for other Apple TV+ comedies such as Schmigadoon!, Physical, and Mythic Quest during that type period. Apple TV+ increased the number of new viewers by 50 percent week-over-week on the back of the premiere too, yet another record. [’Ted Lasso’ Season Two Special — Media+] The show is up for 20 Emmy's, with Apple TV+ as a whole receiving 35 nominations.

Read more »

Apple shows you how to take ‘otherworldly’ iPhone images
Explore some of the more exotic possibilities of your iPhone’s camera with a free tutorial from a professional photographer. An video Today at Apple session shows how to use Night Mode to take and edit “otherworldly” images. Get these free suggestions now: The expertise comes from Maria Lax, a Finnish photog based in London. ‘Otherworldly’ […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Facebook explores integrating Oculus workout data with Apple Health
According to code discovered in the Oculus iOS app, Facebook is exploring the idea of allowing users to synchronize workout data from Oculus… The post appeared first on MacDailyNews.

Read more »

How to add Amazon’s new ‘Ask Alexa’ widget to your iPhone’s Home screen
Amazon just rolled out a new update for its Alexa app that adds a much-anticipated Home screen widget for iPhone and iPad. You can use it to ask Alexa anything you like faster than ever before. Here’s how to set it up. With the Alexa widget on your Home screen, you can summon Amazon’s digital […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Tim Cook says Apple considering whether requiring employee vaccinations is ‘the right answer’
Following the breaking news that Google will require employees returning to its offices in October to get the COVID vaccine, Tim Cook has shared that the company is continuing to “monitor things daily” before deciding if that’s “the right answer or not.” more… The post appeared first on 9to5Mac.

Read more »

Apple releases fourth public beta of iOS 15, iPadOS 15, tvOS 15, watchOS 8, macOS Monterey
Apple has released the fourth beta of iOS 15, iPadOS 15, tvOS 15, watchOS 8, and macOS Monterey to members of its public software testing program.Safari in iPadOS 15 beta 4 has multiple display optionsThe fourth public betas should be essentially the same as the fourth developer betas, which Apple seeded on Tuesday. The builds can be acquired from the Apple Beta Software Program web portal. Read more...

Read more »

Apple releases minor watchOS 7.6.1 update with bug, security fixes
Apple has released watchOS 7.6.1, a minor update to the Apple Watch operating system that likely only contains bug fixes and security updates.Credit: Andrew O'Hara, AppleInsiderThe watchOS 7.6.1 update, released on Wednesday, comes a couple of days after Apple released iOS 14.7.1 and iPadOS 14.7.1. Those point releases included fixes related to an Apple Watch bug that prevented it being unlocked when connected to Touch ID devices. Read more...

Read more »

Earnings and Evolution – TMO Daily Observations 2021-07-28
Bryan Chaffin and Charlotte Henry join host Kelly Guimont to talk about Apple’s earnings report and how the landscape has changed.

Read more »

Apple releases new macOS Monterey build for public beta testers with Live Text for Intel Macs
Just one day after seeding the fourth macOS Monterey beta to developers, the latest build is now available for public beta testers. Apple at first said Universal Control was enabled in the release notes but then removed it. However, Apple has turned on Live Text support for Intel Macs in the new Monterey beta. more… The post appeared first on 9to5Mac.

Read more »

Apple supplier TSMC gets green light for 2nm chip production by 2024
Taiwan Semiconductor Manufacturing Co. (TSMC) has received final approval from the taiwanese government to build a 2nm chip plant… The post appeared first on MacDailyNews.

Read more »

Ukraine Authorities Seize Unencrypted Windscribe VPN Servers
VPN provider Windscribe said its servers were not encrypted, enabling authorities to create decoy servers and snoop on web traffic. The Ontario, Canada-based company said earlier this month that two servers hosted in Ukraine were seized as part of an investigation into activity that had occurred a year earlier. The servers, which ran the OpenVPN virtual private network software, were also configured to use a setting that was deprecated in 2018 after security research revealed vulnerabilities that could allow adversaries to decrypt data. Oh come on, VPN servers that weren’t encrypted?

Read more »

Apple releases new iOS 15 and iPadOS 15 public betas with latest Safari changes and more
One day after releasing it to developers, Apple today is releasing the latest iOS 15 beta for public beta testers. Apple refers to this as iOS 15 public beta 5and it includes a handful of notable changes, such as Safari design changes, new Podcasts widgets, and more.  more… The post appeared first on 9to5Mac.

Read more »

Totallee Offers Impressive 50% Off Sale for All Smartphone Cases
Starting today and valid until August 8 you can use the promo code MAKEROOM to get 50% off any product with totallee. 50% Sale Totallee is well known for its super-thin, branding-free smartphone cases for iPhones and Androids. Screen protectors are available for iPhones from iPhone 11 to iPhone 12 Pro Max. Some examples of iPhone cases include: iPhone 12 Pro matte case - US$39 iPhone 12 mini transparent case - US$39 iPhone SE matte case - US$39 The company also offers screen protectors and accessories like a UV phone sanitizer, wireless chargers, phone ring grip, and iPhone charging cables.

Read more »

Juuk’s new Ovollo band gives Apple Watch a smooth steel makeover
Bring smooth stainless steel to your Apple Watch with Juuk’s gorgeous new Ovollo band. Its mirror-polished finish helps make your smartwatch look like a dazzling fashion piece, and it’s available in a number of color options to suit your style. You can order yours now through the Cult of Mac Store. Juuk makes some of […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How to use Tab Groups in Safari on macOS Monterey
Apple may be changing its plans for tabs in Safari on macOS Monterey, but Tab Groups are something different — and they're staying.Once you've tried Tab Groups, you're never going backIf you're on the macOS Monterey beta, if you've been invited to AppleSeed, or if you've just been paying attention, you know that Safari is changing. Opinions differ over the new design for tabs, but enough people don't like it that Apple has been undoing some of those alterations. Read more...

Read more »

Today's top 5 Apple deals on Amazon
Apple's latest hardware is up to $200 off at Amazon today, with month-end deals going on now on AirPods Pro, the 2021 Apple TV 4K, MacBook hardware and the new M1 iPad Pro 12.9-inch.$999 12.9-inch iPad ProAmazon has the cheapest 12.9-inch iPad Pro price available today, with month-end savings knocking $100 off 128GB and 256GB Wi-Fi models. Read more...

Read more »

New Zens wireless charger powers iPhone 12 plus 3 devices
Zens launched a new all-in-one wireless charger station for four devices. It’s handy for juicing up your MagSafe-compatible iPhone. Plus you can add an Apple Watch, AirPods and one other gadget, all at once if needed. Zens wireless charger: Power up 4 devices at once The minimalist, aluminum Zens 4-in-1 Magnetic + Watch Wireless Charger, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Exploring Night Mode on iPhone
In a new video, Today at Apple creative Landon teams up with photographer Maria Lax to explore Night mode on iPhone. They shoot, experiment, and edit a host of interesting pictures in the clip.

Read more »

Twitter Shopping is a pilot project launching in the US, here’s how it’s going to work
Twitter is launching another feature to boost its platform with Twitter Shopping. Starting today, this pilot of the Shop Module is available for people in the US that use the platform in English on iOS devices. more… The post appeared first on 9to5Mac.

Read more »

Stacktrace Podcast 146: “Another straw on the back of the antitrust camel”
After an accidental deep dive into Git branching strategies and a discussion about app-wide data models, John and Rambo talk about the recent news that Netflix is getting into gaming, and what that could mean both content-wise and technically. Sponsored by Pillow: Pillow is an all-in-one sleep tracking solution to help you get a better night’s sleep. Download it from the App Store today. Download MP3 more… The post appeared first on 9to5Mac.

Read more »

Apple had yet another astonishing quarter, but its share price is drifting lower
It's another astonishing quarter in a string of them, but Apple's share price is nonetheless drifting lower in trading on Wednesday… The post appeared first on MacDailyNews.

Read more »

Should you put a keyboard cover on a MacBook Pro? [Setups]
When a computer setup is as clean and spare as Redditor whatsyourname’s, the eye tends to go to the most unusual item. In this case, it’s probably the colorful keyboard cover on the MacBook Pro, making it look like some other model of laptop. And, of course, what did commenters most want to talk about […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Twitter Tests New ‘Shop Module’ Feature for iOS Users
Twitter is piloting a new feature on Wednesday called Shop Module. It will let brands add a shopping section at the top of their profiles. The pilot is currently limited to iOS devices for people who use the service in English. The Shop Module is a dedicated space at the top of a profile where businesses can showcase their products. When people visit a profile with the Shop Module enabled, they can scroll through the carousel of products and tap through on a single product to learn more and purchase -- seamlessly in an in-app browser, without having to leave Twitter.

Read more »

Deals: Apple Watch deals from $170, Anker HomeKit cams $174 off, DJI OM 4 $129, more
We’ve made it halfway through the workweek, and all of today’s best deals have arrived headlined by this one-day Apple Watch sale from $170. That’s alongside being able to save as much as $174 on Anker eufyCam HomeKit systems and a rare discount on DJI’s OM 4 gimbal at $129. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more… The post appeared first on 9to5Mac.

Read more »

Step up home security with a Ring Video Doorbell Pro for under $100
You might not be getting a lot of visitors right now, but they’ll be back … one day. Maybe. And wouldn’t it be great if you could see who’s outside your home without even being there? Pick up a Ring Video Doorbell Pro for $40 less. Amazon is now offering certified refurbished units that look […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

PlugwalkJoe Does the Perp Walk
One day after last summer's mass-hack of Twitter, KrebsOnSecurity wrote that 22-year-old British citizen Joseph "PlugwalkJoe" O'Connor appeared to have been involved in the incident. When the Justice Department last week announced O'Connor's arrest and indictment, his alleged role in the Twitter compromise was well covered in the media. But most of the coverage so far seem to have overlooked the far more sinister criminal charges in the indictment, which involve an underground scene wherein young men turn to extortion, sextortion, SIM swapping, death threats and physical attacks -- all in a bid to seize control over highly-prized social media accounts.

Read more »

Pegasus Spyware Hacks iPhones of Prominent Individuals
Tens of thousands of phones are known to have been infected by Pegasus, spyware that can take control of a phone and its data. The post appeared first on The Mac Security Blog.

Read more »

Prepare for the End of 3G Networks – Intego Mac Podcast Episode 197
Apple has released security updates for all its operating systems. We discuss the new disclosures about Pegasus spyware, and Apple's response. And we look at what will happen when mobile phone carriers shut down their 3G networks; you may have 3G devices that you don't think about. And Josh has a new laptop; finally. The post appeared first on The Mac Security Blog.

Read more »

Apple releases iOS 14.7, watchOS 7.6, macOS 11.5, and more
Apple has released security updates for all of its operating systems this week. Here's what's new. The post appeared first on The Mac Security Blog.

Read more »

Serial Swatter Who Caused Death Gets Five Years in Prison
A 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that lead to the death of a 60-year-old grandfather in 2020 was sentenced to 60 months in prison today.

Read more »

Red Hat Security Advisory 2021-2813-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Issues addressed include a buffer overflow vulnerability.

Read more »

Spam Kingpin Peter Levashov Gets Time Served
A federal judge in Connecticut today handed down a sentence of time served to spam kingpin Peter “Severa” Levashov, a prolific purveyor of malicious and junk email, and the creator of malware strains that infected millions of Microsoft computers globally. Levashov has been in federal custody since his extradition to the United States and guilty plea in 2018, and was facing up to 12 more years in prison. Instead, he will go free under three years of supervised release and a possible fine.

Read more »

Don’t Wanna Pay Ransom Gangs? Test Your Backups.
Browse the comments on virtually any story about a ransomware attack and you will almost surely encounter the view that the victim organization could have avoided paying their extortionists if only they'd had proper data backups. But the ugly truth is there are many non-obvious reasons why victims end up paying even when they have done nearly everything right from a data backup perspective. 

Read more »

Vulnerability Summary for the Week of July 12, 2021
Original release date: July 19, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info echobh -- sharecare Echo ShareCare 8.15.5 is susceptible to SQL injection vulnerabilities when processing remote input from both authenticated and unauthenticated users, leading to the ability to bypass authentication, exfiltrate Structured Query Language (SQL) records, and manipulate data. 2021-07-13 7.5 CVE-2021-33578 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. It does not perform authentication or authorization checks when accessing a subset of sensitive resources, leading to the ability for unauthenticated users to access pages that are vulnerable to attacks such as SQL injection. 2021-07-13 7.5 CVE-2021-36124 MISC espruino -- espruino Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22884 MISC fortinet -- forticlient An improper symlink following in FortiClient for Mac 6.4.3 and below may allow an non-privileged user to execute arbitrary privileged shell commands during installation phase. 2021-07-12 7.2 CVE-2021-26089 CONFIRM fortinet -- fortimail A missing cryptographic step in the implementation of the hash digest algorithm in FortiMail 6.4.0 through 6.4.4, and 6.2.0 through 6.2.7 may allow an unauthenticated attacker to tamper with signed URLs by appending further data which allows bypass of signature verification. 2021-07-09 7.5 CVE-2021-24020 CONFIRM fortinet -- fortimail Multiple improper neutralization of special elements of SQL commands vulnerabilities in FortiMail before 6.4.4 may allow a non-authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests. 2021-07-09 7.5 CVE-2021-24007 CONFIRM golang -- go golang/go in 1.0.2 fixes all.bash on shared machines. dotest() in src/pkg/debug/gosym/pclntab_test.go creates a temporary file with predicable name and executes it as shell script. 2021-07-09 7.5 CVE-2012-2666 MISC MISC MISC MISC google -- android In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181346550 2021-07-14 7.8 CVE-2021-0596 MISC google -- android In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable PendingIntent. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-8.1 Android-9Android ID: A-154319182 2021-07-14 7.2 CVE-2020-0417 MISC google -- android In flv extractor, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-187161771 2021-07-14 7.2 CVE-2021-0577 MISC google -- android In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-167389063 2021-07-14 10 CVE-2021-0515 MISC google -- android In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-184963385 2021-07-14 7.2 CVE-2021-0585 MISC google -- android In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validation. This could lead to remote (proximal, NFC) escalation of privilege allowing an attacker to deceive a user into allowing a Bluetooth connection with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176445224 2021-07-14 7.9 CVE-2021-0594 MISC google -- android In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-185259758 2021-07-14 7.2 CVE-2021-0587 MISC google -- android In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-180939982 2021-07-14 7.2 CVE-2021-0589 MISC google -- android In various functions in WideVine, there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-188061006 2021-07-14 9.3 CVE-2021-0592 MISC google -- android In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-9 Android-11 Android-8.1Android ID: A-162604069 2021-07-14 9.3 CVE-2021-0514 MISC google -- android In onCreateOptionsMenu of WifiNetworkDetailsFragment.java, there is a possible way for guest users to view and modify Wi-Fi settings for all configured APs due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-177573895 2021-07-14 7.2 CVE-2021-0602 MISC halo -- halo Remote Code Executon vulnerability in Halo 0.4.3 via the remoteAddr and themeName parameters. 2021-07-12 7.5 CVE-2020-18980 MISC jsish -- jsish Integer overflow vulnerability in function Jsi_ObjSetLength in jsish before 3.0.6, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22875 MISC MISC jsish -- jsish Integer overflow vulnerability in function Jsi_ObjArraySizer in jsish before 3.0.8, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22874 MISC MISC jsish -- jsish Buffer overflow vulnerability in function NumberToPrecisionCmd in jsish before 3.0.7, allows remote attackers to execute arbitrary code. 2021-07-13 7.5 CVE-2020-22873 MISC kaseya -- vsa Kaseya VSA before 9.5.5 allows remote code execution. 2021-07-09 7.5 CVE-2021-30118 MISC kramerav -- viaware KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg. 2021-07-12 7.5 CVE-2021-35064 MISC linux -- linux_kernel An out-of-bounds memory write flaw was found in the Linux kernel's joystick devices subsystem in versions before 5.9-rc1, in the way the user calls ioctl JSIOCSBTNMAP. This flaw allows a local user to crash the system or possibly escalate their privileges on the system. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 2021-07-09 7.2 CVE-2021-3612 MISC MISC linuxptp_project -- linuxptp A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak, crash, or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1, before 2.0.1, before 1.9.3, before 1.8.1, before 1.7.1, before 1.6.1 and before 1.5.1. 2021-07-09 8 CVE-2021-3570 MISC DEBIAN FEDORA FEDORA metinfo -- metinfo SQL Injection vulnerability in Metinfo 7.0.0beta in index.php. 2021-07-12 7.5 CVE-2020-21132 MISC MISC metinfo -- metinfo SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid. 2021-07-12 7.5 CVE-2020-21133 MISC MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31196, CVE-2021-34473. 2021-07-14 7.5 CVE-2021-31206 MISC microsoft -- windows_10 Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31979, CVE-2021-34514. 2021-07-14 7.2 CVE-2021-33771 MISC microsoft -- windows_10 Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability 2021-07-14 7.5 CVE-2021-33757 MISC microsoft -- windows_10 Windows Secure Kernel Mode Security Feature Bypass Vulnerability 2021-07-14 7.2 CVE-2021-33744 MISC microsoft -- windows_10 Windows Kernel Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-33771, CVE-2021-34514. 2021-07-14 7.2 CVE-2021-31979 MISC microsoft -- windows_10 Windows Media Remote Code Execution Vulnerability 2021-07-14 9.3 CVE-2021-33740 MISC nextcloud -- nextcloud_server Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server supports application specific tokens for authentication purposes. These tokens are supposed to be granted to a specific applications (e.g. DAV sync clients), and can also be configured by the user to not have any filesystem access. Due to a lacking permission check, the tokens were able to change their own permissions in versions prior to 19.0.13, 20.0.11, and 21.0.3. Thus fileystem limited tokens were able to grant themselves access to the filesystem. The issue is patched in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds aside from upgrading. 2021-07-12 7.5 CVE-2021-32688 MISC CONFIRM MISC nextcloud -- nextcloud_server Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds. 2021-07-12 7.5 CVE-2021-32726 MISC MISC CONFIRM ninjateam -- filebird The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user. 2021-07-12 7.5 CVE-2021-24385 CONFIRM MISC putil-merge_project -- putil-merge Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution. 2021-07-14 7.5 CVE-2021-25953 MISC python -- pillow Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c. 2021-07-13 7.5 CVE-2021-34552 MISC MISC qualcomm -- apq8009w_firmware Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables 2021-07-13 10 CVE-2020-11307 CONFIRM qualcomm -- apq8017_firmware Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1890 CONFIRM qualcomm -- apq8017_firmware Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1886 CONFIRM qualcomm -- apq8017_firmware Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1889 CONFIRM qualcomm -- apq8017_firmware Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1888 CONFIRM qualcomm -- aqt1000_firmware Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music 2021-07-13 7.2 CVE-2021-1931 CONFIRM qualcomm -- aqt1000_firmware Use after free can occur due to improper handling of response from firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables 2021-07-13 7.2 CVE-2021-1940 CONFIRM qualcomm -- aqt1000_firmware Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking 2021-07-13 10 CVE-2021-1965 CONFIRM sap -- netweaver_as_abap A function module of SAP NetWeaver AS ABAP (Reconciliation Framework), versions - 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F, allows a high privileged attacker to inject code that can be executed by the application. An attacker could thereby delete some critical information and could make the SAP system completely unavailable. 2021-07-14 7.5 CVE-2021-33678 MISC MISC solarwinds -- dameware_mini_remote_control In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file deletion as SYSTEM. 2021-07-13 9.4 CVE-2021-31217 MISC MISC totaljs -- total.js The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. 2021-07-12 7.5 CVE-2021-23389 MISC MISC MISC totaljs -- total4 The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions. 2021-07-12 7.5 CVE-2021-23390 MISC MISC MISC wms_project -- wms SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php". 2021-07-12 7.5 CVE-2020-18544 MISC wpdevart -- poll,_survey,_questionnaire_and_voting_system The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks 2021-07-12 7.5 CVE-2021-24442 CONFIRM MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- ant When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected. 2021-07-14 4.3 CVE-2021-36373 MISC MISC MLIST MLIST MLIST apache -- ant When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected. 2021-07-14 4.3 CVE-2021-36374 MISC MISC MLIST MLIST MLIST apache -- tomcat Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding. 2021-07-12 5 CVE-2021-33037 MISC apache -- tomcat A vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64. 2021-07-12 5 CVE-2021-30639 MISC MLIST MLIST artifex -- mujs Buffer overflow vulnerability in function jsG_markobject in jsgc.c in mujs before 1.0.8, allows remote attackers to cause a denial of service. 2021-07-13 5 CVE-2020-22886 MISC artifex -- mujs Buffer overflow vulnerability in mujs before 1.0.8 due to recursion in the GC scanning phase, allows remote attackers to cause a denial of service. 2021-07-13 5 CVE-2020-22885 MISC autodesk -- design_review A maliciously crafted PDF, PICT or TIFF file can be used to write beyond the allocated buffer while parsing PDF, PICT or TIFF files in Autodesk 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27036 MISC autodesk -- design_review A maliciously crafted TIFF file in Autodesk 2018, 2017, 2013, 2012, 2011 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27039 MISC autodesk -- design_review A Type Confusion vulnerability in Autodesk 2018, 2017, 2013, 2012, 2011 can occur when processing a maliciously crafted PDF file. An attacker can leverage this to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27038 MISC autodesk -- design_review A maliciously crafted PNG, PDF or DWF file in Autodesk 2018, 2017, 2013, 2012, 2011 can be used to attempt to free an object that has already been freed while parsing them. This vulnerability can be exploited by remote attackers to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27037 MISC autodesk -- design_review A heap-based buffer overflow could occur while parsing PICT or TIFF files in Autodesk 2018, 2017, 2013, 2012, 2011. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27034 MISC autodesk -- design_review A maliciously crafted TIFF, PDF, PICT or DWF files in Autodesk 2018, 2017, 2013, 2012, 2011 can be forced to read beyond allocated boundaries when parsing the TIFF, PDF, PICT or DWF files. This vulnerability can be exploited to execute arbitrary code. 2021-07-09 6.8 CVE-2021-27035 MISC axiosys -- bento4 A buffer overflow vulnerability in Ap4ElstAtom.cpp of Bento 1.5.1-628 leads to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19719 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a direct copy to NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19722 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/AP4IkmsAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19720 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap4Atom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19718 MISC axiosys -- bento4 An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bento 1.5.1-628 causes a NULL pointer dereference, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19717 MISC axiosys -- bento4 A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac, leading to system crashes and a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19721 MISC baidu -- umeditor Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php. 2021-07-14 4.3 CVE-2020-18145 MISC bookingcore -- booking_core The “Subscribe” feature in Ultimate Booking System Booking Core 1.7.0 is vulnerable to CSV formula injection. The input containing the excel formula is not being sanitized by the application. As a result when admin in backend download and open the csv, content of the cells are executed. 2021-07-14 6.8 CVE-2020-25445 MISC bookingcore -- booking_core Cross Site Request Forgery (CSRF) vulnerability in Booking Core - Ultimate Booking System Booking Core 1.7.0 . The CSRF token is not being validated when the request is sent as a GET method. This results in an unauthorized change in the user's email ID, which can later be used to reset the password. The new password will be sent to a modified email ID. 2021-07-14 4.3 CVE-2020-27379 MISC brave -- brave In Brave Desktop between versions 1.17 and 1.26.60, when adblocking is enabled and a proxy browser extension is installed, the CNAME adblocking feature issues DNS requests that used the system DNS settings instead of the extension's proxy settings, resulting in possible information disclosure. 2021-07-12 4.3 CVE-2021-22916 MISC brave -- browser Brave Browser Desktop between versions 1.17 and 1.20 is vulnerable to information disclosure by way of DNS requests in Tor windows not flowing through Tor if adblocking was enabled. 2021-07-12 4.3 CVE-2021-22917 MISC codeblab -- glass The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. 2021-07-12 4.3 CVE-2021-24434 CONFIRM dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user. 2021-07-12 4.6 CVE-2021-21590 MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 do not exit on failed Initialization. A local authenticated Service user could potentially exploit this vulnerability to escalate privileges. 2021-07-12 4.6 CVE-2021-21589 MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user. 2021-07-12 4.6 CVE-2021-21591 MISC dell -- powerflex_presentation_server Dell EMC PowerFlex, v3.5.x contain a Cross-Site WebSocket Hijacking Vulnerability in the Presentation Server/WebUI. An unauthenticated attacker could potentially exploit this vulnerability by tricking the user into performing unwanted actions on the Presentation Server and perform which may lead to configuration changes. 2021-07-12 4.3 CVE-2021-21588 MISC delta_project -- delta dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory. 2021-07-13 4.4 CVE-2021-36376 CONFIRM MISC MISC devolutions -- devolutions_server Devolutions Server before 2021.1.18, and LTS before 2020.3.20, allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext). 2021-07-12 4.3 CVE-2021-36382 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The TextReader feature in General/TextReader/TextReader.cfm is susceptible to a local file inclusion vulnerability when processing remote input in the textFile parameter from an authenticated user, leading to the ability to read arbitrary files on the server filesystems as well any files accessible via Universal Naming Convention (UNC) paths. 2021-07-13 4 CVE-2021-36123 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParse_Sup/UnzipFile_Upd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject arbitrary arguments to 7z.exe. 2021-07-13 6.5 CVE-2021-36122 MISC echobh -- sharecare An issue was discovered in Echo ShareCare 8.15.5. The file-upload feature in Access/DownloadFeed_Mnt/FileUpload_Upd.cfm is susceptible to an unrestricted upload vulnerability via the name1 parameter, when processing remote input from an authenticated user, leading to the ability for arbitrary files to be written to arbitrary filesystem locations via ../ Directory Traversal on the Z: drive (a hard-coded drive letter where ShareCare application files reside) and remote code execution as the ShareCare service user (NT AUTHORITYSYSTEM). 2021-07-13 6.5 CVE-2021-36121 MISC edgexfoundry -- edgex_foundry EdgeX Foundry is an open source project for building a common open framework for internet-of-things edge computing. A vulnerability exists in the Edinburgh, Fuji, Geneva, and Hanoi versions of the software. When the EdgeX API gateway is configured for OAuth2 authentication and a proxy user is created, the client_id and client_secret required to obtain an OAuth2 authentication token are set to the username of the proxy user. A remote network attacker can then perform a dictionary-based password attack on the OAuth2 token endpoint of the API gateway to obtain an OAuth2 authentication token and use that token to make authenticated calls to EdgeX microservices from an untrusted network. OAuth2 is the default authentication method in EdgeX Edinburgh release. The default authentication method was changed to JWT in Fuji and later releases. Users should upgrade to the EdgeX Ireland release to obtain the fix. The OAuth2 authentication method is disabled in Ireland release. If unable to upgrade and OAuth2 authentication is required, users should create OAuth2 users directly using the Kong admin API and forgo the use of the `security-proxy-setup` tool to create OAuth2 users. 2021-07-09 5.8 CVE-2021-32753 MISC CONFIRM edifecs -- transaction_management In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application. 2021-07-12 5 CVE-2021-36381 MISC MISC element-it -- http_commander A Directory Traversal vulnerability in the Unzip feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to write files to arbitrary directories via relative paths in ZIP archives. 2021-07-14 4 CVE-2021-33211 MISC MISC element-it -- http_commander An SSRF vulnerability in the "Upload from URL" feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to retrieve HTTP and FTP files from the internal server network by inserting an internal address. 2021-07-14 4 CVE-2021-33213 MISC MISC esri -- arcgis_server A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. 2021-07-10 4.3 CVE-2021-29107 CONFIRM esri -- arcgis_server A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-07-10 4.3 CVE-2021-29106 CONFIRM esri -- arcgis_server A Server-Side Request Forgery (SSRF) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote, unauthenticated attacker to forge GET requests to arbitrary URLs from the system, potentially leading to network enumeration or facilitating other attacks. 2021-07-11 6.4 CVE-2021-29102 CONFIRM esri -- arcgis_server A stored Cross Site Scripting (XXS) vulnerability in ArcGIS Server Manager version 10.8.1 and below may allow a remote unauthenticated attacker to pass and store malicious strings in the ArcGIS Server Manager application. 2021-07-11 4.3 CVE-2021-29104 CONFIRM esri -- arcgis_server A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser. 2021-07-11 4.3 CVE-2021-29103 CONFIRM eventespresso -- event_espresso A cross-site scripting (XSS) vulnerability in wp-content/plugins/event-espresso-core-reg/admin_pages/messages/templates/ee_msg_admin_overview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. 2021-07-13 4.3 CVE-2020-26153 MISC MISC exiv2 -- exiv2 A buffer overflow vulnerability in the Databuf function in types.cpp of Exiv2 v0.27.1 leads to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19716 MISC exiv2 -- exiv2 An integer overflow vulnerability in the getUShort function of Exiv2 0.27.1 results in segmentation faults within the application, leading to a denial of service (DOS). 2021-07-13 4.3 CVE-2020-19715 MISC fetchdesigns -- sign-up_sheets The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue 2021-07-12 6 CVE-2021-24441 CONFIRM fortinet -- fortiap An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments. 2021-07-09 4.6 CVE-2021-26106 CONFIRM fortinet -- fortimail A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests. 2021-07-12 5 CVE-2021-26090 CONFIRM fortinet -- fortimail An improper neutralization of special elements used in an OS Command vulnerability in the administrative interface of FortiMail before 6.4.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. 2021-07-12 6.5 CVE-2021-24015 CONFIRM fortinet -- fortimail A missing cryptographic step in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an unauthenticated attacker who intercepts the encrypted messages to manipulate them in such a way that makes the tampering and the recovery of the plaintexts possible. 2021-07-09 5 CVE-2021-26100 CONFIRM fortinet -- fortimail Multiple Path traversal vulnerabilities in the Webmail of FortiMail before 6.4.4 may allow a regular user to obtain unauthorized access to files and data via specifically crafted web requests. 2021-07-12 4 CVE-2021-24013 CONFIRM fortinet -- fortimail Missing cryptographic steps in the Identity-Based Encryption service of FortiMail before 7.0.0 may allow an attacker who comes in possession of the encrypted master keys to compromise their confidentiality by observing a few invariant properties of the ciphertext. 2021-07-12 4 CVE-2021-26099 CONFIRM fortinet -- fortimail Multiple instances of incorrect calculation of buffer size in the Webmail and Administrative interface of FortiMail before 6.4.5 may allow an authenticated attacker with regular webmail access to trigger a buffer overflow and to possibly execute unauthorized code or commands via specifically crafted HTTP requests. 2021-07-09 6.5 CVE-2021-22129 CONFIRM fortinet -- fortisandbox A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands. 2021-07-09 6.3 CVE-2020-29014 CONFIRM foxitsoftware -- foxit_reader Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 produce incorrect PDF document signatures because the certificate name, document owner, and signature author are mishandled. 2021-07-09 4.3 CVE-2021-33795 MISC foxitsoftware -- foxit_reader Foxit Reader before 10.1.4 and PhantomPDF before 10.1.4 have an out-of-bounds write via a crafted /Size key in the Trailer dictionary. 2021-07-09 6.8 CVE-2021-33792 MISC getambassador -- emissary-ingress Emissary-Ingress (formerly Ambassador API Gateway) through 1.13.9 allows attackers to bypass client certificate requirements (i.e., mTLS cert_required) on backend upstreams when more than one TLSContext is defined and at least one configuration exists that does not require client certificate authentication. The attacker must send an SNI specifying an unprotected backend and an HTTP Host header specifying a protected backend. (2.x versions are unaffected. 1.x versions are unaffected with certain configuration settings involving prune_unreachable_routes and a wildcard Host resource.) 2021-07-09 4.3 CVE-2021-36371 MISC MISC google -- android In handleSendStatusChangeBroadcast of WifiDisplayAdapter.java, there is a possible leak of location-sensitive data due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-176541017 2021-07-14 4.9 CVE-2021-0518 MISC google -- android In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-182584940 2021-07-14 6.9 CVE-2021-0586 MISC google -- android In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-177238342 2021-07-14 4.9 CVE-2021-0588 MISC google -- android In onCreate of PermissionActivity.java, there is a possible permission bypass due to Confusing UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174495520 2021-07-14 4.4 CVE-2021-0441 MISC google -- android In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-179042963 2021-07-14 6.9 CVE-2021-0600 MISC google -- android In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-180643802 2021-07-14 4.9 CVE-2021-0601 MISC google -- android In onCreate of ContactSelectionActivity.java, there is a possible way to get access to contacts without permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-182809425 2021-07-14 4.4 CVE-2021-0603 MISC google -- android In sendNetworkConditionsBroadcast of NetworkMonitor.java, there is a possible way for a privileged app to receive WiFi BSSID and SSID without location permissions due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-175213041 2021-07-14 4.9 CVE-2021-0590 MISC google -- android In onPackageAddedInternal of PermissionManagerService.java, there is possible access to external storage due to a permissions bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-171430330 2021-07-14 4.6 CVE-2021-0486 MISC google -- android In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broadcasted intent due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175614289 2021-07-14 4.9 CVE-2021-0599 MISC google -- android In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account names due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176496502 2021-07-14 4.9 CVE-2021-0597 MISC halo -- halo File Deletion vulnerability in Halo 0.4.3 via delBackup. 2021-07-12 6.4 CVE-2020-19038 MISC halo -- halo Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies. 2021-07-12 5 CVE-2020-19037 MISC halo -- halo Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter. 2021-07-12 4.3 CVE-2020-18979 MISC halo -- halo SSRF vulnerability in Halo show log messages | match "Failed to complete DFE tuning" fpc4 smic_phy_dfe_tuning_state: et-4/1/6 - Failed to complete DFE tuning (count 3) and interface will be in a permanently down state: user@host > show interfaces et-4/1/6 terse Interface Admin Link Proto Local Remote et-4/1/6 up down et-4/1/6.0 up down aenet -- > ae101.0 This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S7 on MX Series; 17.1R1 and later versions prior to 17.2R3-S3 on MX Series; 17.3 versions prior to 17.3R3-S8 on MX Series; 17.4 versions prior to 17.4R2-S11, 17.4R3-S1 on MX Series, SRX4600; 18.1 versions prior to 18.1R3-S10 on MX Series, EX9200 Series, SRX4600; 18.2 versions prior to 18.2R3-S3 on MX Series, EX9200 Series, SRX4600; 18.3 versions prior to 18.3R3-S1 on MX Series, EX9200 Series, SRX4600; 18.4 versions prior to 18.4R2-S3, 18.4R3 on MX Series, EX9200 Series, SRX4600; 19.1 versions prior to 19.1R2-S1, 19.1R3 on MX Series, EX9200 Series, SRX4600; 19.2 versions prior to 19.2R1-S3, 19.2R2 on MX Series, EX9200 Series, SRX4600; 19.3 versions prior to 19.3R2 on MX Series, EX9200 Series, SRX4600. This issue does not affect Juniper Networks Junos OS versions prior to 16.1R1. 2021-07-15 not yet calculated CVE-2021-0290 CONFIRM juniper_networks -- junos_os When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of Juniper Networks Junos OS allows an attacker to bypass the user-defined ARP Policer. In this particular case the User ARP policer is replaced with default ARP policer. To review the desired ARP Policers and actual state one can run the command "show interfaces < > extensive" and review the output. See further details below. An example output is: show interfaces extensive | match policer Policer: Input: __default_arp_policer__ = V2.7), SIMATIC NET CP1626 (All versions), SIMATIC NET DK-16xx PN IO (All Versions >= V2.7), SIMATIC PROFINET Driver (All versions), SIMATIC Power Line Booster PLB, Base Module (MLFB: 6ES7972-5AA10-0AB0) (All versions), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All Versions < V4.5), SIMOCODE proV Ethernet/IP (All versions < V1.1.3), SIMOCODE proV PROFINET (All versions < V2.1.3), SOFTNET-IE PNIO (All versions). Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device. 2021-07-13 not yet calculated CVE-2020-28400 CONFIRM siemens -- sinumerik   A vulnerability has been identified in SINUMERIK Analyse MyCondition (All versions), SINUMERIK Analyze MyPerformance (All versions), SINUMERIK Analyze MyPerformance /OEE-Monitor (All versions), SINUMERIK Analyze MyPerformance /OEE-Tuning (All versions), SINUMERIK Integrate Client 02 (All versions >= V02.00.12 < 02.00.18), SINUMERIK Integrate Client 03 (All versions >= V03.00.12 < 03.00.18), SINUMERIK Integrate Client 04 (V04.00.02 and all versions >= V04.00.15 < 04.00.18), SINUMERIK Integrate for Production 4.1 (All versions < V4.1 SP10 HF3), SINUMERIK Integrate for Production 5.1 (V5.1), SINUMERIK Manage MyMachines (All versions), SINUMERIK Manage MyMachines /Remote (All versions), SINUMERIK Manage MyMachines /Spindel Monitor (All versions), SINUMERIK Manage MyPrograms (All versions), SINUMERIK Manage MyResources /Programs (All versions), SINUMERIK Manage MyResources /Tools (All versions), SINUMERIK Manage MyTools (All versions), SINUMERIK Operate V4.8 (All versions < V4.8 SP8), SINUMERIK Operate V4.93 (All versions < V4.93 HF7), SINUMERIK Operate V4.94 (All versions < V4.94 HF5), SINUMERIK Optimize MyProgramming /NX-Cam Editor (All versions). Due to an error in a third-party dependency the ssl flags used for setting up a TLS connection to a server are overwitten with wrong settings. This results in a missing validation of the server certificate and thus in a possible TLS MITM szenario. 2021-07-13 not yet calculated CVE-2021-31892 CONFIRM siemens --  simatic_pcs A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.X (All versions), SIMATIC PDM (All versions), SIMATIC STEP 7 V5.X (All versions < V5.7), SINAMICS STARTER (containing STEP 7 OEM version) (All versions). A directory containing metafiles relevant to devices' configurations has write permissions. An attacker could leverage this vulnerability by changing the content of certain metafiles and subsequently manipulate parameters or behavior of devices that would be later configured by the affected software. 2021-07-13 not yet calculated CVE-2021-31894 CONFIRM siemens --  simatic_pcs   A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions < V9.2), SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3), SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution. 2021-07-13 not yet calculated CVE-2021-31893 CONFIRM siemens -- multiple_ruggedcomros_products   A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions < V4.3.7), RUGGEDCOM ROS M2200 (All versions < V4.3.7), RUGGEDCOM ROS M969 (All versions < V4.3.7), RUGGEDCOM ROS RMC (All versions < V4.3.7), RUGGEDCOM ROS RMC20 (All versions < V4.3.7), RUGGEDCOM ROS RMC30 (All versions < V4.3.7), RUGGEDCOM ROS RMC40 (All versions < V4.3.7), RUGGEDCOM ROS RMC41 (All versions < V4.3.7), RUGGEDCOM ROS RMC8388 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RMC8388 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RP110 (All versions < V4.3.7), RUGGEDCOM ROS RS400 (All versions < V4.3.7), RUGGEDCOM ROS RS401 (All versions < V4.3.7), RUGGEDCOM ROS RS416 (All versions < V4.3.7), RUGGEDCOM ROS RS416v2 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS416v2 V5.X (All versions < 5.5.4), RUGGEDCOM ROS RS8000 (All versions < V4.3.7), RUGGEDCOM ROS RS8000A (All versions < V4.3.7), RUGGEDCOM ROS RS8000H (All versions < V4.3.7), RUGGEDCOM ROS RS8000T (All versions < V4.3.7), RUGGEDCOM ROS RS900 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS900 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RS900G (All versions < V4.3.7), RUGGEDCOM ROS RS900G (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RS900G (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RS900GP (All versions < V4.3.7), RUGGEDCOM ROS RS900L (All versions < V4.3.7), RUGGEDCOM ROS RS900W (All versions < V4.3.7), RUGGEDCOM ROS RS910 (All versions < V4.3.7), RUGGEDCOM ROS RS910L (All versions < V4.3.7), RUGGEDCOM ROS RS910W (All versions < V4.3.7), RUGGEDCOM ROS RS920L (All versions < V4.3.7), RUGGEDCOM ROS RS920W (All versions < V4.3.7), RUGGEDCOM ROS RS930L (All versions < V4.3.7), RUGGEDCOM ROS RS930W (All versions < V4.3.7), RUGGEDCOM ROS RS940G (All versions < V4.3.7), RUGGEDCOM ROS RS969 (All versions < V4.3.7), RUGGEDCOM ROS RSG2100 (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100 (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2100 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (32M) V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2100P (32M) V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2200 (All versions < V4.3.7), RUGGEDCOM ROS RSG2288 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2288 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2300 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2300 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2300P V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2300P V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG2488 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG2488 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900 V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG900 V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900C (All versions < V5.5.4), RUGGEDCOM ROS RSG900G V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG900G V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSG900R (All versions < V5.5.4), RUGGEDCOM ROS RSG920P V4.X (All versions < V4.3.7), RUGGEDCOM ROS RSG920P V5.X (All versions < V5.5.4), RUGGEDCOM ROS RSL910 (All versions < V5.5.4), RUGGEDCOM ROS RST2228 (All versions < V5.5.4), RUGGEDCOM ROS RST916C (All versions < V5.5.4), RUGGEDCOM ROS RST916P (All versions < V5.5.4), RUGGEDCOM ROS i800 (All versions < V4.3.7), RUGGEDCOM ROS i801 (All versions < V4.3.7), RUGGEDCOM ROS i802 (All versions < V4.3.7), RUGGEDCOM ROS i803 (All versions < V4.3.7). The DHCP client in affected devices fails to properly sanitize incoming DHCP packets. This could allow an unauthenticated remote attacker to cause memory to be overwritten, potentially allowing remote code execution. 2021-07-13 not yet calculated CVE-2021-31895 CONFIRM solarwinds -- serv-u   Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability. 2021-07-14 not yet calculated CVE-2021-35211 MISC MISC teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). By sending malformed requests, a remote attacker could leak an application token due to an error not properly handled by the system. 2021-07-13 not yet calculated CVE-2021-33709 CONFIRM teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected devices that could allow an attacker to execute malicious JavaScript code by tricking users into accessing a malicious link. 2021-07-13 not yet calculated CVE-2021-33710 CONFIRM teamcenter -- active_workspace   A vulnerability has been identified in Teamcenter Active Workspace V4 (All versions < V4.3.9), Teamcenter Active Workspace V5.0 (All versions < V5.0.7), Teamcenter Active Workspace V5.1 (All versions < V5.1.4). The affected application allows verbose error messages which allow leaking of sensitive information, such as full paths. 2021-07-13 not yet calculated CVE-2021-33711 CONFIRM telegram -- telegram   A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attacker can cause the server to receive messages in a different order than they were sent a client. 2021-07-17 not yet calculated CVE-2021-36769 MISC thinkcmf -- thinkcmf   Cross Site Request Forgerly (CSRF) vulnerability in ThinkCMF v5.1.0, which can add an admin account. 2021-07-14 not yet calculated CVE-2020-18151 MISC trusted_firmware_mbed -- tls   In Trusted Firmware Mbed TLS 2.24.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. 2021-07-14 not yet calculated CVE-2021-24119 MISC MISC unisys -- stealth   Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run. 2021-07-15 not yet calculated CVE-2021-35056 MISC CONFIRM uri.js -- uri.js   URI.js is vulnerable to URL Redirection to Untrusted Site 2021-07-16 not yet calculated CVE-2021-3647 MISC CONFIRM varnish -- cache   Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8. 2021-07-14 not yet calculated CVE-2021-36740 MISC MISC MISC MISC wolfssl -- wolfssl   In wolfSSL through 4.6.0, a side-channel vulnerability in base64 PEM file decoding allows system-level (administrator) attackers to obtain information about secret RSA keys via a controlled-channel and side-channel attack on software running in isolated environments that can be single stepped, especially Intel SGX. 2021-07-14 not yet calculated CVE-2021-24116 MISC CONFIRM wuwire -- wuwire   MuWire is a file publishing and networking tool that protects the identity of its users by using I2P technology. Users of MuWire desktop client prior to version 0.8.8 can be de-anonymized by an attacker who knows their full ID. An attacker could send a message with a subject line containing a URL with an HTML image tag and the MuWire client would try to fetch that image via clearnet, thus exposing the IP address of the user. The problem is fixed in MuWire 0.8.8. As a workaround, users can disable messaging functionality to prevent other users from sending them malicious messages. 2021-07-15 not yet calculated CVE-2021-32750 CONFIRM ysoft -- safeq   Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream. 2021-07-14 not yet calculated CVE-2021-31859 MISC MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows remote code execution. 2021-07-17 not yet calculated CVE-2021-33911 MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS. 2021-07-17 not yet calculated CVE-2021-36771 MISC zoho_manageengine -- admanager_plus   Zoho ManageEngine ADManager Plus before 7110 allows stored XSS. 2021-07-17 not yet calculated CVE-2021-36772 MISC zscaler -- client_connector   The Zscaler Client Connector for Windows prior to 2.1.2.74 had a stack based buffer overflow when connecting to misconfigured TLS servers. An adversary would potentially have been able to execute arbitrary code with system privileges. 2021-07-15 not yet calculated CVE-2020-11633 MISC zscaler -- client_connector   The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileges. 2021-07-15 not yet calculated CVE-2020-11632 MISC zscaler -- client_connector   The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context. 2021-07-15 not yet calculated CVE-2020-11634 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

3G Networks Are Shutting Down; What Will Happen to Your Older Devices?
Carriers are shutting down 3G networks. While this may not affect your smartphone, you may still have devices that depend on this technology to communicate. The post appeared first on The Mac Security Blog.

Read more »

Screenshots and Shortcuts – Intego Mac Podcast Episode 196
Apple is fixing a bug that could disable network access on devices connecting to wi-fi networks containing weird characters, and Ring rolls out end-to-end encryption for doorbells. We take a close look at how to shoot screenshots on the Mac, and we discuss the new Shortcuts coming to macOS Monterey The post appeared first on The Mac Security Blog.

Read more »

Save up to $140 on an M1 Mac mini at Apple with these Certified Refurbished models available starting at only $589
Apple has a full line of standard configuration M1 Mac minis available in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Note that stock of these models will likely come and go, so be sure to check Apple’s site for the latest stock status. The $589 model is the cheapest M1 Mac currently for sale anywhere. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Here are the details of Apple’s sales tax holiday for 2021. Save in certain US states on specific days
Apple is participating in the 2021 sales tax holiday again this year. In certain states on certain days customers are eligible to save on the sales tax for items purchased on Apple’s online store. For 2021, the following states are participating in the tax holiday: Florida: Jul 31-Aug 9 Massachusetts: Aug 14-15 Missouri: Aug 6-8 New Mexico: Aug 6-8 South Carolina: Aug 6-8 Tennessee: Jul 30-Aug 1 Virginia: Aug 6-8 Full details are available here on → Read More...

Read more »

Apple has 13″ M1 MacBook Pros available for $200-$230 off MSRP, Certified Refurbished, starting at only $1099
Apple has a full line of 2020 13″ M1 MacBook Pros available Certified Refurbished, starting at only $1099 and up to $230 off original MSRP. These are the cheapest M1 MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Pro/256GB SSD/Space Gray: $1099 $200 off MSRP – 13″ M1 MacBook Pro/512GB SSD/Space Gray: $1269 $230 off MSRP – 13″ M1 MacBook Pro/256GB SSD/Silver: $1099 $200 off MSRP – 13″ 13″ M1 MacBook Pro/512GB SSD/Silver: $1269 $230 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Our exclusive Apple Price Trackers help you find the best deal and lowest prices on all your Apple gear
Our Apple award-winning price trackers are the best place to look for the lowest prices and latest sales on all the latest Apple gear. Scan our price trackers for the latest information on sales, bundles, and availability on systems from Apple’s authorized internet/catalog resellers. We update the trackers continuously: – 16″ MacBook Pros – 13″ MacBook Pros – 13″ MacBook Airs – iMacs – Mac minis – Mac Pros – Pro Display XDR – 7.9″ iPad minis – 10.2″ iPads – 10.9″ iPad Airs – 11″ iPad Pros – 12″ iPad Pros – Apple Watch – Apple TVs – Apple AirPods – iPhones Other price trackers include HomePod minis, Keyboards & Pointers, iPod touch, iPad Keyboards, and Apple Pencils. A full list of the available Apple price trackers is in the menu at the top of → Read More...

Read more »

The best deal on 13″ M1 MacBook Airs are these Certified Refurbished models available at Apple starting at only $849
Apple has a full line of 2020 13″ M1 MacBook Airs available, Certified Refurbished, starting at only $849 and up to $190 off original MSRP. These are the cheapest M1 MacBook Airs for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Space Gray: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Silver: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 7-Core GPU/256GB SSD/Gold: $849 $150 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Space Gray: $1059 $190 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Silver: $1059 $190 off MSRP – 13″ M1 MacBook Air/8-Core M1 Silicon CPU, 8-Core GPU/512GB SSD/Gold: $1059 $190 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Air → Read More...

Read more »

Reminder: Take advantage of Apple’s Back to School promo & save up to $400 on a Mac or iPad, get free AirPods
Take advantage of Apple’s Back to School promotion for 2021. As part of this promotion, Apple will include one free pair AirPods (with charging case) with the purchase of a MacBook Air, MacBook Pro, iMac, Mac mini, or Mac Pro. Apple will also include a free pair of Apple AirPods (with charging case) with the purchase of any new iPad Air or iPad Pro (iPad mini and 8th-gen iPad excluded). You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Lastly, Apple will take 20% off AppleCare+ plans with your purchase. Promotion runs through September 27, 2021. In addition to the free AirPods, purchase a new Mac using Apple’s Education discount, and take up to $400 off MSRP. Purchase an iPad, and take up to $100 off MSRP. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. Parents may also purchase on behalf of a child who is currently in school. Apple’s discount applies to the new Macs & iPads with M1 Apple Silicon CPUs as well as models containing Intel processors. Education discounts are also available on most build-to-order options, such as RAM, storage, CPUs, and graphics cards: – 16″ 2.3GHz 8-Core MacBook Pro: $2599 $200 off – 16″ 2.6GHz 6-Core MacBook Pro: $2199 $200 off – 13″ 2.0GHz/1TB 4-Core MacBook Pro: $1899 $100 off – 13″ 2.0GHz/512GB 4-Core MacBook Pro: $1699 $100 off – 13″ M1 MacBook Pro/512GB: $1399 $100 off – 13″ M1 MacBook Pro/256GB: $1199 $100 off – 13″ M1 MacBook Air/8-Core CPU/7-Core GPU/256GB: $899 $100 off – 13″ M1 MacBook Air/8-Core CPU/8-Core GPU/512GB: $1149 $100 off – 8-Core Mac Pro: $5599 $400 off – Pro Display XDR (standard): $4599 $400 off – Pro Display XDR (nano glass): $5599 $400 off – Pro Stand: $5599

Read more »

Sunday Sale: Amazon is offering record-low prices on Apple’s entire MacBook lineup with models on sale starting at $899 and up to $500 off MSRP
Amazon has Apple’s entire MacBook lineup on sale today for record low prices, with models available starting at $899 and up to $500 off Apple’s MSRP. Shipping is free. These are the same MacBook Pros sold by Apple in their retail and online stores: 13″ MacBook Airs: 8-Core M1 Silicon CPU, 7-Core GPU: – 13″ M1 MacBook Air/256GB Space Gray: $899 $100 off MSRP – 13″ M1 MacBook Air/256GB Silver: $899 $100 off MSRP – 13″ M1 MacBook Air/256GB Gold: $899 $100 off MSRP 8-Core M1 Silicon CPU, 8-Core GPU: – 13″ M1 MacBook Air/512GB Space Gray: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Silver: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Gold: $1099 $150 off MSRP 13″ M1 MacBook Pros: – 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1299.99 $200 off MSRP – 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1299.99 $200 off MSRP 13″ Intel MacBook Pros: – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1799 $200 off MSRP 16″ MacBook Pros: – 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2299.99 $500 off MSRP – 16″ 2.6GHz 6-Core MacBook Pro Silver: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Silver: $2299.99 $500 off MSRP Amazon’s prices are currently the lowest available for these models from any Apple reseller. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. See our 16″ MacBook Pro Price Tracker, 13″ MacBook Pro Price Tracker, and 13″ MacBook Air Price Tracker for the → Read More...

Read more »

Sunday Sale: Apple Pencil 2 for only $99, save $30
Amazon has the Apple Pencil 2 on sale today for only $99 shipped. Their price is $30 off Apple’s MSRP, and it’s the lowest price available for an Apple Pencil 2 anywhere. For the latest prices and sales, keep an eye on our Apple Pencil 2 Price Tracker, → Read More...

Read more »

Get a new 13″ M1 MacBook Pro for $100 off Apple’s MSRP, plus pay no sales tax in 42 US states
Apple reseller DataVision has Apple’s new 2020 13″ MacBook Pros with Apple Silicon M1 processors in stock and on sale today for up to $100 off MSRP including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 2020 13″ MacBook Pro M1 CPU/256GB SSD Space Gray: $1259 $40 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD Space Gray: $1399 $100 off MSRP – 2020 13″ MacBook Pro M1 CPU/256GB SSD Silver: $1199 $100 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD Silver: $1399 $100 off MSRP DataVision will include a free 45 day no-hassle return period in addition to Apple’s standard one-year warranty. Three custom configurations with 16GB of RAM are also available: – 2020 13″ MacBook Pro M1 CPU/16GB RAM/256GB SSD Space Gray: $1498 – 2020 13″ MacBook Pro M1 CPU/16GB RAM/512GB SSD Space Gray: $1729 – 2020 13″ MacBook Pro M1 CPU/16GB RAM/512GB SSD Silver: $1699 For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Deal Alert! 16″ MacBook Pros on sale for lowest prices ever, up to $500 off Apple’s MSRP, starting at $1999
Amazon has 16″ MacBook Pros on sale for $400-$500 off Apple’s MSRP this weekend, with prices starting at $1999. Shipping is free. These are the same MacBook Pros sold by Apple in their retail and online stores: – 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2299.99 $500 off MSRP – 16″ 2.6GHz 6-Core MacBook Pro Silver: $1999.99 $400 off MSRP – 16″ 2.3GHz 8-Core MacBook Pro Silver: $2299.99 $500 off MSRP Amazon’s prices are the lowest 16″ MacBook Pro prices we’ve seen so far from any Apple reseller. Note that Amazon’s stock status may change at any time–see their site for the latest availability. Also, be sure to make your purchase from Amazon rather than a third-party seller. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Xfinity Mobile brings back ‘Buy One Apple iPhone SE, Get a Second One For Free’ promotion
Buy one 64GB iPhone SE at Xfinity Mobile through August 4, 2021, and get a second one for free. 24 month contract required, and cost for the free phone will be credited to your account over a 24 month period. One or more new lines required. The fine print: “iPhone SE 64GB On Us: Offer ends 08/04/21. Requires purchase of new, eligible iPhone SE 64GB, while supplies last, 24 month Xfinity Mobile Device Payment Plan Agreement (“Device Agreement”), activation of new Xfinity Mobile line and transfer of phone number from another carrier within 30 days of phone purchase date. Device credits applied monthly to your account over 24 months so long as Device Agreement is in effect. If line is canceled, voluntarily or involuntarily or device payments are accelerated, balance of credits associated with device payment are forfeited. May not be combined with other offers. Not valid with prior purchases, returns or exchanges.” Xfinity Mobile’s deal is live on their → Read More...

Read more »

4 days only: $10 off HomePod minis on Sams Club’s online store
Sams Club has Apple HomePod minis on sale for $89.98 for 4 days only, ending on Saturday, July 24th. Their price is $10 off Apple’s MSRP, and both Space Gray and White colors are available. Sale price is for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup, if available. Sams Club membership required. For the latest prices & sales, see our HomePod Price Tracker, → Read More...

Read more »