The New MacBook Pro is $100 Less on Amazon than Apple
Just a few days after the release of the new 16-inch MacBook Pro, Amazon has dropped the price of the Apple product $100 less than what it’s going for on… The post appeared first on iLounge.

Read more »

Ex-Apple executives take aim at datacenter processor market
A trio of former Apple executives who worked on the iPhone maker's mobile chips have launched their own startup to design processors destined for use in data centers, with the company Nuvia recently raising $53 million in funding.

Read more »

The New MacBook Pro keyboard is a throwback in the best way
It's also an admission, tacit or otherwise, that Apple made a mistake with the butterfly keyboard. Rest assured, this "new" design will be in all future Apple laptops.∞ Read this on The Loop

Read more »

This researcher created an algorithm that removes the water ...
If you've ever taken underwater photos, you'll know the results are generally pretty disappointing. This technology could change that.∞ Read this on The Loop

Read more »

Apple Orders Up ‘Slow Horses’ For Apple TV+
Apple will be making a new Apple TV+ show called ‘Slow Horses’, with Gary Oldman being cast as the main actor. The show comes from a book with the same… The post appeared first on iLounge.

Read more »

16-inch MacBook Pro beats predecessors by overcoming thermal...
The just-released 16-inch MacBook Pro handles heat better, giving it faster performance than the 15-inch models introduced earlier this year, even though both laptops use exactly the same processor. Earlier benchmarks found that these two devices scored the same on Geekbench 5. But Max Bench did comparison tests after first forcing each processor to heat […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple To Remove Vaping-Related Apps Due to Public Health Con...
Due to public health concerns, Apple will be removing all apps that are related to vaping at the App Store. The Cupertino-based company released a statement, saying that they agree… The post Apple To Remove Vaping-Related Apps Due to Public Health Concerns appeared first on iLounge.

Read more »

New MacBook Pro Getting a Teardown on iFixit Website
The new MacBook Pro, which has been recently made available to the public will be getting a teardown by iFixit, known for dismantling tech devices and sharing the video on… The post appeared first on iLounge.

Read more »

Sayonara Wild Hearts is Apple Arcade’s wildest ride [Revie...
Speed and techno-pop blend in Sayonara Wild Hearts, one of the best titles on Apple Arcade. Ride a motorcycle, fly or battle opponents to the beat of the music. Read on to see why everyone with a subscription to Apple’s gaming service should be playing this new offering. Annapurna Sayonara Wild Hearts review There’s a […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

16-inch MacBook Pro is here at last! [Cult of Mac Magazine 3...
Apple unleashed the 16-inch MacBook Pro this week, delivering a powerful beast of a machine that answers many of our prayers. That butterfly keyboard? Gone, replaced with a Magic Keyboard. And those thermal throttling problems? Supposedly fixed forever. Sure, we found a couple of not-so-happy surprises. But all in all, we feel just a little […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Teardown shows 16-inch MacBook Pro keyboard’s revised ...
An initial teardown of the 16-inch MacBook Pro offers a close examination of the new keyboard mechanism used in the model, with the scissor mechanism deemed to be a massive improvement over the prior butterfly mechanism.

Read more »

Consumer Reports: AirPods Pro pack ‘significant’ sound q...
AirPods Pro have earned widespread praise since their release last month thanks to sound quality improvements, noise cancellation, and more. Consumer Reports is now out with its full review of AirPods Pro, and those improvements seemingly aren’t enough to take the top-rated crown from Samsung. more… The post Consumer Reports: AirPods Pro pack ‘significant’ sound quality upgrades, but Galaxy Buds still best appeared first on 9to5Mac.

Read more »

Today in Apple history: Steve Jobs secures Macintosh name
November 16, 1982: Intent on calling Apple’s upcoming personal computer the “Macintosh,” Steve Jobs pens an impassioned plea to audio company McIntosh Laboratory asking permission to use the name. You can probably guess how the resulting discussions turned out! The McIntosh computer? Before the iPhone, the Macintosh was Apple’s most iconic product name. The only […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Dad explains how the Apple Watch Noise app changed the life ...
Over the years, we’ve heard many stories about the Apple Watch has changed people’s lives through its fitnesses and health features. This weekend, a new feature from People tells the story of how the Noise app in watchOS 6 has helped a 21-year-old in Texas with autism improve his social skills. more… The post Dad explains how the Apple Watch Noise app changed the life of his son with autism appeared first on 9to5Mac.

Read more »

Defense Vertical Duo Charger – $10 Off [Sponsorship]
Please join us in thanking Defense by X-Doria as our sponsor here at TMO this week. Defense makes all kinds of great accessories for your Apple devices, including iPhone and AirPods cases, Apple Watch Bands, and wireless charging solutions. And, as you’ve probably seen from the site this week, the Defense Vertical Duo Charger is a great-looking, multi-functional wireless charger.

Read more »

Apple @ Work: Privileges for macOS is the open source tool t...
I’ve heard for years that you shouldn’t use your Mac with administrator privileges. I 100% agree with that statement, and I still use my Mac with administrator privileges. But to be perfectly honest, it’s just sort of inconvenient. In the enterprise, running as an administrator can certainly be against company policy, and depending on what environment you operate in, you may be out of compliance with industry regulations or customer contracts. But thanks to an open source tool (Privileges for macOS) from SAP, Apple focused enterprises now have a great solution.  more… The post Apple @ Work: Privileges for macOS is the open source tool that all Apple IT departments need appeared first on 9to5Mac.

Read more »

Tim Cook and President Trump set to visit Texas on Wednesday...
Earlier this week, a report suggested that President Trump and Tim Cook would make a trip to Austin, Texas together sometime in the future. Now, Reuters reports that the trip will take place on Wednesday, November 20. more… The post Tim Cook and President Trump set to visit Texas on Wednesday, tour Mac Pro facilities appeared first on 9to5Mac.

Read more »

Apple files for patent for an ambidextrous mouse
Apple is looking into ways to improve the mouse for use with its Macs (and, hopefully one day, iPads). The company has filed for a patent (number 10,474,251) for an ambidextrous mouse configured for both left and right handed use. 

Read more »

Notable apps and updates, Nov. 11-16
On a regular basis, Apple World Today posts a list of notable new apps or app updates that have been released. They may not necessarily be new, but they're popular and deserve mention. Here are this week’s picks.

Read more »

Get your iPhone or Apple Watch charged with the Wireless Cha...
iLounge has a special deal on the Wireless Charging Mouse Pad, which allows you to get an ultra-useful accessory that can save space and juice up your gadgets. At first… The post Get your iPhone or Apple Watch charged with the Wireless Charging Mouse Pad appeared first on iLounge.

Read more »

Juice Up Your Apple Watch and iPhone in Style with the Belki...
Need a functional charging accessory for your nightstand, one that looks just as stylish as your Apple Watch or iPhone? The Belkin Powerhouse is the perfect choice, and right now… The post Juice Up Your Apple Watch and iPhone in Style with the Belkin Powerhouse at $20 Off appeared first on iLounge.

Read more »

Apple TV+: ‘See’ Is a Great Show that Transcends Its Cap...
Apple TV+’s See has a lot going on for it on the surface, but beneath that surface is a show about people, relationships, politics, and a reality that challenges most of us to think differently.

Read more »

Germany Forces Apple To Let Other Mobile Wallet Services Use...
A new German law passed yesterday requires Apple to allow other mobile payments services access to the iPhone's NFC chip for payments to allow them to fully compete with Apple Pay. 9to5Mac reports: Apple initially completely locked down the NFC chip so that it could be used only by Apple Pay. It later allowed some third-party apps to use the chip but has always refused to do so for other mobile payment apps. Reuters reports that the law doesn't name Apple specifically, but would apply to the tech giant. The piece somewhat confusingly refers to access to the NFC chip by third-party payment apps as Apple Pay. "A German parliamentary committee unexpectedly voted in a late-night session on Wednesday to force the tech giant to open up Apple Pay to rival providers in Germany," reports Reuters. "This came in the form of an amendment to an anti-money laundering law that was adopted late on Thursday by the full parliament and is set to come into effect early next year. The legislation, which did not name Apple specifically, will force operators of electronic money infrastructure to offer access to rivals for a reasonable fee." Apple says that the change would be harmful: "We are surprised at how suddenly this legislation was introduced. We fear that the draft law could be harmful to user friendliness, data protection and the security of financial information." Read more of this story at Slashdot.

Read more »

Apple Research App Now Available in the US
Apple announces that they will be launching the Research app today in the US, which already has three studies for hearing, women’s health and heart and movement. Interested individuals will… The post appeared first on iLounge.

Read more »

Apple Enthusiasts Recreate Catalina Wallpaper Despite Challe...
A trio of friends have tried to recapture all the default wallpapers in macOS. Andrew Levitt, a photographer and YouTube personality was joined by Taylor Gray and Jacob Phillips in… The post Apple Enthusiasts Recreate Catalina Wallpaper Despite Challenging Terrain appeared first on iLounge.

Read more »

Apple Pay Promo Gives Snapfish Card Buyers 75% Off
Apple has released a new promo for its Apple Pay platform, with Snapfish cards getting a massive 75% discount. Snapfish is a photo-printing and sharing platform on the internet. To… The post appeared first on iLounge.

Read more »

Protecting Your iPhone
Dr. Mac used to eschew protecting his iPhones in any way, but after he scratched one iPhone and cracked the screen of another, he changed his tune…

Read more »

‘The Mandalorian’ could be the best TV Western since ‘...
OK, this is just crazy talk. Justified was one of the best TV series ever and we're only two episodes in to The Mandalorian. Make no mistake - I loved Justified and I mildly enjoyed The Mandalorian but it will take quite a bit more for the latter to match up to the former.∞ Read this on The Loop

Read more »

Using the Delta Airlines App and Apple Business Chat in a Sn...
On a recent delay- and cancellation-plagued trip, Adam Engst found that the most effective resources for dealing with rebooking flights and getting questions answered were the Delta iPhone app and the company’s Business Chat-based support reps.

Read more »

MacBook Pro Teardown Confirms the New Keyboard Is Basically ...
iFixit's teardown of the new 16-inch MacBook Pro confirms that the keyboard uses the more reliable scissor-style switches that Apple first introduced in its Magic Keyboards in 2015. The Verge reports: The switches on the 16-inch MacBook Pro are so similar to the standalone keyboard, in fact, that iFixit's report says that keys are interchangeable between the two products. The change comes after a long, multiyear debate between Apple and customers over the butterfly switches, causing Apple to revamp the mechanism multiple times to block debris and add extra strength. Apple was also forced to acknowledge that the keyboards were problematic, and offered an extended warranty program for those laptops. Per iFixit, the new keys also have more travel when you press them (about 0.5 mm more), and the keycaps themselves are about 0.2 mm thicker compared to the much-maligned butterfly switches. The teardown also notes that the clips that attach the keycaps to the switches appear to be more reinforced to make it easier to remove or replace them down the line. Read more of this story at Slashdot.

Read more »

Orcus RAT Author Charged in Malware Scheme
In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with orchestrating an international malware scheme.

Read more »

Patch Tuesday, November 2019 Edition
Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and in software that runs on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploited in the wild, as well as a sneaky bug in certain versions of Office for Mac that bypasses security protections and was detailed publicly prior to today's patches.

Read more »

Retailer Orvis.com Leaked Hundreds of Internal Passwords on ...
Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

Read more »

Vulnerability Summary for the Week of November 4, 2019
Original release date: November 11, 2019 | Last revised: November 12, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2019-11-01 7.5 CVE-2011-3923MISCEXPLOIT-DBBIDMISCMISCXFMISC aruba_networks -- clearpass_policy_manager Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. 2019-11-06 10 CVE-2016-4401CONFIRM clamav -- clamav There is a possible heap overflow in libclamav/fsg.c before 0.100.0. 2019-11-06 7.5 CVE-2007-0899MISC computing_for_good -- basic_laboratory_information_system Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. 2019-11-06 7.5 CVE-2019-5617MISC computing_for_good -- basic_laboratory_information_system   Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator. 2019-11-06 7.5 CVE-2019-5644MISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview 2019-11-04 7.5 CVE-2013-2259MISCMISCMISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input 2019-11-04 7.5 CVE-2013-4103MISCMISCMISCMISCMISC gri -- gri gri before 2.12.18 generates temporary files in an insecure way. 2019-11-08 7.5 CVE-2008-7291MISC isl_internet_sicherheitslösungen -- arp_guard A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. 2019-11-04 7.5 CVE-2019-18663MISC linux -- linux_kernel A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. 2019-11-07 7.8 CVE-2019-18812MISC linux -- linux_kernel A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.33 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. 2019-11-07 7.8 CVE-2010-2243MISCCONFIRMMISCMLIST linux -- linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. 2019-11-07 7.5 CVE-2019-18814MISC linux -- linux_kernel A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. 2019-11-07 7.8 CVE-2019-18813MISC linux -- linux_kernel An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. 2019-11-04 7.8 CVE-2019-18680MISCMISCMISCMISC linux -- linux_kernel An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. 2019-11-07 7.5 CVE-2019-18805MISCMISC linux -- linux_kernel A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. 2019-11-07 7.8 CVE-2019-18810MISCMISC linux -- linux_kernel A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. 2019-11-07 7.8 CVE-2019-18809MISC linux -- linux_kernel A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. 2019-11-07 7.8 CVE-2019-18811MISC linux-vserver -- linux-vserver linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. 2019-11-06 10 CVE-2006-4243MISC magento -- magento A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods. 2019-11-06 7.5 CVE-2019-8144MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection. 2019-11-06 9 CVE-2019-8159MISC magento -- magento An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities. 2019-11-05 7.5 CVE-2019-8121MISC magento -- magento An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component. 2019-11-06 7.5 CVE-2019-8136MISC magento -- magento An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. 2019-11-06 7.5 CVE-2019-8158MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. 2019-11-06 7.5 CVE-2019-8135MISC minidlna -- minidlna MiniDLNA has heap-based buffer overflow 2019-11-01 7.5 CVE-2013-2739MISCMISC minidlna -- minidlna minidlna has SQL Injection that may allow retrieval of arbitrary files 2019-11-01 7.5 CVE-2013-2738MISCMISCMISCMISC nvu -- nvu Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues. 2019-11-05 7.5 CVE-2005-2354MISCMISCMISC php-gettext -- php-gettext The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. 2019-11-04 7.5 CVE-2015-8980SUSEMLISTMLISTBIDCONFIRMCONFIRMCONFIRM portainer -- portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). 2019-11-07 9 CVE-2019-16872MISC python_sofware_foundation_and_beanbag -- djblets_and_review_board An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. 2019-11-04 7.5 CVE-2013-4409MISCMISCMISCMISCMISCMISCMISCMISCMISCMISC qualcomm -- multiple_products Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10528CONFIRM qualcomm -- multiple_products Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10533CONFIRM qualcomm -- multiple_products Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10505CONFIRM qualcomm -- multiple_products While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 7.5 CVE-2019-10522CONFIRM qualcomm -- multiple_products While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8976, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM8150 2019-11-06 7.5 CVE-2019-2302CONFIRM qualcomm -- multiple_products Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20 2019-11-06 7.5 CVE-2019-10542CONFIRM qualcomm -- multiple_products Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130 2019-11-06 7.5 CVE-2019-10565CONFIRM qualcomm -- multiple_products Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10541CONFIRM qualcomm -- multiple_products Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10534CONFIRM qualcomm -- multiple_products Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439 2019-11-06 10 CVE-2019-10531CONFIRM qualcomm -- multiple_products Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 9.3 CVE-2019-10529CONFIRM qualcomm -- multiple_products Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9205, MDM9650, QCA8081, QCS605, SD 427, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2249CONFIRM qualcomm -- multiple_products Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2283CONFIRM qualcomm -- multiple_products Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2258CONFIRM qualcomm -- multiple_products Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 2019-11-06 7.2 CVE-2019-2246CONFIRM qualcomm -- multiple_products When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24 2019-11-06 10 CVE-2019-2324CONFIRM qualcomm -- multiple_products Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2325CONFIRM qualcomm -- multiple_products Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2285CONFIRM qualcomm -- multiple_products Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2332CONFIRM qualcomm -- multiple_products Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2323CONFIRM qualcomm -- multiple_products Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2331CONFIRM quest -- kace_systems_management_appliance_server_center Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. 2019-11-06 7.5 CVE-2019-12918MISCMISC rbot -- rbot Rbot Reaction plugin allows command execution 2019-11-06 7.5 CVE-2010-2446MISCMISC red_hat -- openshift cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. 2019-11-01 7.5 CVE-2013-0165MISC s9y -- serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. 2019-11-05 7.5 CVE-2011-1134CONFIRMDEBIANSECTRACKMISC salesagility -- suitecrm SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. 2019-11-06 7.5 CVE-2019-18784MISCMISC shadow_and_sudo -- shadow_and_sudo There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process. 2019-11-04 7.2 CVE-2005-4890MISCMISCMISCMISCMISCMISCMISCMISCMISCMISCMISC sonatype  -- nexus_repository_manager There is an OS Command Injection in Nexus Repository Manager 2019-11-07 not yet calculated CVE-2019-12331CONFIRMMISC python_packaging_authority -- python_package_installer The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. 2019-11-05 not yet calculated CVE-2013-5123MISCMISCMISCMISCMISCMISCMISCMISC rapid7 -- metasploit_pro Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. 2019-11-06 not yet calculated CVE-2019-5642CONFIRM red_hat -- 389_directory_server A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 2019-11-08 not yet calculated CVE-2019-14824CONFIRM red_hat -- enterprise_linux_5 frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user. 2019-11-07 not yet calculated CVE-2008-3278MISCMISCMISC red_hat -- jboss_operations_network In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. 2019-11-08 not yet calculated CVE-2008-5083MISCMISC red_hat -- tuned tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. 2019-11-08 not yet calculated CVE-2013-1820MISCMISCMISC red_hat -- virtualization_manager In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform. 2019-11-09 not yet calculated CVE-2009-3552MISCMISCBUGTRAQ samba -- samba A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. 2019-11-06 not yet calculated CVE-2019-14833SUSECONFIRMMISC samba -- samba A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. 2019-11-06 not yet calculated CVE-2019-10218SUSECONFIRMMISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status. 2019-11-06 not yet calculated CVE-2019-16401MISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. 2019-11-06 not yet calculated CVE-2019-16400MISC shibboleth -- shibboleth_service_provider The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default. 2019-11-07 not yet calculated CVE-2010-2450MISCMISCCONFIRM simplesamlphp -- simplesamlphp Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. 2019-11-07 not yet calculated CVE-2019-3465MISCMLISTBUGTRAQMISCDEBIAN simplesamlphp -- simplesamlphp simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. 2019-11-06 not yet calculated CVE-2011-4625MISCMISC strapi -- strapi strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. 2019-11-07 not yet calculated CVE-2019-18818MISCMISCMISC syscp -- syscp syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot. 2019-11-07 not yet calculated CVE-2010-2476MISCMISCMLIST tahoe-lafs -- tahoe-lafs Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. 2019-11-07 not yet calculated CVE-2012-0051MISCMISCMISCMISCMISCCONFIRM termpkg -- termpkg termpkg 3.3 suffers from buffer overflow. 2019-11-06 not yet calculated CVE-2006-3100MISCMISC tmaxsoft -- jeus JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file. 2019-11-08 not yet calculated CVE-2019-17327MISC veritas -- multiple_products An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. 2019-11-05 not yet calculated CVE-2019-18780MISCMISCMISCMISC viber -- viber Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 16 bytes of udid in a binary format, which is located at approximately offset 0x40 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS. 2019-11-06 not yet calculated CVE-2019-18800MISC wolfssl -- wolfssl In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free. 2019-11-09 not yet calculated CVE-2019-18840MISC wordpress -- wordpress A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. 2019-11-08 not yet calculated CVE-2019-17661MISC zte -- mf910s_router Security researcher Shen Ying from the Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. 2019-11-07 not yet calculated CVE-2019-3422CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations. 2019-11-08 not yet calculated CVE-2019-3426CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts. 2019-11-08 not yet calculated CVE-2019-3425CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Study: Ransomware, Data Breaches at Hospitals tied to Uptick...
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security -- or the lack thereof -- may be impacting patient outcomes.

Read more »

Researchers use lasers to hack Siri, Alexa, Google assistant...
Researchers have used programmable low-powered lasers to remotely control voice-activated personal assistants like Apple's Siri, Amazon's Alexa, and Google Assistant from up to 360 feet away. These attacks exploit a vulnerability in microphones using micro-electro-mechanical systems (MEMS), which the researchers have discovered will respond to lasers the same way they will respond to sound. The […]

Read more »

Apple updates its privacy page with sleek new look
A company’s privacy page usually reads like it was written by lawyers—because it usually is. Information is rarely presented in a way that laypeople can understand, and as for making it both easy to consume and easy on the eyes? Forget it. Apple’s new privacy page thinks different. It presents the company’s privacy info in plain […]

Read more »

iPad vs. MacBook: is iPadOS a game changer?
It took Apple more than nine years to recognize that the iPhone and iPad were different enough to warrant separate operating systems: iOS 13 and iPadOS 13. Now, with the changes in the new iPadOS, an iPad could replace a laptop for many people. iPadOS may really be a game changer for mobile computing. But just how effectively can an iPad replace a MacBook?

Read more »

Red Hat Security Advisory 2019-3513-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Read more »

Vulnerability Summary for the Week of October 28, 2019
Original release date: November 4, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- experience_manager   Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution. 2019-10-25 7.5 CVE-2019-8088CONFIRM apache -- thrift In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings. 2019-10-29 7.8 CVE-2019-0205MISC bitlbee -- bitlbee   Bitlbee does not drop extra group privileges correctly in unix.c 2019-10-29 7.5 CVE-2012-1187MISCMISCMISCMISC cisco -- video_communications_server   Cisco Video Communications Server (VCS) before X7.0.3 contains a command injection vulnerability which allows remote, authenticated attackers to execute arbitrary commands. 2019-10-29 9 CVE-2011-2538CONFIRM codesys -- eni_server   CODESYS V2.3 ENI server up to V3.2.2.24 has a Buffer Overflow. 2019-10-25 7.5 CVE-2019-16265CONFIRMMISC d-link -- dir-865   D-Link DIR-865L has PHP File Inclusion in the router xml file. 2019-10-25 7.5 CVE-2013-4857MISCMISC d-link -- dir-865l_devices   D-Link DIR-865L has SMB Symlink Traversal due to misconfiguration in the SMB service allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 7.9 CVE-2013-4855MISCMISCMISC debian_project -- qtparted   qtparted has insecure library loading which may allow arbitrary code execution 2019-10-29 7.5 CVE-2010-3375DEBIANMISCMISC google -- chrome   browser/extensions/api/dial/dial_registry.cc in Google Chrome before 54.0.2840.98 on macOS, before 54.0.2840.99 on Windows, and before 54.0.2840.100 on Linux neglects to copy a device ID before an erase() call, which causes the erase operation to access data that that erase operation will destroy. 2019-10-25 7.5 CVE-2016-5202MISCMISCMISCMISCMISC hot-world -- repetier-server A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-28 10 CVE-2019-14450CONFIRMMISC hot-world -- repetier-server   RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450, an attacker can upload an "external command" configuration as a printer configuration, and achieve remote code execution. After exploitation, loading of the external command configuration is dependent on a system reboot or service restart. 2019-10-25 10 CVE-2019-14451CONFIRMMISC intrasrv -- intrasrv   A remote SEH buffer overflow has been discovered in IntraSrv 1.0 (2007-06-03). An attacker may send a crafted HTTP GET or HEAD request that can result in a compromise of the hosting system. 2019-10-28 10 CVE-2019-17181MISCMISC jetbrains -- teamcity In JetBrains TeamCity before 2019.1.4, insecure Java Deserialization could potentially allow remote code execution. 2019-10-31 7.5 CVE-2019-18364CONFIRM k7_computing -- antivirus_premium_and_total_security_and_ultimate_security   In K7 Antivirus Premium 16.0.xxx through 16.0.0120; K7 Total Security 16.0.xxx through 16.0.0120; and K7 Ultimate Security 16.0.xxx through 16.0.0120, the module K7TSHlpr.dll improperly validates the administrative privileges of the user, allowing arbitrary registry writes in the K7AVOptn.dll module to facilitate escalation of privileges via inter-process communication with a service process. 2019-10-28 7.5 CVE-2019-16897MISC labf -- nfsaxe_ftp_client   Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. 2019-10-25 7.5 CVE-2017-14742EXPLOIT-DB linksys -- ea6500_router   Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. 2019-10-25 10 CVE-2013-4658MISCMISCMISC medoo -- medoo   columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. 2019-10-30 7.5 CVE-2019-10762MISCMISC mikrotik -- routeros   RouterOS 6.45.6 Stable, RouterOS 6.44.5 Long-term, and below insufficiently validate where upgrade packages are download from when using the autoupgrade feature. Therefore, a remote attacker can trick the router into "upgrading" to an older version of RouterOS and possibly reseting all the system's usernames and passwords. 2019-10-29 8.5 CVE-2019-3977MISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password. 2019-10-25 7.5 CVE-2016-2356MISCMISCMISC milesight -- ip_security_cameras   Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource. 2019-10-25 7.5 CVE-2016-2359MISCMISCMISC mitsubishi_electric_and_inea -- me-rtu_devices An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Undocumented hard-coded user passwords for root, ineaadmin, mitsadmin, and maint could allow an attacker to gain unauthorised access to the RTU. (Also, the accounts ineaadmin and mitsadmin are able to escalate privileges to root without supplying a password due to insecure entries in /etc/sudoers on the RTU.) 2019-10-28 10 CVE-2019-14930MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to the RTU's system shell. Functionality in mobile.php provides users with the ability to ping sites or IP addresses via Mobile Connection Test. When the Mobile Connection Test is submitted, action.php is called to execute the test. An attacker can use a shell command separator (;) in the host variable to execute operating system commands upon submitting the test data. 2019-10-28 10 CVE-2019-14931MISCMISC mitsubishi_electric_and_inea -- me-rtu_devices   An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. Hard-coded SSH keys allow an attacker to gain unauthorised access or disclose encrypted data on the RTU due to the keys not being regenerated on initial installation or with firmware updates. In other words, these devices use private-key values in /etc/ssh/ssh_host_rsa_key, /etc/ssh/ssh_host_ecdsa_key, and /etc/ssh/ssh_host_dsa_key files that are publicly available from the vendor web sites. 2019-10-28 7.5 CVE-2019-14926MISCMISC philips -- intellispace_perinatal   In IntelliSpace Perinatal, Versions K and prior, a vulnerability within the IntelliSpace Perinatal application environment could enable an unauthorized attacker with physical access to a locked application screen, or an authorized remote desktop session host application user to break-out from the containment of the application and access unauthorized resources from the Windows operating system as the limited-access Windows user. Due to potential Windows vulnerabilities, it may be possible for additional attack methods to be used to escalate privileges on the operating system. 2019-10-25 7.2 CVE-2019-13546MISC php -- php   In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. 2019-10-28 7.5 CVE-2019-11043REDHATREDHATREDHATREDHATCONFIRMMISCFEDORAFEDORAFEDORACONFIRMCONFIRMUBUNTUUBUNTUDEBIANDEBIAN pixelpost -- pixelpost   pixelpost 1.7.1 has SQL injection 2019-10-28 7.5 CVE-2009-4899MISCDEBIANMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 9 CVE-2019-16663MISCMISCMISCMISCMISC rconfig -- rconfig   An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution. 2019-10-28 10 CVE-2019-16662MISCMISCMISCMISCMISCMISC rittal -- rittal_chiller_sk_3232_series   Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb firmware A1.5.3 ? B1.2.4. The authentication mechanism on affected systems is configured using hard-coded credentials. These credentials could allow attackers to influence the primary operations of the affected systems, namely turning the cooling unit on and off and setting the temperature set point. 2019-10-25 10 CVE-2019-13553FULLDISCMISC sequelize -- sequelize   Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped for the MySQL/MariaDB dialects. 2019-10-29 7.5 CVE-2019-10748MISCMISCMISC sequelize -- sequelize   sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Postgres dialect. 2019-10-29 7.5 CVE-2019-10749MISCMISC snoopy -- snoopy e Snoopy before 2.0.0 has a security hole in exec cURL 2019-10-28 7.5 CVE-2002-2444MISCDEBIANMISC sugarcrm -- sugarcrm   SugarCRM CE

Read more »

NCR Barred Mint, QuickBooks from Banking Platform During Acc...
Banking industry giant NCR Corp. [NYSE: NCR] late last month took the unusual step of temporarily blocking third-party financial data aggregators Mint and QuicBooks Online from accessing Digital Insight, an online banking platform used by hundreds of financial institutions. That ban, which came in response to a series of bank account takeovers in which cybercriminals used aggregation sites to surveil and drain consumer accounts, has since been rescinded. But the incident raises fresh questions about the proper role of digital banking platforms in fighting password abuse.

Read more »

Weekend Sale: Apple AirPods Pro for $234.98 at Abt Electroni...
Abt Electronics has Apple’s new AirPods Pro in stock and on sale today for $234.98 including free shipping and free returns. Their price is $15 off Apple’s MSRP for these AirPods and tie Amazon & Sams Club as the lowest price available. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

New 2019 16″ MacBook Pros on sale for $100 off Apple’s M...
Apple Authorized Reseller Adorama has new 2019 16″ MacBook Pros on sale today for $100 off Apple’s MSRP, each including free shipping. In addition, Adorama charges sales tax for NY & NJ residents only: – 2019 16″ 2.6GHz 6-Core MacBook Pro (Space Gray or Silver): $2299 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro (Space Gray or Silver): $2699 $100 off MSRP Preorder today, and Adorama will delivery when they receive stock from Apple. These are the same 16″ MacBook Pros sold by Apple in their retail and online stores. Keep an eye on our 16″ MacBook Pro Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Apple Watch Series 3 GPS models on sale for lowest prices ev...
Amazon has Apple Watch Series 3 GPS models on sale starting at only $179. There prices are the lowest we’ve ever seen for these models from any Apple reseller. Choose Amazon as the seller rather than a third-party, and note that Amazon stock fluctuates, so be sure to check their site for the latest availability. Shipping is free: – 38mm Apple Watch Series 3 GPS: $179 $20 off MSRP – 42mm Apple Watch Series 3 GPS: $209 $20 off MSRP A limited supply remains available at these prices. Note that optional Apple Watch bands may be extra. For the latest prices from Apple and its resellers, see our Apple Watch → Read More...

Read more »

iOS Bug In Facebook News Feed Lets Device Camera Be Used Wi...
NEWS: 11.15.19- Users of the Facebook social media platform’s mobile app running on iOS devices won’t, like, this piece of news one bit in where a bug in the News Feed gave access to the camera while the unsuspecting individual simply scrolled through their daily posts unaware of the issue. The Facebook “like” icon shown here inverted to illustrate an opposite thumbs down reaction. (Photo: Facebook) Discovered by Joshua Maddux, CEO of 95Visual, a web design and development firm based out of Santa Clarita, California (a city located just north of Los Angeles which itself was placed inadvertently in the spotlight yesterday morning due to a tragedy), the chief executive officer posted a tweet on Twitter last Saturday that said he, according to Maddux himself, found a Facebook security and privacy issue where when the app is open it actively uses the camera. The rest of his post, which also included an embedded video, said the following: … I found a bug in the app that lets you see the camera open behind your feed. Note that I had the camera pointed at the carpet. The news of the discovery was one of the top tech stories running the gamut Wednesday through various media outlets such as CNN which alerted Facebook users — specifically on devices with the iOS mobile operating system installled (Android software appeared to be immune) — to restrict, temporarily, access to the camera until a fix for the bug was issued by the social media company. It was not immediately clear, nor was it specified, in the CNN report as to whether the problem was evident solely in the Facebook app for iOS or also when the social media platform is accessed on the web (e.g., Safari) while in the iOS environment. It also is unknown if the Facebook app running on iPadOS, the recently released spinoff of iOS for the iPad (naturally), is included. Furthermore, there was no word on what version(s) of → Read More...

Read more »

16″ MacBook Pros on sale! Preorder at Amazon today for $10...
Apple’s new 16″ MacBook Pros were only introduced yesterday, but Amazon is already offering a $100 discount on preorders. Prices for the base 6-Core 16″ MacBook Pros start at $2299: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2299.99 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2699.99 $100 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2299.99 $100 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2699.99 $100 off MSRP These MacBook Pros will ship for free once stock is received. Amazon is the first Apple reseller we track to offer discounts on 16″ MacBook Pros. See our 16″ and 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Use our exclusive MacBook Price Trackers to find today’s b...
Our Apple award-winning MacBook price trackers are the best place to look for the best sales & lowest prices on new and clearance MacBook Airs and MacBook Pros–including Apple’s new 16″ MacBook Pro. Scan our price trackers for the latest information on sales, bundles, and availability on systems from Apple’s authorized internet/catalog resellers. We update the trackers continuously: – 16″ & 15″ MacBook Pros – 13″ MacBook Pros – 13″ MacBook Airs – 12″ MacBooks (recently discontinued by Apple) We track new as well as Apple Certified Refurbished models. A full list of the available Apple price trackers is in the menu at the top of → Read More...

Read more »

New November Verizon iPhone deal: Get an iPhone Xr for 50% o...
Verizon has the 64GB iPhone Xr on sale for 50% off for a limited time, plus they will include a free $200 prepaid MasterCard and a free Amazon Echo Dot. That reduces their price for the 64GB iPhone Xr to $12.49 per month for 24 months and reduces the total cost of the phone by $300 over that period.. New line of service required. Here are the details: – Add iPhone XR to your cart as a new line with monthly device or full retail price payments – Get your $300 credited to your account over 24 months. – Plus, you’ll get a $200 Prepaid Mastercard when you switch to Verizon on Unlimited. – Get a free Echo Dot and Amazon Smart Plug when you switch to Verizon on Unlimited. The fine print: “Up to $749.99 device payment purchase per phone w/1 new smartphone line + Unlimited required. 2nd phone must be of equal or lesser value. Less up to $599.99 promo credit applied to account over 24 mos; promo credit ends if eligibility requirements are no longer met; 0% APR. Less $200 prepaid card (mailed w/in 8 wks) when you port-in your number from any wireless carrier and activate a new select iPhone (minimum retail price of $550) on device payment to a postpaid Verizon consumer account and activate on an eligible Verizon Unlimited postpaid plan. Echo Dot (3rd gen) and Smart Plug devices provided by Verizon and redeemed on amazon.com. Must be redeemed no later than 1.31.2020. Amazon, Echo, Alexa and all related logos are trademarks of amazon.com, Inc.” This deal is live on Verizon’s → Read More...

Read more »

Apple cuts prices on clearance, refurbished 2018 15″ 6-Cor...
Apple has clearance 2018 15″ 6-Core Touch Bar MacBook Pros, Certified Refurbished, now available starting at only $1829. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 15″ MacBook Pros currently available for sale at Apple: – 15″ 2.2GHz Touch Bar MacBook Pro (Space Gray): $1829 original MSRP $2399 – 15″ 2.2GHz Touch Bar MacBook Pro (Silver): $1829 original MSRP $2399 – 15″ 2.6GHz Touch Bar MacBook Pro (Space Gray): $2119 original MSRP $2799 – 15″ 2.6GHz Touch Bar MacBook Pro (Silver): $2119 original MSRP $2799 See our 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, updated daily, as well as specifications and review of these → Read More...

Read more »

Up to $450 price drop on clearance 15″ MacBook Pros at B&a...
B&H Photo has dropped prices Apple’s 2019 15″ 6-Core and 8-Core MacBook Pros by $400-$450 off original MSRP, starting at $1999, with free overnight shipping available to many addresses in the US: – 2019 15″ 2.6GHz 6-Core MacBook Pro Space Gray: $1999 $400 off original MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Space Gray: $2349 $450 off original MSRP – 2019 15″ 2.6GHz 6-Core MacBook Pro Silver: $1999 $400 off original MSRP – 2019 15″ 2.3GHz 8-Core MacBook Pro Silver: $2349 $450 off original MSRP See our 16″ and 15″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

Here’s how to save $200 on Apple’s new 16″ MacBook Pro...
Apple has released details of their Education discount associated with the new 2019 16″ 6-Core and 8-Core MacBook Pros. Take $200 off the price of the new 8-Core model (now $2599) and $200 off the 16″ 6-Core MacBook Pro (now $2199). All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount. – 2019 16″ 2.3GHz 8-Core Touch Bar MacBook Pro: $2599 $200 off – 2019 16″ 2.6GHz 6-Core Touch Bar MacBook Pro: $2199 $200 off Not in the US? Click for the Canada or the → Read More...

Read more »

Price drop! 2019 15″ 2.6GHz 6-Core MacBook Pro for $1999, ...
Focus Camera has dropped their price for clearance 2019 15″ 2.6GHz 6-Core Space Gray MacBook Pros by $400 to $1999 shipped. Apple’s original MSRP for this model was $2399. Focus charges sales tax for NY & NJ → Read More...

Read more »

Apple drops prices on clearance refurbished 2019 15″ MacBo...
Apple has dropped prices on clearance 2019 15″ 6-Core and 8-Core Touch Bar MacBook Pros, Certified Refurbished, with models now available for up to $530 off original MSRP, starting at $1869. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. Apple’s refurbished prices are currently the cheapest available for 2019 15″ MacBook Pros anywhere: – 15″ 2.6GHz 6-Core MacBook Pro (Space Gray): $1869 was $2039 – 15″ 2.6GHz 6-Core MacBook Pro (Silver): $1869 was $2039 – 15″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2209 was $2379 – 15″ 2.6GHz 8-Core MacBook Pro (Silver): $2209 was $2379 See our 16″ MacBook Pro Price Tracker for the latest prices & deals on 16″ as well as clearance 15″ models from Apple and its resellers, → Read More...

Read more »