Apple’s iPhone reaches record market share in India in fou...
Apple’s iPhone reached a record 75.6% market share in the fourth quarter of 2019 in India thanks to strong performance of the iPhone 11 and price drop on previous-generation models, according to the IDC research group -- as noted by MSN.

Read more »

9to5Mac Daily: February 25, 2020 – Apple Watch study, ARM ...
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by Hyper:  Hyper’s next-gen of USB-C Hubs is now available to preorder. Thanks to Hyper, we’re also giving 9to5Mac readers the chance to win Apple’s new Mac Pro worth $6000 this month.

Read more »

Apple considers adding another major OLED display-maker to i...
China’s largest display maker is publicly confident it will meet Apple’s quality standards for its future needs of organic light-emitting diode, or OLED, displays and is preparing to possibly become another component provider. A media report Tuesday gives further evidence Apple is expecting its needs for the state-of-the-art displays to grow beyond the supply of […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Coronavirus Causes iPhone Sales to Drop 28 Percent in China
iPhone sales in China plummeted 28 percent from the month before, largely because of the coronavirus outbreak, according to UBS.

Read more »

Kelly and Ian Betteridge – TMO Daily Observations 2020-02-...
Today Kelly sits down with Ian Betteridge to discuss the current state of design at Apple and how it stacks up against the competition.

Read more »

Apple and TikTok Decline to Testify in Front of Congress for...
Apple and TikTok have rejected a request from Sen. Josh Hawley to appear at a hearing discussing their relationships with China.

Read more »

Why America is losing the toilet race
I had the same Japanese experience the author did. While initially confused by my hotel's toilets, the detailed instructions (!) in English helped and I "loved" using the toilet for the week I was there. We are in the market for a new toilet in our house and while there's no way we'd splurge for a Toto, there is nothing similar to them on the market for a non-exorbitant price.∞ Read this on The Loop

Read more »

Concept shows off how Apple could enhance the multitasking e...
Apple tries to improve iPad’s multitasking capabilities every year, making the system more powerful to perform multiple tasks simultaneously. But this has also raised questions about the usability of multitasking on the iPad, which has become increasingly complicated for some users. more… The post Concept shows off how Apple could enhance the multitasking experience on iPad appeared first on 9to5Mac.

Read more »

How to Take Screenshots and Record Your Screen on iPad With ...
Taking screenshots on an iPad is a simple click of the button. However, recording the screen requires a couple of extra steps.

Read more »

Tuesday’s best deals: Apple 27-inch 5K iMac $200 off, Anke...
Tuesday’s best deals include $200 off Apple’s latest 27-inch 5K iMac, an Anker iPhone accessory sale from $8, and a rare discount on the official Milanese Loop Apple Watch Band. Head below for all that and more in the latest 9to5Toys Lunch Break. more… The post Tuesday’s best deals: Apple 27-inch 5K iMac $200 off, Anker iPhone accessory sale from $8, more appeared first on 9to5Mac.

Read more »

Connecting a 5.25 inch floppy drive to your Apple Watch
Niles Mitchell attempts to connect an Apple Watch to a 5.25 inch floppy, and access files from that disk. Mitchell used a DaynaFile… The post appeared first on MacDailyNews.

Read more »

Wyze Lock review: This ultra-affordable smart deadbolt conve...
Convert your dumb deadbolt into a Wi-Fi-connected smart lock for less.

Read more »

Moment launches RTRO iPhone video app with vintage vibes and...
Moment, the company behind the popular external lenses and the Moment Pro Camera app is out today with a new app focused on making shooting vintage-inspired video fun and easy to share on social media. RTRO includes a simple and intuitive UI with unique retro filters that each has “a historical reference in mind and brought forward to a more modern style.” more… The post Moment launches RTRO iPhone video app with vintage vibes and easy social media sharing appeared first on 9to5Mac.

Read more »

In surprise to no one, virus hit January iPhone sales in Chi...
Sales of iPhones in China dropped 28 percent in the month of January as the deadly coronavirus began its rapid spread, according to new research. February is likely to go on record as much worse. As the death toll from the virus rose, factories shut down, Apple closed all 42 of its China retail stores […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Keep Everyone Happy with the 5-in-1 FamilyCharger from Eleva...
The typical family has a lot of electronic devices. Some use Lightning connectors, others use those little micro-USB connectors, and there are a growing number of USB-C devices. With Elevation Lab’s 5-in-1 FamilyCharger ($75 with 52W power supply, $50 for the multi-cord only), you can keep all those devices charged up without searching for the proper cables.

Read more »

BOE invests in OLED module lines exclusively for Apple iPhon...
In a bid to become the third OLED supplier for Apple's iPhone in 2021 along with Samsung Display and LG Display, BOE, the biggest display maker in China… The post BOE invests in OLED module lines exclusively for Apple iPhones appeared first on MacDailyNews.

Read more »

What Happens When The Government Blocks Internet Access?
We all rely on the internet for our day-to-day lives. Yet, at the height of protests, governments around the world can shut down their citizens’ access to the web. BBC News looked into where, and why, this happened during 2019. When the internet shuts down, everything is stopped in its tracks. Data shared with the BBC by digital rights group Access Now, shows that last year services were deliberately shut down more than 200 times in 33 separate countries. This includes, on one occasion, in the UK. In April 2019 the British Transport Police shut down the wi-fi on London’s Tube network during a protest by climate change activists Extinction Rebellion. Also revealed in the report about shutdowns in 2019: The internet was switched off during 65 protests in various countries around the world. A further 12 took place during election periods. The majority of all shutdowns occurred in India. The longest internet switch-off happened in Chad, central Africa, and lasted 15 months.

Read more »

Netatmo adds HomeKit Secure video support to its Smart indoo...
Smart home device maker Netatmo announced Tuesday support for Apple’s HomeKitSecure Video standard as part of its Smart indoor camera. The free and automatic update rolled out Tuesday to users, according to a company announcement, and will be available to install on all cameras over the next few days. Using HomeKit Secure Video, users can now set […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Inside The New ‘Amazon Go’ Grocery Store
The first Amazon Go grocery store is close to opening. Geekwire took a look inside the Seattle cashier-less outlet. GeekWire got a sneak peek at the store during a recent media preview, entering by scanning a smartphone app and strolling the aisles of the completely stocked store. The banks of cameras and sensors overhead track everything put into a shopping cart, with the help of artificial intelligence — rendering unnecessary the old-fashioned ritual of scanning and paying at a checkout stand. Items are charged to a shopper’s Amazon account shortly after they walk through the exit. Apart from the larger size, the concept is very similar to the Amazon Go convenience stores that first opened to the public in Seattle in January 2018. Amazon Go has expanded to 25 locations across cities including San Francisco, Chicago and New York. That smaller concept, sized between 450 and 2,700 square feet, ushered in an era of grab-and-go shopping.

Read more »

Apple declines to testify at second congressional hearing pr...
Apple and TikTok have each declined a request from U.S. Senator Josh Hawley (R-MO) to testify at a March congressional hearing that would have probed… The post Apple declines to testify at second congressional hearing probing tech’s ties to China appeared first on MacDailyNews.

Read more »

Survey of workers at Apple and elsewhere highlights H-1B vis...
A survey of foreign workers employed by Apple and other tech giants has highlighted controversy around the H-1B visa that allows them to work in the US. President Trump has made it harder to qualify for the visa … more… The post Survey of workers at Apple and elsewhere highlights H-1B visa controversy appeared first on 9to5Mac.

Read more »

Apple teams with Johnson & Johnson for 3-year heart stud...
Apple will team up with Johnson & Johnson to study whether the Apple Watch and its knack for alerting users to atrial fibrillation can reduce stroke risk in seniors 65 and older. The Heartline Study will include a special iPhone app. Afib is a leading cause of stroke. The three-year study is open to seniors […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Netatmo’s Smart Indoor Camera now supports Apple HomeKit S...
The HomeKit Secure Video update will allow Netatmo Smart Indoor Security Camera users to securely store their saved video clips in iCloud.

Read more »

Firefox flips on default DNS over HTTPS to encrypt Internet ...
Mozilla has announced that it is enabling default DNS over HTTPS on its Firefox browser, likely setting up a lengthy battle with the U.S. government.

Read more »

Apple Publishes White Papers on Mac Pro, Pro Display XDR
Apple has published two white papers that cover the Mac Pro and the Pro Display XDR, with details on each product’s features and hardware.

Read more »

Apple, Johnson & Johnson Launch ‘Heartline’ Study
Apple and Johnson & Johnson partner on the Heartline study to determine if the accompanying app as well as Apple Watch can reduce the risk of a stroke.

Read more »

How to restore lost calendars & reminders from iCloud
This is one of those tips that's worth going through, just to understand the mechanics of how calendars and reminders are stored in iCloud. Worth tucking away for a day you hope will never come, when your calendars or reminders come up missing or accidentally deleted.∞ Read this on The Loop

Read more »

How to pick an arm to mount your new display
Looking for a wall or desk mounted arm for a new display? Or just a stand? Follow the headline link, a couple of taps and you're there.∞ Read this on The Loop

Read more »

∞ Apple white papers filled with detail on Mac Pro and Pro...
Apple posted two white papers, technology overviews of the Mac Pro and Pro Display XDR: Link to the Apple Mac Pro Technology Overview Link to the Apple Pro Display XDR Technology Overview Easy reads, lots of great detail and images.

Read more »

Johnson & Johnson and Apple launch ‘Heartline Study’...
The Heartline Study is designed to explore if iPhone and Apple Watch can improve health outcomes, including reducing the risk of stroke… The post Johnson & Johnson and Apple launch ‘Heartline Study’ to see if Apple Watch can help reduce the risk of stroke appeared first on MacDailyNews.

Read more »

Red Hat Security Advisory 2020-0568-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Zyxel Fixes 0day in Network Storage Devices
Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a "ZyXEL") is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.

Read more »

Switch default apps on iPhone or iPad for better security an...
Modern operating systems, both on the desktop and on mobile devices, include plenty of “stock apps”—apps provided by default so you can use your device without needing a lot of third-party software. You get an email app, a calendar, a web browser, a messaging app, and more. This wasn’t always the case; I remember when […]

Read more »

Red Hat Security Advisory 2020-0559-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability was addressed.

Read more »

Hackers Were Inside Citrix for Five Months
Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.

Read more »

Encoding Stolen Credit Card Data on Barcodes
Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the U.S. Secret Service, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code.

Read more »

Red Hat Security Advisory 2020-0515-01
- KornShell is a Unix shell developed by AT&T Bell Laboratories, which is backward-compatible with the Bourne shell and includes many features of the C shell. The most recent version is KSH-93. KornShell complies with the POSIX.2 standard. A code injection vulnerability has been addressed.

Read more »

Pay Up, Or We’ll Make Google Ban Your Ads
A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google's AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher's ads with so much bot and junk traffic that Google's automated anti-fraud systems suspend the user's AdSense account for suspicious traffic.

Read more »

Vulnerability Summary for the Week of February 10, 2020
Original release date: February 17, 2020The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- framemaker   Adobe Framemaker versions 2019.0.4 and below have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution. 2020-02-13 10 CVE-2020-3740CONFIRM ajaxeplorer -- ajaxeplorer   Ajaxeplorer before 5.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) archive_name parameter to the Power FS module (plugins/action.powerfs/class.PowerFSController.php), a (2) file name to the getTrustSizeOnFileSystem function in the File System (Standard) module (plugins/access.fs/class.fsAccessWrapper.php), or the (3) revision parameter to the Subversion Repository module (plugins/meta.svn/class.SvnManager.php). 2020-02-11 10 CVE-2013-4267MISCMISCMISC artica -- pandora_fms   functions_netflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nf_live_view ip_dst, dst_port, or src_port parameter, a different vulnerability than CVE-2019-20224. 2020-02-12 9 CVE-2020-8947MISCMISCMISC atutor -- atutor   confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login parameter. 2020-02-11 7.5 CVE-2014-9753MISCMISCMISCMISCMISC belkin -- n300_router   An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication using "Javascript debugging." 2020-02-07 10 CVE-2013-3091MISCMISCMISC biscom -- secure_file_transfer   Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. 2020-02-07 7.5 CVE-2020-8796MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/175922 bosch -- bvms_mobile_video_service   Deserialization of Untrusted Data in the BVMS Mobile Video Service (BVMS MVS) allows an unauthenticated remote attacker to execute arbitrary code on the system. This affects Bosch BVMS versions 10.0 = V3.0), SCALANCE S612 (All versions >= V3.0), SCALANCE S623 (All versions >= V3.0), SCALANCE S627-2M (All versions >= V3.0). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. 2020-02-11 5 CVE-2019-13925MISC siemens -- multiple_scalance_switches   A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (all versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (all versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface. At the time of advisory publication no public exploitation of this security vulnerability was known. 2020-02-11 4.3 CVE-2019-13924MISC siemens -- multiple_simatic_devices   A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.1), SIMATIC S7-300 PN/DP CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V6 and below CPU family (incl. SIPLUS variants) (All versions), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants) (All versions). Affected devices contain a vulnerability that could cause a Denial-of-Service condition of the web server by sending specially crafted HTTP requests to ports 80/tcp and 443/tcp. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device’s web server. Beyond the web service, no other functions or interfaces are affected by the Denial-of-Service condition. 2020-02-11 5 CVE-2019-13940MISCMISC siemens -- ozw672_and_772_web_servers   A vulnerability has been identified in OZW672 (All versions < V10.00), OZW772 (All versions < V10.00). Vulnerable versions of OZW Web Server use predictable path names for project files that legitimately authenticated users have created by using the application's export function. By accessing a specific uniform resource locator on the web server, a remote attacker could be able to download a project file without prior authentication. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected system. No user interaction is required to exploit this security vulnerability. Successful exploitation of the security vulnerability compromises the confidentiality of the targeted system. 2020-02-11 5 CVE-2019-13941MISC simple_machines -- simple_machines_forum   File Disclosure in SMF (SimpleMachines Forum) character exists. This causes a denial of service in which the recipient cannot read all of their messages. 2020-02-12 not yet calculated CVE-2020-7957CONFIRMCONFIRMMISC dovecot -- dovecot   lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop. 2020-02-12 not yet calculated CVE-2020-7046CONFIRMCONFIRMMISC drupal -- drupal   The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field. 2020-02-11 not yet calculated CVE-2013-4225MISCMISCMISCMISC easyxdm -- easyxdm   Cross-site Scripting (XSS) in EasyXDM before 2.4.18 allows remote attackers to inject arbitrary web script or html via the easyxdm.swf file. 2020-02-14 not yet calculated CVE-2013-5212MISCXF etherpad -- etherpad   Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.2 through 1.5.4 allows remote attackers to read arbitrary files with permissions of the user running the service via a .. (dot dot) in the path parameter of HTTP API requests. NOTE: This vulnerability is due to an incomplete fix to CVE-2015-3297. 2020-02-13 not yet calculated CVE-2015-3309MISCMISCMISC extrun -- ilbo   ilbo App (ilbo App for Android prior to version 1.1.8 and ilbo App for iOS prior to version 1.2.01) allows an attacker on the same network segment to bypass authentication and to view the images which were recorded by the other ilbo user's device via unspecified vectors. 2020-02-14 not yet calculated CVE-2020-5532MISCMISCMISC fasterxml -- jackson-databind   FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter. 2020-02-10 not yet calculated CVE-2020-8840MISC foxit -- phantompdf This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of text field objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9400. 2020-02-14 not yet calculated CVE-2020-8846MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.2947. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the fxhtml2pdf.exe module. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9560. 2020-02-14 not yet calculated CVE-2020-8855MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks in AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9358. 2020-02-14 not yet calculated CVE-2020-8845MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9591. 2020-02-14 not yet calculated CVE-2020-8853MISCMISC foxit -- phantompdf   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of JPEG files to PDF. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9606. 2020-02-14 not yet calculated CVE-2020-8854MISCMISC foxit -- phantompdf   This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25608. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of watermarks. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9640. 2020-02-14 not yet calculated CVE-2020-8856MISCMISC foxit -- reader This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-9416. 2020-02-14 not yet calculated CVE-2020-8852MISCMISC foxit -- reader This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of form Annotation objects within AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9862. 2020-02-14 not yet calculated CVE-2020-8857MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9414. 2020-02-14 not yet calculated CVE-2020-8847MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9406. 2020-02-14 not yet calculated CVE-2020-8851MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG2000 images. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9407. 2020-02-14 not yet calculated CVE-2020-8848MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9415. 2020-02-14 not yet calculated CVE-2020-8850MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.0.29455. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPEG2000 files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9413. 2020-02-14 not yet calculated CVE-2020-8849MISCMISC foxit -- reader   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPEG files within CovertToPDF. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9102. 2020-02-14 not yet calculated CVE-2020-8844CONFIRMMISC free_reprintables -- articlefr   A Privilege Escalation Vulnerability exists in Free Reprintables ArticleFR 11.06.2014 due to insufficient access restrictions in the data.php script, which could let a remote malicious user obtain access or modify or delete database information. 2020-02-13 not yet calculated CVE-2014-4170MISCMISCMISCMISC freebsd -- bsd_libc   regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. 2020-02-12 not yet calculated CVE-2011-3336FULLDISCBIDMISCBUGTRAQ fujitsu -- multiple_products   The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V11 and other versions, Interstage Job Workload Server V8, Interstage List Works V10 and other versions, Interstage Studio V12 and other versions, Interstage Web Server Express V11, Linkexpress V5, Safeauthor V3, ServerView Resource Orchestrator V3, Systemwalker Cloud Business Service Management V1, Systemwalker Desktop Keeper V15, Systemwalker Desktop Patrol V15, Systemwalker IT Change Manager V14, Systemwalker Operation Manager V16 and other versions, Systemwalker Runbook Automation V15 and other versions, Systemwalker Security Control V1, and Systemwalker Software Configuration Manager V15. 2020-02-07 not yet calculated CVE-2019-13163CONFIRM git -- git   Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem. 2020-02-12 not yet calculated CVE-2014-9390MISCMISCMISCMISCMISCMISCMISC gitlab -- gitlab   GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associated to an issue via the activity timeline. 2020-02-14 not yet calculated CVE-2019-15592MISCMISC gitlab -- gitlab   GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request endpoint. 2020-02-14 not yet calculated CVE-2019-15594MISCMISC global_payments -- php-sdk   Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations. 2020-02-14 not yet calculated CVE-2019-20455MISCMISC gocloud -- mutliple_devices   Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3.0.17193, S3A K2P MTK 4.2.7.16528, S3A 4.3.0.16572, and ISP3000 4.3.0.17190 devices allows remote attackers to execute arbitrary OS commands via shell metacharacters in a ping operation, as demonstrated by the cgi-bin/webui/admin/tools/app_ping/diag_ping/; substring. 2020-02-12 not yet calculated CVE-2020-8949MISC google -- android In notifyNetworkTested and related functions of NetworkMonitor.java, there is a possible bypass of private DNS settings. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-9Android ID: A-122652057 2020-02-13 not yet calculated CVE-2020-0028MISC google -- android   In btm_read_remote_ext_features_complete of btm_acl.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-141552859 2020-02-13 not yet calculated CVE-2020-0005MISC google -- android   It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no additional execution privileges needed. User action is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-128674520 2020-02-13 not yet calculated CVE-2020-0014MISC google -- android   In binder_thread_release of binder.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145286050References: Upstream kernel 2020-02-13 not yet calculated CVE-2020-0030MISC google -- android   The Bluetooth stack in Android before 2.3.6 allows a physically proximate attacker to obtain contact information via an AT phonebook transfer. 2020-02-12 not yet calculated CVE-2011-2343CONFIRMMISC google -- android   In updatePermissions of PermissionManagerService.java, it may be possible for a malicious app to obtain a custom permission from another app due to a permission bypass. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-67319274 2020-02-13 not yet calculated CVE-2019-2200MISC google -- android   In onCreate of CertInstaller.java, there is a possible way to overlay the Certificate Installation dialog by a malicious application. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139017101 2020-02-13 not yet calculated CVE-2020-0015MISC google -- android   In Parcel::continueWrite of Parcel.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-140419401 2020-02-13 not yet calculated CVE-2020-0026MISC google -- android   In multiple places, it was possible for the primary user’s dictionary to be visible to and modifiable by secondary users. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-123232892 2020-02-13 not yet calculated CVE-2020-0017MISC google -- android   In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139945049 2020-02-13 not yet calculated CVE-2020-0018MISC google -- android   In HidRawSensor::batch of HidRawSensor.cpp, there is a possible out of bounds write due to an unexpected switch fallthrough. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-144040966 2020-02-13 not yet calculated CVE-2020-0027MISC google -- android   In getAttributeRange of ExifInterface.java, there is a possible failure to redact location information from media files due to an incorrect bounds check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-143118731 2020-02-13 not yet calculated CVE-2020-0020MISC google -- android   In removeUnusedPackagesLPw of PackageManagerService.java, there is a possible permanent denial-of-service due to a missing package dependency test. This could lead to remote denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141413692 2020-02-13 not yet calculated CVE-2020-0021MISC google -- android   In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715 2020-02-13 not yet calculated CVE-2020-0022FULLDISCMISC google -- android   In setPhonebookAccessPermission of AdapterService.java, there is a possible disclosure of user contacts over bluetooth due to a missing permission check. This could lead to local information disclosure if a malicious app enables contacts over a bluetooth connection, with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-145130871 2020-02-13 not yet calculated CVE-2020-0023MISC hashicorp -- sentinel HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. 2020-02-14 not yet calculated CVE-2019-19879MISC hcl -- appscan_standard_edition   HCL AppScan Standard Edition 9.0.3.13 and earlier uses hard-coded credentials which can be exploited by attackers to get unauthorized access to the system. 2020-02-14 not yet calculated CVE-2019-4392MISC hitachi -- command_suite_and_automation_director   A vulnerability in Hitachi Command Suite prior to 8.7.1-00 and Hitachi Automation Director prior to 8.5.0-00 allow authenticated remote users to expose technical information through error messages. Hitachi Command Suite includes Hitachi Device Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21032MISCCONFIRM hitachi -- multiple_products   A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. 2020-02-14 not yet calculated CVE-2018-21033MISCCONFIRM hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7208MISC hp -- linuxki   LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. 2020-02-13 not yet calculated CVE-2020-7209MISC ibm -- tivoli_monitoring_service   IBM Tivoli Monitoring Service 6.3.0.7.3 through 6.3.0.7.10 could allow an unauthorized user to access and modify operation aspects of the ITM monitoring server possibly leading to an effective denial of service or disabling of the monitoring server. IBM X-Force ID: 167647. 2020-02-13 not yet calculated CVE-2019-4592XFCONFIRM ibm -- urbancode_deploy_and_urbancode_build IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248. 2020-02-13 not yet calculated CVE-2019-4666XFCONFIRMCONFIRM intel -- converged_security_and_management_engine   Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versions 14.0 through 14.0.10 may allow a privileged user to potentially enable escalation of privilege, denial of service or information disclosure via local access. 2020-02-13 not yet calculated CVE-2019-14598MISC intel -- e1000e/82574l_network_controller_devices   A denial of service vulnerability exists in some motherboard implementations of Intel e1000e/82574L network controller devices through 2013-02-06 where the device can be brought into a non-processing state when parsing 32 hex, 33 hex, or 34 hex byte values at the 0x47f offset. NOTE: A followup statement from Intel suggests that the root cause of this issue was an incorrectly configured EEPROM image. 2020-02-13 not yet calculated CVE-2013-1634MISCMISCMLISTMLISTSECTRACKXF intel -- manycore_platform_software_stack   Improper permissions in the installer for Intel(R) MPSS before version 3.8.6 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0563MISC intel -- renesas_electronics_usb   Improper permissions in the installer for the Intel(R) Renesas Electronics(R) USB 3.0 Driver, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0560MISC intel -- sgx_software_development_kit Improper initialization in the Intel(R) SGX SDK before v2.6.100.1 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0561MISC intel --  raid_web_console_2 Improper permissions in the installer for Intel(R) RWC2, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0562MISC intel --  raid_web_console_3_for_windows Improper permissions in the installer for Intel(R) RWC3 for Windows before version 7.010.009.000 may allow an authenticated user to potentially enable escalation of privilege via local access. 2020-02-13 not yet calculated CVE-2020-0564MISC invision_power_services -- invision_power_board   Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. 2020-02-12 not yet calculated CVE-2013-3725MISC istio -- istio   An issue was discovered in Istio 1.3 through 1.3.6. Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header. This feature is disabled by default in Istio 1.3 and 1.4. 2020-02-14 not yet calculated CVE-2020-8843MISCMISCCONFIRM joomla! -- joomla!   Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution. 2020-02-12 not yet calculated CVE-2011-4906CONFIRMEXPLOIT-DBMISC joomla! -- joomla!   TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php. 2020-02-12 not yet calculated CVE-2011-4908MISCEXPLOIT-DBMLIST jsreport -- jsreport   An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8128MISC jsreport -- script-manager   An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code. 2020-02-14 not yet calculated CVE-2020-8129MISC juniper -- junos_os   Multiple vulnerabilities exist in Juniper Junos J-Web error handling that may lead to cross site scripting (XSS) issues or crash the J-Web service (DoS). This affects Juniper Junos OS 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R8, 12.3X48 before 12.3X48-D10, 13.1 before 13.1R5, 13.2 before 13.2R6, 13.3 before 13.3R4, 14.1 before 14.1R3, 14.1X53 before 14.1X53-D10, 14.2 before 14.2R1, and 15.1 before 15.1R1. 2020-02-11 not yet calculated CVE-2014-6447CONFIRMMISC kaseya -- virtual_system_administrator   Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. 2020-02-13 not yet calculated CVE-2015-6589MISCMISCMISCMISC kde -- paste_applet   The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack. 2020-02-11 not yet calculated CVE-2013-2120MISCMISCMISCMISCMISC kde -- paste_applet   The KRandom::random function in KDE Paste Applet after 4.10.5 in kdeplasma-addons uses the GNU C Library rand function's linear congruential generator, which makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms by predicting the generator output. 2020-02-11 not yet calculated CVE-2013-2213MISCMISCMISC kinetica -- kinetica   The Admin web application in Kinetica 7.0.9.2.20191118151947 does not properly sanitise the input for the function getLogs. This lack of sanitisation could be exploited to allow an authenticated attacker to run remote code on the underlying operating system. The logFile parameter in the getLogs function was used as a variable in a command to read log files; however, due to poor input sanitisation, it was possible to bypass a replacement and break out of the command. 2020-02-11 not yet calculated CVE-2020-8429MISCMISC lenovo -- ez_media_&_backup_center A vulnerability in the web interface of Lenovo EZ Media & Backup Center, ix2 & ix2-dl version 4.1.406.34763 and prior could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page. 2020-02-14 not yet calculated CVE-2019-19758CONFIRM lenovo -- multiple_devices   Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled. 2020-02-14 not yet calculated CVE-2019-6190CONFIRM lenovo -- xclarity_administrator   An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered a Document Object Model (DOM) based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The JavaScript code is executed on the user's system, not executed on LXCA itself. 2020-02-14 not yet calculated CVE-2019-19757CONFIRM lenovo -- xclarity_administrator   An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow information disclosure. 2020-02-14 not yet calculated CVE-2019-6194CONFIRM lenovo -- xclarity_administrator   An information disclosure vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.6.6 that could allow unauthenticated access to some configuration files which may contain usernames, license keys, IP addresses, and encrypted password hashes. 2020-02-14 not yet calculated CVE-2019-6193CONFIRM lenovo -- xclarity_controller   An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to higher-privileged information if 1) “LDAP Authentication Only with Local Authorization” mode is configured and used by XCC, and 2) a lesser privileged user logs into XCC within 1 minute of a higher privileged user logging out. The authorization bypass does not exist when “Local Authentication and Authorization” or “LDAP Authentication and Authorization” modes are configured and used by XCC. 2020-02-14 not yet calculated CVE-2019-6195CONFIRM lexmark -- multiple_devices   Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. 2020-02-13 not yet calculated CVE-2019-18791MISCCONFIRM libuv -- libuv   The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition. 2020-02-11 not yet calculated CVE-2014-9748MISCMISCMISCMISCMISC linux -- linux_kernel   ext4_protect_reserved_inode in fs/ext4/block_validity.c in the Linux kernel through 5.5.3 allows attackers to cause a denial of service (soft lockup) via a crafted journal size. 2020-02-14 not yet calculated CVE-2020-8992MISC lvm2 -- lvm2   vg_lookup in daemons/lvmetad/lvmetad-core.c in LVM2 2.02 mismanages memory, leading to an lvmetad memory leak, as demonstrated by running pvs. 2020-02-14 not yet calculated CVE-2020-8991MISC magento -- magento Zend_XmlRpc Class in Magento before 1.7.0.2 contains an information disclosure vulnerability. 2020-02-13 not yet calculated CVE-2012-6091MLISTBIDXF mailu -- mailu   In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354 2020-02-13 not yet calculated CVE-2020-5239MISCCONFIRM mambo -- mambo_cms Mambo CMS through 4.6.5 has multiple XSS. 2020-02-12 not yet calculated CVE-2011-2499MLIST mantisbt -- mantisbt   A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. 2020-02-13 not yet calculated CVE-2020-8981MISCMISC matestack-ui-core_gem_for_ruby_on_rails -- matestack-ui-core_gem_for_ruby_on_rails matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. 2020-02-13 not yet calculated CVE-2020-5241CONFIRM maxum_development_corporation -- rumpus_ftp   A CSRF vulnerability exists in the Web Settings of Web File Manager in Rumpus FTP 8.2.9.1. Exploitation of this vulnerability can result in manipulation of Server Web settings at RAPR/WebSettingsGeneralSet.html. 2020-02-10 not yet calculated CVE-2019-19664MISCMISC maxum_development_corporation -- rumpus_ftp_server   A CSRF vulnerability exists in the Web File Manager's Create/Delete Accounts functionality of Rumpus FTP Server 8.2.9.1. By exploiting it, an attacker can Create and Delete accounts via RAPR/TriggerServerFunction.html. 2020-02-10 not yet calculated CVE-2019-19662MISCMISC mcafee -- endpoint_security   Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS. 2020-02-14 not yet calculated CVE-2020-7251CONFIRM microsoft -- multiple_windows_products An information vulnerability exists when Windows Modules Installer Service improperly discloses file information, aka 'Windows Modules Installer Service Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0728MISCBUGTRAQ microsoft -- multiple_windows_products An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0714MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Windows Graphics Component improperly handles objects in memory, aka 'Windows Graphics Component Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0745, CVE-2020-0792. 2020-02-11 not yet calculated CVE-2020-0715MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists when the Connected User Experiences and Telemetry Service improperly handles file operations, aka 'Connected User Experiences and Telemetry Service Elevation of Privilege Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0727MISC microsoft -- multiple_windows_products   A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability, an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory., aka 'Windows Imaging Library Remote Code Execution Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0708MISC microsoft -- multiple_windows_products   An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0719, CVE-2020-0720, CVE-2020-0721, CVE-2020-0722, CVE-2020-0723, CVE-2020-0724, CVE-2020-0725, CVE-2020-0726, CVE-2020-0731. 2020-02-11 not yet calculated CVE-2020-0691MISC microsoft -- office_online_server   A spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly, aka 'Microsoft Office Online Server Spoofing Vulnerability'. 2020-02-11 not yet calculated CVE-2020-0695MISC microsys -- promotic   Microsys PROMOTIC 8.2.13 contains an ActiveX Control Start Buffer Overflow vulnerability which can lead to denial of service. 2020-02-13 not yet calculated CVE-2014-1617MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme. 2020-02-13 not yet calculated CVE-2013-7287MISCMISC mobileiron -- vsp_and_sentry   MobileIron VSP < 5.9.1 and Sentry < 5.0 has a weak password obfuscation algorithm 2020-02-12 not yet calculated CVE-2013-7286MISCMISC moxa -- mgate_5105-mb-eip_devices   This vulnerability allows remote attackers to execute arbitrary code on affected installations of Moxa MGate 5105-MB-EIP firmware version 4.1. Authentication is required to exploit this vulnerability. The specific flaw exists within the DestIP parameter within MainPing.asp. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9552. 2020-02-14 not yet calculated CVE-2020-8858MISCMISC netgear -- cg3100_devices   A vulnerability exists in Netgear CG3100 devices before 3.9.2421.13.mp3 V0027 via an embed malicious script in an unspecified page, which could let a malicious user obtain sensitive information. 2020-02-13 not yet calculated CVE-2014-3919MISC netis -- wf2471_devices   Netis WF2471 v1.2.30142 devices allow an authenticated attacker to execute arbitrary OS commands via shell metacharacters in the /cgi-bin-igd/sys_log_clean.cgi log_3g_type parameter. 2020-02-12 not yet calculated CVE-2020-8946MISC nvidia -- graphics_drivers   A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry. 2020-02-12 not yet calculated CVE-2012-0951MISCMISC nxp -- kw41z_devices   The Bluetooth Low Energy implementation on NXP SDK through 2.2.1 for KW41Z devices does not properly restrict the Link Layer payload length, allowing attackers in radio range to cause a buffer overflow via a crafted packet. 2020-02-12 not yet calculated CVE-2019-17519MISC openconnect_project -- openconnect_vpn_client OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection. 2020-02-13 not yet calculated CVE-2013-7098CONFIRM openvpn -- access_server OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication bypass (except when a user is enrolled in two-factor authentication). 2020-02-13 not yet calculated CVE-2020-8953CONFIRM openx -- openx_ad_server   A Code Execution Vulnerability exists in OpenX Ad Server 2.8.10 due to a backdoor in flowplayer-3.1.1.min.js library, which could let a remote malicious user execute arbitrary PHP code 2020-02-14 not yet calculated CVE-2013-4211MISCMISCMISCMISCMISC otrs -- itsm_and_faq   A Cross-Site Scripting (XSS) Vulnerability exists in OTRS ITSM prior to 3.2.4, 3.1.8, and 3.0.7 and FAQ prior to 2.1.4 and 2.0.8 via changes, workorder items, and FAQ articles, which could let a remote malicious user execute arbitrary code. 2020-02-12 not yet calculated CVE-2013-2637MISCMISCMISCMISC palo_alto_networks -- expedition_migration_tool   Insufficient Cross-Site Request Forgery (XSRF) protection on Expedition Migration Tool allows remote unauthenticated attackers to hijack the authentication of administrators and to perform actions on the Expedition Migration Tool. This issue affects Expedition Migration Tool 1.1.51 and earlier versions. 2020-02-12 not yet calculated CVE-2020-1977CONFIRM palo_alto_networks -- globalprotect   A denial-of-service (DoS) vulnerability in Palo Alto Networks GlobalProtect software running on Mac OS allows authenticated local users to cause the Mac OS kernel to hang or crash. This issue affects GlobalProtect 5.0.5 and earlier versions of GlobalProtect 5.0 on Mac OS. 2020-02-12 not yet calculated CVE-2020-1976CONFIRM palo_alto_networks -- pan-os   Missing XML validation vulnerability in the PAN-OS web interface on Palo Alto Networks PAN-OS software allows authenticated users to inject arbitrary XML that results in privilege escalation. This issue affects PAN-OS 8.1 versions earlier than PAN-OS 8.1.12 and PAN-OS 9.0 versions earlier than PAN-OS 9.0.6. This issue does not affect PAN-OS 7.1, PAN-OS 8.0, or PAN-OS 9.1 or later versions. 2020-02-12 not yet calculated CVE-2020-1975CONFIRM pcre -- pearl_compatible_regular_expressions   An out-of-bounds read was discovered in PCRE before 10.34 when the pattern X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c. 2020-02-14 not yet calculated CVE-2019-20454MISCMISCMISCMISC podman -- podman   A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. 2020-02-11 not yet calculated CVE-2020-1726CONFIRM prestashop -- prestashop   PrestaShop before 1.4.11 allows logout CSRF. 2020-02-14 not yet calculated CVE-2013-4792MISC prestashop -- prestashop   PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE. 2020-02-14 not yet calculated CVE-2013-4791MISC prismview -- prismview_system_and_prismview_player   The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.) 2020-02-10 not yet calculated CVE-2019-20451MISC proglottis -- gpgme   The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. 2020-02-12 not yet calculated CVE-2020-8945MISCMISCMISCMISC progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, multiple SQL Injection vulnerabilities have been found in the REST API that could allow an authenticated attacker to gain unauthorized access to MOVEit Transfer's database via the REST API. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or destroy database elements. 2020-02-14 not yet calculated CVE-2020-8611MISCCONFIRMCONFIRMCONFIRM progress -- moveit_transfer   In Progress MOVEit Transfer 2019.1 before 2019.1.4 and 2019.2 before 2019.2.1, a REST API endpoint failed to adequately sanitize malicious input, which could allow an authenticated attacker to execute arbitrary code in a victim's browser, aka XSS. 2020-02-14 not yet calculated CVE-2020-8612MISCCONFIRMCONFIRMCONFIRM python-mode -- python-mode A Code Execution vulnerability exists in select.py when using python-mode 2012-12-19. 2020-02-12 not yet calculated CVE-2013-5106MISC qemu -- qemu   An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. 2020-02-11 not yet calculated CVE-2020-1711CONFIRMMISCMISC qnap -- viocard-300_devices   QNAP VioCard 300 has hardcoded RSA private keys. 2020-02-13 not yet calculated CVE-2013-6277MISCMISC realtek -- ndis_driver_rt64x64.sys   Realtek NDIS driver rt640x64.sys, file version 10.1.505.2015, fails to do any size checking on an input buffer from user space, which the driver assumes has a size greater than zero bytes. To exploit this vulnerability, an attacker must send an IRP with a system buffer size of 0. 2020-02-12 not yet calculated CVE-2019-11867MISCMISC red_hat -- openshift_enterprise   The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. 2020-02-12 not yet calculated CVE-2014-0234MISCMISCMISCMISCMISC runc -- runc   runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) 2020-02-12 not yet calculated CVE-2019-19921SUSEMISCMISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module. 2020-02-13 not yet calculated CVE-2020-8804MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list. 2020-02-13 not yet calculated CVE-2020-8803MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. 2020-02-13 not yet calculated CVE-2020-8802MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows PHAR Deserialization. 2020-02-13 not yet calculated CVE-2020-8801MISCMISCMISC salesagility -- suitecrm   SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection. 2020-02-13 not yet calculated CVE-2020-8800MISCMISCMISC samsung -- s6_edge_smartphone   Multiple buffer overflows in the esa_write function in /dev/seirenin the Exynos Seiren Audio driver, as used in Samsung S6 Edge, allow local users to cause a denial of service (memory corruption) via a large (1) buffer or (2) size parameter. 2020-02-12 not yet calculated CVE-2015-7890MISCMISCMISC sap -- business_objects_intelligence_platform Certain settings page(s) in SAP Business Objects Business Intelligence Platform (CMC), version 4.2, generates error messages that can give enterprise private-network related information which would otherwise be restricted leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6189MISCMISC sap -- enterprise_resource_planning_and_s/4hana   VAT Pro-Rata reports in SAP ERP (SAP_APPL versions 600, 602, 603, 604, 605, 606, 616 and SAP_FIN versions 617, 618, 700, 720, 730) and SAP S/4 HANA (versions 100, 101, 102, 103, 104) do not perform necessary authorization checks for an authenticated user leading to Missing Authorization Check. 2020-02-12 not yet calculated CVE-2020-6188MISCMISC sap -- host_agent SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability. 2020-02-12 not yet calculated CVE-2020-6183MISCMISC sap -- host_agent   SAP Host Agent, version 7.21, allows an attacker to cause a slowdown in processing of username/password-based authentication requests of the SAP Host Agent, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6186MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root privileges in SAP Host Agent via SAP Landscape Management. 2020-02-12 not yet calculated CVE-2020-6192MISCMISC sap -- landscape_management   SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to Missing Input Validation. 2020-02-12 not yet calculated CVE-2020-6191MISCMISC sap -- mobile_platform   SAP Mobile Platform, version 3.0, does not sufficiently validate an XML document accepted from an untrusted source which could lead to partial denial of service. Since SAP Mobile Platform does not allow External-Entity resolving, there is no issue of leaking content of files on the server. 2020-02-12 not yet calculated CVE-2020-6177MISCMISC sap -- netweaver   SAP NetWeaver (Guided Procedures), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently validate an XML document input from a compromised admin, leading to Denial of Service. 2020-02-12 not yet calculated CVE-2020-6187MISCMISC sap -- netweaver   SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6193MISCMISC sap -- netweaver_and_abap_platform   Under some circumstances the SAML SSO implementation in the SAP NetWeaver (SAP_BASIS versions 702, 730, 731, 740 and SAP ABAP Platform (SAP_BASIS versions 750, 751, 752, 753, 754), allows an attacker to include invalidated data in the HTTP response header sent to a Web user, leading to HTTP Response Splitting vulnerability. 2020-02-12 not yet calculated CVE-2020-6181MISCMISC sap -- netweaver_and_s/4hana Under certain conditions, ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), does not sufficiently encode user-controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability. 2020-02-12 not yet calculated CVE-2020-6184MISCMISC sap -- netweaver_and_s/4hana   Under certain conditions ABAP Online Community in SAP NetWeaver (SAP_BASIS version 7.40) and SAP S/4HANA (SAP_BASIS versions 7.50, 7.51, 7.52, 7.53, 7.54), allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability. 2020-02-12 not yet calculated CVE-2020-6185MISCMISC sap -- netweaver_as_java   Certain vulnerable endpoints in SAP NetWeaver AS Java (Heap Dump Application), versions 7.30, 7.31, 7.40, 7.50, provide valuable information about the system like hostname, server node and installation path that could be misused by an attacker leading to Information Disclosure. 2020-02-12 not yet calculated CVE-2020-6190MISCMISC shaman -- shaman   Shaman 1.0.9: Users can add the line askforpwd=false to his shaman.conf file, without entering the root password in shaman. The next time shaman is run, root privileges are granted despite the fact that the user never entered the root password. 2020-02-12 not yet calculated CVE-2011-4338MISCMISC siemens -- multiple_devices   A vulnerability has been identified in Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller (All versions), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 (All Versions < V4.5), Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P (All Versions < V4.6), PROFINET Driver for Controller (All Versions < V2.1), RUGGEDCOM RM1224 (All versions < V4.3), SCALANCE M-800 / S615 (All versions < V4.3), SCALANCE W700 IEEE 802.11n (All versions

Read more »

Cryptocurrency 101 – Part 1: Blockchain and basic concepts
This is the first in a series of articles exploring Bitcoin, cryptocurrencies and their fundamental technologies, and how you might find these technologies useful and use them safely. You’ve likely heard about Bitcoin, which is a type of cryptocurrency or digital currency, and perhaps you’ve wondered what all the fuss is about. What exactly are […]

Read more »

A Light at the End of Liberty Reserve’s Demise?
In May 2013, the U.S. Justice Department seized Liberty Reserve, alleging the virtual currency service acted as a $6 billion financial hub for the cybercrime world. Prompted by assurances that the government would one day afford Liberty Reserve users a chance to reclaim any funds seized as part of the takedown, KrebsOnSecurity filed a claim shortly thereafter to see if and when this process might take place. This week, an investigator with the U.S. Internal Revenue service finally got in touch to discuss my claim.

Read more »

Back on sale! Apple’s new Mac Pro for $5499, $500 off MSRP...
B&H Photo has the base 2019 Mac Pro (3.5GHz 8-Core Xeon, 32GB RAM, 256GB SSD) in stock today and on sale for $5499 including free overnight delivery to many addresses in the US. Their price is $500 off Apple’s MSRP, and it’s the cheapest price currently available for a new Mac Pro anywhere. Multiple custom configurations are also available for order, although only a few are in stock and ready for shipping. See their site for details. Keep an eye on our Mac Pro Price Tracker, as well as our Pro Display XDR Price Tracker, for the latest prices & deals from Apple and → Read More...

Read more »

B&H offers $100 discount on base 13″ 1.4GHz Apple MacB...
B&H Photo has new 2019 13″ 1.4GHz MacBook Pros on sale for $100 off Apple’s MSRP today with prices starting at $1199. Overnight shipping is free to many addresses in the US. These are the same MacBook Pros sold by Apple in their retail and online stores. B&H’s prices are the lowest available for new 13″ MacBook Pros: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1199 $100 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1199.99 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1399 $100 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1399.99 $100 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple continues to offer Certified Refurbished iPhone XS mod...
Apple has Certified Refurbished iPhone XS models available for up to $350 off MSRP, with prices starting at $699. Each iPhone is unlocked and comes with Apple’s standard one-year warranty and a new outer case. Multiple colors are available: – 64GB iPhone XS: $699 save $200 – 256GB iPhone XS: $829 save $230 – 512GB iPhone XS: $999 save $350 – 64GB iPhone XS Max: $799 save $200 – 256GB iPhone XS Max: $929 save $230 – 512GB iPhone XS Max: $1099 → Read More...

Read more »

Apple AirPods are on sale for $30 off today
Amazon has new 2019 Apple AirPods (non-Pro models) on sale today for $30 off MSRP, starting at $129. Shipping is free: – AirPods with Wireless Charging Case: $169 $30 off MSRP – AirPods with Charging Case: $129.98 $30 off MSRP See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

27″ 3.7GHz 6-Core 5K iMac on sale for $2099, $200 off Appl...
B&H Photo has the 2019 27″ 3.7GHz 6-Core 5K iMac in stock today and on sale for $200 off Apple’s MSRP. Overnight shipping is free to many locations in the US: – 27″ 3.7GHz 6-Core 5K iMac: $2099 $200 off MSRP See our iMac Price Tracker for the latest sales and prices from Apple and → Read More...

Read more »

Save up to $250 on a 12.9″ iPad Pros with these Certified ...
Apple has Certified Refurbished 12.9″ iPad Pros available on their online store for up to $250 off the cost of new models. Prices start at $849. Each iPad comes with a standard Apple one-year warranty, outer cases are new, and shipping is free. The following configurations are available: – 12.9″ 64GB WiFi iPad Pro: $849 $150 off – 12.9″ 256GB WiFi iPad Pro: $979 $170 off – 12.9″ 512GB WiFi iPad Pro: $1149 $180 off – 12.9″ 1TB WiFi iPad Pro: $1319 $230 off – 12.9″ 64GB WiFi + Cellular iPad Pro: $979 $170 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1109 $190 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1279 $220 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1449 $250 off Keep an eye on our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Save up to $220 on 11″ iPad Pros with these refurbished mo...
Apple has Certified Refurbished 11″ iPad Pros available on their online store for up to $220 off the cost of new models. Prices start at $679. Each iPad comes with a standard Apple one-year warranty, outer cases are new, and shipping is free. The following configurations are available: – 11″ 64GB WiFi iPad Pro: $679 $120 off – 11″ 256GB WiFi iPad Pro: $809 $140 off – 11″ 512GB WiFi iPad Pro: $979 $170 off – 11″ 1TB WiFi iPad Pro: $1149 $200 off – 11″ 256GB WiFi + Cellular iPad Pro: $939 $160 off – 11″ 512GB WiFi + Cellular iPad Pro: $1109 $190 off – 11″ 1TB WiFi + Cellular iPad Pro: $1279 $220 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

8-Core 27″ iMac Pro available for $4249, Certified Refurbi...
Apple has Certified Refurbished 27″ 3.2GHz 8-Core iMac Pros available for $4249 including free shipping. Their price is $750 off the cost of new models. A standard Apple one-year warranty is included. Apple’s refurbished price is the cheapest currently available for an iMac Pro from → Read More...

Read more »

$749 MacBook Airs continue to be available on Amazon
Amazon has the 2017 13″ 1.8GHz/128GB MacBook Air on sale today for only $749 shipped. That’s $250 off Apple’s original MSRP for this model and the cheapest new MacBook available from any Apple reseller. These are new, unopened clearance MacBook Airs. Keep an eye on our MacBook Air Price Tracker for the latest sales & deals from Apple and → Read More...

Read more »

HomePods on sale for $204 at Other World Computing, $95 off ...
Other World Computing has discounted, new, Apple HomePods on sale for up to $95 off Apple’s MSRP: – HomePod Space Gray: $207.99 $92 off MSRP – HomePod White: $204.99 $95 off MSRP These are the same HomePods sold by Apple in their retail and online stores. Keep an eye on our HomePod Price Tracker for the latest deals and sales from Apple and → Read More...

Read more »

Get a Certified Refurbished iMac at Apple for as little as $...
Apple has Certified Refurbished 2019 21″ & 27″ iMacs available starting at $929 and up to $350 off the cost of new models. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are available: – 27″ 6-Core 3.7GHz iMac (MRR12LL/A): $1949 $350 off MSRP – 27″ 6-Core 3.6GHz iMac (MRR02LL/A): $1699 $300 off MSRP – 27″ 6-Core 3.0GHz iMac (MRQY2LL/A): $1529 $270 off MSRP – 21″ 6-Core 3.0GHz iMac (MRT42LL/A): $1269 $230 off MSRP – 21″ 4-Core 3.6GHz iMac (MNDY2LL/A): $1099 $200 off MSRP – 21″ 2-Core 2.3GHz iMac (MMQA2LL/A): $929 $170 off MSRP Multiple configurations of custom iMacs are also available. Their prices are the cheapest available for 2019 iMacs anywhere. For more information, see our iMac Price Tracker, → Read More...

Read more »

A Look Back At The Top 5 Most Read Stories Of 2019 In The �...
FEATURE: 02.21.20 The best of the best are now history and we’re not talking about Super Bowl LIV from earlier this month but rather, coverage from the past year (its second and first full one at that) of the “Mac Potpourri” column where today we share and take a look back at the most read stories of this writer from 2019 here on MacPrices (returning, I might add, after another short writing hiatus). When you click on the link to any one of my articles, you are just a single individual of many out there in the worldwide web who are reading that story. While some websites show how many page views an article has received, the “Mac Potpourri” column currently does not have that feature — although it does have a Facebook plugin that shows how many likes from readers (which is not an accurate representation of the total number of actual hits) — but behind the scenes, however, we receive those statistics from WordPress, the system that our site is built upon. And that leads us to a short list of data which includes the articles and the number of page views or total hits it has received. From January to December of last year, the following are the top five most read stories of 2019 here in the “Mac Potpourri” column. No. 1: 24,336 Total Hits “With The New iPadOS, Apple Is Paving The Way For A Merger Of iOS & MacOS” EDITORIAL: 07.26.19- The advent of the new iPadOS, — a hybrid-like operating system that is part mobile and part desktop, further blurs the lines between iOS, “the world’s most advanced mobile operating system,” and MacOS, “the world’s most advanced desktop operating system,” and this latest move by Apple suggests that an impending merger of its two operating systems is on the horizon, something that continues to look even more likely than ever before (if not definitely). … • www.macprices.net/2019/07/26/with-the-new-ipados-apple-is-paving-the-way-to-a-forthcoming-merger-of-ios-macos/ No. 2: 15,450 Total Hits “iPhone SE Successor Possibly To Come In Form Of New 4.8-inch ‘XE’ Model” NEWS: 04.15.19- Current owners of the iPhone SE who are fans of the smaller 4-inch form factor in Apple’s smartphone → Read More...

Read more »