Vulnerability Summary for the Week of November 16, 2020
Original release date: November 23, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 2020-11-18 7.5 CVE-2020-28367 MISC CONFIRM MLIST MLIST FEDORA golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. 2020-11-18 7.5 CVE-2020-28366 MISC CONFIRM MLIST FEDORA jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. 2020-11-16 10 CVE-2020-25207 MISC CONFIRM riken -- xoonips Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. 2020-11-16 7.5 CVE-2020-5664 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info chronoengine -- chronoforums Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed. 2020-11-16 4.3 CVE-2020-27459 MISC cmsuno_project -- cmsuno An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server. 2020-11-13 6.5 CVE-2020-25538 MISC golang -- go Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. 2020-11-18 5 CVE-2020-28362 CONFIRM MLIST FEDORA intel -- proset/wireless_wifi Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. 2020-11-13 5.8 CVE-2020-12313 MISC ivanti -- endpoint_manager LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request. 2020-11-16 6.5 CVE-2020-13769 MISC MISC ivanti -- endpoint_manager In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required. 2020-11-16 5 CVE-2020-13772 MISC MISC jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. 2020-11-16 5 CVE-2020-25013 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. 2020-11-16 5 CVE-2020-25210 MISC CONFIRM jetbrains -- youtrack JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27626 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. 2020-11-16 5 CVE-2020-27625 MISC jetbrains -- youtrack JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27624 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. 2020-11-16 5 CVE-2020-25209 MISC CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS) 2020-11-17 4.3 CVE-2020-11860 CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS). 2020-11-17 4.3 CVE-2020-25834 CONFIRM netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. 2020-11-13 5 CVE-2020-8583 MISC netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information. 2020-11-13 4 CVE-2020-8582 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6147 FULLDISC MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance USDC file format path element token index. 2020-11-13 6.8 CVE-2020-6156 MISC pixar -- openusd A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. 2020-11-13 6.8 CVE-2020-6155 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6150 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section. 2020-11-13 6.8 CVE-2020-6149 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6148 MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.5 CVE-2020-25695 MISC MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.8 CVE-2020-25694 MISC MISC riken -- xoonips SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. 2020-11-16 6.5 CVE-2020-5659 MISC MISC riken -- xoonips Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 4 CVE-2020-5663 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- infosphere_information_server IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910. 2020-11-13 2.1 CVE-2020-4886 XF CONFIRM jetbrains -- youtrack Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. 2020-11-16 2.1 CVE-2020-24366 MISC CONFIRM microfocus -- filr Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. 2020-11-17 3.5 CVE-2020-25832 CONFIRM microfocus -- idol Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. 2020-11-17 3.5 CVE-2020-25833 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). 2020-11-16 3.5 CVE-2020-27988 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). 2020-11-16 3.5 CVE-2020-27989 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). 2020-11-16 3.5 CVE-2020-27990 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). 2020-11-16 3.5 CVE-2020-27991 CONFIRM riken -- xoonips Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 3.5 CVE-2020-5662 MISC MISC salesagility -- suitecrm SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML. 2020-11-18 3.5 CVE-2020-14208 MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info airleader -- master_and_easy_devices   Airleader Master and Easy =12.8, =13.4, =13.5, =8.14, =13.4, =13.5, cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font. 2020-11-21 not yet calculated CVE-2020-25725 CONFIRM MISC reddoxx -- maildepot_2033   REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. 2020-11-18 not yet calculated CVE-2020-26554 MISC MISC resourcexpress -- qubi3_devices   QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility. 2020-11-17 not yet calculated CVE-2020-25746 CONFIRM MISC rsa -- archer   RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application. 2020-11-18 not yet calculated CVE-2020-26884 CONFIRM schneider_electric -- easergy_t300   A CWE-284: Improper Access Control vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of problems, including information exposure, denial of service, and command execution when access to a resource from an attacker is not restricted or incorrectly restricted. 2020-11-19 not yet calculated CVE-2020-7561 MISC schneider_electric -- ecostruxure_building_operation_enterprise_server   A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location. 2020-11-19 not yet calculated CVE-2020-28209 MISC schneider_electric -- ecostruxure_building_operation_webreports A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser. 2020-11-19 not yet calculated CVE-2020-7572 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7570 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution. 2020-11-19 not yet calculated CVE-2020-7569 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7571 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control. 2020-11-19 not yet calculated CVE-2020-7573 MISC schneider_electric -- ecostruxure_building_operation_webstation   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser. 2020-11-19 not yet calculated CVE-2020-28210 MISC schneider_electric -- ecostruxure_control_expert A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus. 2020-11-19 not yet calculated CVE-2020-28213 MISC schneider_electric -- ecostruxure_control_expert   A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus. 2020-11-19 not yet calculated CVE-2020-28212 MISC schneider_electric -- ecostruxure_control_expert   A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger. 2020-11-19 not yet calculated CVE-2020-28211 MISC schneider_electric -- ecostruxure_control_expert   A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7559 MISC schneider_electric -- ecostruxure_operator_terminal_expert   A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert. 2020-11-19 not yet calculated CVE-2020-7544 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7556 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7558 MISC schneider_electric -- igss_definition   A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7557 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7555 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7550 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7551 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7552 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7554 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7553 MISC schneider_electric -- modicon_m221 A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys. 2020-11-19 not yet calculated CVE-2020-7567 MISC schneider_electric -- modicon_m221   A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7566 MISC schneider_electric -- modicon_m221   A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7565 MISC schneider_electric -- modicon_m221   A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7568 MISC schneider_electric -- multiple_products A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7564 MISC schneider_electric -- multiple_products   A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7562 MISC schneider_electric -- multiple_products   A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7563 MISC schneider_electric -- plc_simulator_on_ecostruxure_control_expert   A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7538 MISC scratchverifier -- scratchverifier   In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login. 2020-11-20 not yet calculated CVE-2020-26236 MISC CONFIRM semantic-release -- semantic-release   In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3. 2020-11-18 not yet calculated CVE-2020-26226 MISC CONFIRM sensormatics_electronics -- american_dynamics_victor_web_client_and_software_house_c.cure_web_client   A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack. 2020-11-19 not yet calculated CVE-2020-9049 CERT CONFIRM sokrates -- sowa   A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter. 2020-11-19 not yet calculated CVE-2020-28350 MISC sourcecodester -- gym_management_system   Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'. 2020-11-17 not yet calculated CVE-2020-28129 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. 2020-11-17 not yet calculated CVE-2020-28138 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. 2020-11-17 not yet calculated CVE-2020-28140 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. 2020-11-17 not yet calculated CVE-2020-28139 MISC MISC sourcecodester -- online_library_management_system   An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root). 2020-11-17 not yet calculated CVE-2020-28130 MISC MISC sourcecodester -- simple_grocery_store_sales_and_inventory_system   An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php. 2020-11-17 not yet calculated CVE-2020-28133 MISC MISC sourcecodester -- tourism_management_system   An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. 2020-11-17 not yet calculated CVE-2020-28136 MISC MISC sourcecodester -- water_billing_system   SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. 2020-11-17 not yet calculated CVE-2020-28183 MISC MISC MISC suitecrm -- suitecrm SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. 2020-11-18 not yet calculated CVE-2020-15300 MISC suitecrm -- suitecrm   SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation. 2020-11-18 not yet calculated CVE-2020-15301 MISC symantec -- endpoint_detection_and_response   Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data. 2020-11-18 not yet calculated CVE-2020-12593 CONFIRM taskcafe -- project_management_tool   Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token. 2020-11-17 not yet calculated CVE-2020-25400 MISC tenable -- tp-link_archer   UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router. 2020-11-21 not yet calculated CVE-2020-5797 MISC tobesoft -- xplatform   Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto:// 2020-11-17 not yet calculated CVE-2020-7841 MISC tp-link -- multiple_devices   Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N. 2020-11-20 not yet calculated CVE-2020-28877 MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-24297 MISC MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing a denial of service) by sending a POST request to the /admin/syslog endpoint. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-28005 MISC MISC trend_micro -- apex_one   A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. 2020-11-18 not yet calculated CVE-2020-28572 MISC trend_micro -- interscan_web_security_virtual_appliance A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28581 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28578 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28579 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28580 MISC MISC trend_micro -- security_2020 Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27697 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27695 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27696 MISC trend_micro -- worry-free_business_security   A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console. 2020-11-18 not yet calculated CVE-2020-28574 MISC MISC trusted_computing_group -- trusted_platform_module_library_family   Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack. 2020-11-18 not yet calculated CVE-2020-26933 MISC CONFIRM typ03 -- typ03   An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved. 2020-11-18 not yet calculated CVE-2020-28917 MISC typo3 -- fluid   TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory. 2020-11-17 not yet calculated CVE-2020-26216 MISC CONFIRM MISC valve -- game_networking_sockets   Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution. 2020-11-18 not yet calculated CVE-2020-6016 MISC vmware -- esxi   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004) 2020-11-20 not yet calculated CVE-2020-4005 CONFIRM vmware -- multiple_products   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. 2020-11-20 not yet calculated CVE-2020-4004 CONFIRM volkswagon -- discover_media_infotainment_system   The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainment system and executed as root. 2020-11-16 not yet calculated CVE-2020-28656 MISC werkzeug -- werkzeug   Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. 2020-11-18 not yet calculated CVE-2020-28724 MISC MISC MISC western_digital -- inand_devices   Western Digital iNAND devices through 2020-06-03 allow Authentication Bypass via a capture-replay attack. 2020-11-18 not yet calculated CVE-2020-13799 MISC CONFIRM wordpress -- wordpress   The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles. 2020-11-16 not yet calculated CVE-2020-28650 MISC wordpress -- wordpress   The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. 2020-11-16 not yet calculated CVE-2020-28649 MISC MISC xstream -- xstream   XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14. 2020-11-16 not yet calculated CVE-2020-26217 CONFIRM CONFIRM CONFIRM y18n -- y18n   This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true 2020-11-17 not yet calculated CVE-2020-7774 MISC MISC MISC MISC yzmcms -- yzmcms   In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. 2020-11-19 not yet calculated CVE-2020-22394 MISC zte -- multiple_devices   Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2. 2020-11-19 not yet calculated CVE-2020-6879 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

How to Use Apple’s Built-in Features to Encrypt Files and ...
Use features built in to macOS to encrypt files, folders, and disks to ensure that your data is secure. The post How to Use Apple’s Built-in Features to Encrypt Files and Folders appeared first on The Mac Security Blog.

Read more »

GoDaddy Employees Used in Attacks on Multiple Cryptocurrency...
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy, the world's largest domain name registrar, KrebsOnSecurity has learned.

Read more »

Convicted SIM Swapper Gets 3 Years in Jail
A 21-year-old Irishman who pleaded guilty to charges of helping to steal millions of dollars in cryptocurrencies from victims has been sentenced to just under three years in prison. The defendant is part of an alleged conspiracy involving at least eight others in the United States who stand accused of theft via SIM swapping, a […]

Read more »

How To Prepare Your Mac for macOS Big Sur – Intego Mac Pod...
Apple released macOS Big Sur last week. On release day, there were a number of issues, including problems launching apps on Macs. We discuss what happened, and how Apple is changing its Gatekeeper security check. We also talk about when you should upgrade to Big Sur and how you should prepare your Mac for the big upgrade. The post How To Prepare Your Mac for macOS Big Sur – Intego Mac Podcast Episode 162 appeared first on The Mac Security Blog.

Read more »

Trump Fires Security Chief Christopher Krebs
President Trump on Tuesday fired his top election security official Christopher Krebs (no relation). The dismissal came via Twitter two weeks to the day after Trump lost an election he baselessly claims was stolen by widespread voting fraud.

Read more »

Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain...
The macOS and iOS keychain allows you to store passwords securely, and access them on all your Apple devices. The post Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain Works appeared first on The Mac Security Blog.

Read more »

Be Very Sparing in Allowing Site Notifications
An increasing number of websites are asking visitors to approve "notifications," browser modifications that periodically display messages on the user's mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters.

Read more »

How to switch search engines on macOS and iOS (and why you s...
Using a different search engine than the default requires you to manually make a change. Here's how to switch default search engines in OS X and iOS. The post How to switch search engines on macOS and iOS (and why you should) appeared first on The Mac Security Blog.

Read more »

How to Securely Dispose of Your Old Mac
So it’s time to move on and end your relationship with your Mac. You had good times together; you’ll always have memories of the best moments you shared. But there’s a better Mac now, it may be faster, have a better display, or be lighter and more portable. While break-ups are always tough, it’s a […] The post appeared first on The Mac Security Blog.

Read more »

Get a 16″ MacBook Pro for up to $740 off MSRP today at App...
Apple has standard-configuration Certified Refurbished 2019 16″ MacBook Pros available for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 Here are Apple’s standard configurations: 16″ 2.6GHz 16-inch TFT Retina Display 2.6GHz Intel 6-Core i7 16GB memory 512GB SSD Radeon Pro 5300M/4GB Touch Bar and Touch ID 16″ 2.3GHz 16-inch TFT Retina Display 2.3GHz Intel 8-Core i9 16GB memory 1TB SSD Radeon Pro 5500M/4GB Touch Bar and Touch ID Save up to $740 on a custom-configured 16″ MacBook Pro with a range of Certified Refurbished models at Apple. You won’t find cheaper custom configurations anywhere else. The following custom models are available today. Stock is likely to come and go, so check Apple’s site for current availability: – 16″ 2.6GHz/32GB RAM/512GB SSD/ Radeon Pro 5300M: $2379 Apple Certified Refurbished $420 off MSRP – 16″ 2.6GHz/16GB RAM/512GB SSD/ Radeon Pro 5500M 8GB: $2209 Apple Certified Refurbished $290 off MSRP – 16″ 2.6GHz/16GB RAM/1TB SSD/ Radeon Pro 5300M: $2209 Apple Certified Refurbished $390 off MSRP – 16″ 2.3GHz/64GB RAM/2TB SSD/ Radeon Pro 5500M 8GB: $3479 Apple Certified Refurbished $620 off MSRP – 16″ 2.3GHz/32GB RAM/1TB SSD/ Radeon Pro 5500M 8GB: $2799 Apple Certified Refurbished $500 off MSRP – 16″ 2.3GHz/32GB RAM/1TB SSD/ Radeon Pro 5500M 8GB/Silver: $2799 Apple Certified Refurbished $500 off MSRP – 16″ 2.3GHz/32GB RAM/2TB SSD/ Radeon Pro 5500M:

Read more »

Best Black Friday week 2020 deals: New 13″ MacBook Pros wi...
Apple resellers have new 13″ MacBook Pros with M1 Apple Silicon CPUs in stock and on sale for this Black Friday week 2020. Save $50-$71 off Apple’s standard MSRP, or save on sales tax in many US states. The following resellers are offering the best deals today on these new models: (1): Apple’s new 2020 13″ MacBook Pros with M1 Apple Silicon CPUs are now on sale at B&H Photo for $50 off MSRP, starting at $1249, as part of their Black Friday week 2020 sales event. Free expedited shipping is available for most addresses in the US: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1449 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1449 $50 off MSRP (2): Amazon has Apple’s new 2020 13″ MacBook Pros with M1 Apple Silicon CPUs now on sale for $50 off MSRP, starting at $1249. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1449 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1249 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1449 $50 off MSRP (3): Apple reseller DataVision has Apple’s new 2020 13″ MacBook Pros with Apple Silicon M1 processors available for order including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 2020 13″ MacBook Pro M1 CPU/256GB SSD: $1299 – 2020 13″ MacBook Pro M1 CPU/512GB SSD: $1499 Space Gray, Silver, and Gold colors → Read More...

Read more »

Xfinity Mobile Black Friday/Cyber Monday 2020 Apple iPhone D...
Xfinity Mobile has announced their Black Friday/Cyber Monday Apple iPhone deals for 2020. These offers are available starting today on their site and last through December 7th, or while supplies last: – $250 off any new purchase of an iPhone, including the new iPhone 12, iPhone 12 mini, iPhone 12 Pro Max, and iPhone 12 Pro. New line of service required. – $200 Visa Prepaid Card when you purchase Xfinity Internet and add Xfinity Mobile, up to $500 combines savings with the gift card + Xfinity’s $250 off offer. New service required. – Free 64GB Apple iPhone SE, $0 per month, with new line of service. All these deals are live today at Xfinity Mobile. For the latest prices and sales, see our Apple iPhone Price Tracker, → Read More...

Read more »

Xfinity Mobile Black Friday/Cyber Monday 2020 Apple iPhone D...
Xfinity Mobile has announced their Black Friday/Cyber Monday Apple iPhone deals for 2020. These offers are available starting today on their site and last through December 7th, or while supplies last: – $250 off any new purchase of an iPhone, including the new iPhone 12, iPhone 12 mini, iPhone 12 Pro Max, and iPhone 12 Pro. New line of service required. – $200 Visa Prepaid Card when you purchase Xfinity Internet and add Xfinity Mobile, up to $500 combines savings with the gift card + Xfinity’s $250 off offer. New service required. – Free 64GB Apple iPhone SE, $0 per month, with new line of service. All these deals are live today at Xfinity Mobile. For the latest prices and sales, see our Apple iPhone Price Tracker, → Read More...

Read more »

Apple announces Black Friday/Cyber Monday 4-Day shopping eve...
Apple has announced their deals for the four day Black Friday/Cyber Monday 2020 event. Receive a free $200 Apple Store gift card with the purchase of select Macs and $50-$100 with various iPads. Get a $50 Apple Store Gift Card with iPhone SE, 11, and XR models as well as Apple Watch Series 3 and HomePod. A $25 gift card is available with the purchase of AirPods and 4K Apple TV. Apple’s shopping event takes place from Friday, November 27th through Monday, December 30th. The following card amounts will be available during those dates only; all include free shipping and are in stock right now: Macs: – MacBook Pros: $150 Gift Card – iMacs: $150 Gift Card iPhones: – iPhone SE, 11, XR: $50 Gift Card iPads: – 11″ & 12″ iPad Pros: $100 gift card – iPad mini 5: $50 gift card AirPods: – AirPods (non-Pro): $25 Gift Card Apple Watch: – Apple Watch Series 3: $25 Gift Card HomePod: – HomePods: $50-$100 Gift Card Apple TV: – 4K Apple TVs: $25 Gift Card Beats Products: – Beats Studio3 Wireless: $50 Gift Card – Beats Solo3 Wireless, Powerbeats3 Wireless, or Powerbeats Pro: $50 Gift Card Not in the US? Click for the Canada or the

Read more »

Apple announces Black Friday/Cyber Monday 4-Day shopping eve...
Apple has announced their deals for the four day Black Friday/Cyber Monday 2020 event. Receive a free $200 Apple Store gift card with the purchase of select Macs and $50-$100 with various iPads. Get a $50 Apple Store Gift Card with iPhone SE, 11, and XR models as well as Apple Watch Series 3 and HomePod. A $25 gift card is available with the purchase of AirPods and 4K Apple TV. Apple’s shopping event takes place from Friday, November 27th through Monday, December 30th. The following card amounts will be available during those dates only; all include free shipping and are in stock right now: Macs: – MacBook Pros: $150 Gift Card – iMacs: $150 Gift Card iPhones: – iPhone SE, 11, XR: $50 Gift Card iPads: – 11″ & 12″ iPad Pros: $100 gift card – iPad mini 5: $50 gift card AirPods: – AirPods (non-Pro): $25 Gift Card Apple Watch: – Apple Watch Series 3: $25 Gift Card HomePod: – HomePods: $50-$100 Gift Card Apple TV: – 4K Apple TVs: $25 Gift Card Beats Products: – Beats Studio3 Wireless: $50 Gift Card – Beats Solo3 Wireless, Powerbeats3 Wireless, or Powerbeats Pro: $50 Gift Card Not in the US? Click for the Canada or the

Read more »

Black Friday 2020 Sale: 13″ 2.0GHz Intel MacBook Pros for ...
Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs on sale for $250-$200 off Apple’s MSRP as part of their Black Friday week 2020 sale. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1549.99 $250 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1549.99 $250 off MSRP Note that the 512GB models listed above include an extra $100 instant discount applied in your Amazon shopping cart during checkout. – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1799 $200 off MSRP Amazon’s prices are the lowest available for these models from any Apple reseller. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Black Friday 2020 Sale: 12.9″ Apple iPad Pros for up to $1...
Amazon has new 2020 Apple 12.9″ iPad Pros on sale today for up to $150 off MSRP, with prices starting at $899, as part of their Black Friday 2020 week sale. Shipping is free. These are the same iPad Pros sold by Apple in their retail and online stores: – 12″ 128GB WiFi iPad Pro: $899.99 $100 off – 12″ 256GB WiFi iPad Pro: $999 $100 off – 12″ 512GB WiFi iPad Pro: $1149.99 $150 off – 12″ 1TB WiFi iPad Pro: $1349.99 $150 off – 12″ 128GB WiFi + Cell iPad Pro: $1129 $20 off – 12″ 256GB WiFi + Cell iPad Pro: $1149.99 $100 off – 12″ 512GB WiFi + Cell iPad Pro: $1299.99 $150 off – 12″ 1TB WiFi + Cell iPad Pro: $1499.99 $150 off Note that some sale prices may be restricted to either Space Gray or Silver colors. Be sure to make you purchase from Amazon, rather than a third-party seller. Keep an eye on our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Black Friday 2020 Sale! Amazon offers new 11″ iPad Pros fo...
Amazon has 2020 11″ iPad Pros on sale for up to $150 off Apple’s MSRP as part of their Black Friday week 2020 sale. These are the same iPad Pros sold by Apple in its retail and online stores. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free. Note that some sale prices may be restricted to either Space Gray or Silver colors: – 11″ 128GB WiFi iPad Pro: $729.99 $70 off – 11″ 256GB WiFi iPad Pro: $799.99 $100 off – 11″ 512GB WiFi iPad Pro: $999.99 $100 off – 11″ 1TB WiFi iPad Pro: $1149.99 $150 off – 11″ 128GB WiFi + Cellular iPad Pro: $879.99 $70 off – 11″ 256GB WiFi + Cellular iPad Pro: $989.93 $60 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $100 off – 11″ 1TB WiFi + Cellular iPad Pro: $1299.99 $150 off These sale prices are valid as of Sunday morning, November 22nd, and we are unsure how long Amazon intends to offer Black Friday prices on 11″ models. Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »