iPhone 13 and iPhone 13 Pro: How to get the best preorder deal
It’s been a long time since you could only get an iPhone directly from Apple or from AT&T. Today, it’s offered by all major carriers and big retailers, and many of them want to entice you to buy with them by offering special deals. Of course, you can still buy from Apple directly, either in-store or online. If […]

Read more »

How to properly log your devices out of iCloud
There are many occasions on which you need to sign out of iCloud on a device. Maybe you’re returning it to an employer, sending it to Apple or another company for trade-in credit, handing it down to a family member, selling it, or consigning a failing unit to the fires of…recycling. If you used iCloud […]

Read more »

Apple TV+ Guide: Here are all the Apple TV shows and movies available now
Apple TV+ offers exclusive Apple original TV shows and movies in 4K HDR quality. You can watch across all of your screens and pick up where you left off on any device. Apple TV+ costs $4.99 per month. Here’s every Apple original television show and movie available now on Apple TV+, as well as the latest trailers … more… The post appeared first on 9to5Mac.

Read more »

Apple Store is down ahead of iPhone 13 preorders
The Apple Store is currently down ahead of preorders for iPhone 13, iPhone 13 mini, iPhone 13 Pro, and iPhone 13 Pro Max.   Customers can start preordering their new phones beginning at 5 AM Pacific Time, or about six hours from now. more… The post appeared first on 9to5Mac.

Read more »

Apple's online store goes down ahead of iPhone 13 preorders
As is tradition, Apple late Thursday took its online storefront down in preparation of what is expected to be a rush of preorders for its latest iPhone 13 series, though the launch will likely be a little less hectic than usual without Apple Watch Series 7.The online Apple Store and connected Apple Store app went down at around 8:30 p.m. Pacific, more than eight hours prior to a scheduled start to iPhone 13 preorders. Apple will begin accepting orders on Friday at 5 a.m. Pacific, 8 a.m. Eastern, with purchases set to arrive on Sept. 24.Unveiled on Tuesday, iPhone 13 and iPhone 13 Pro are the latest flagship handsets to come out of Cupertino. Read more...

Read more »

Apple is monitoring legal challenges to Texas abortion law
Apple in an internal memo circulated among employees on Thursday said it is monitoring legal challenges to Texas' recently passed abortion law, according to a report.The memo, which references Texas' "uniquely restrictive abortion law," was posted to an internal employee message board and seen by TechCrunch, which corroborated its authenticity with Apple."At Apple, we support our employees' rights to make their own decisions regarding their reproductive health," the message reads. "We are actively monitoring the legal proceedings challenging the uniquely restrictive abortion law in Texas. In the meantime, we want to remind you that our benefits at Apple are comprehensive, and that they allow our employees to travel out-of-state for medical care if it is unavailable in their home state." Read more...

Read more »

Apple Watch SE ships with new USB-C charging cable
Apple's soon to be mid-tier Apple Watch SE now ships with the company's Magnetic Fast Charger, a USB-C cable designed to accommodate the enhanced charging capabilities of Apple Watch Series 7.Apple this week updated online store listings to note the inclusion of a "1m Magnetic Charger to USB-C Cable" with all Apple Watch SE purchases. The new information is located in the "What's in the box" section of Apple Watch SE purchase pages on Apple.com.While not specified by Apple, the cable is thought to be the Magnetic Fast Charger announced alongside Apple Watch Series 7 on Tuesday. The company only fields one USB-C Watch cable, and a discontinued USB-C variant that dates back to 2018 is no longer available for purchase. Read more...

Read more »

Developer disputes Apple's take on 'FlickType' removal
Kosta Eleftheriou, developer and vocal App Store critic, says it took a year of appeals to get his "FlickType" Apple Watch keyboard on the App Store, with those hard-fought gains potentially wiped clean now that Apple "Sherlocked" the app.Apple introduced the QuickPath keyboard during the unveiling of Apple Watch Series 7 on Tuesday. The feature displays a full QWERTY keyboard on Watch's diminutive display and allows users to slide a finger to type, with on-device machine learning leveraged to anticipate subsequent words.FlickType, which was introduced in 2019 and unceremoniously pulled from the App Store for violating then-active guidelines restricting keyboards on Watch, uses a very similar swipe-to-type mechanism and user interface. In response to the introduction of QuickPath, Eleftheriou posted an App Store rejection letter from 2019 to Twitter and referenced an ongoing lawsuit related to the matter. Read more...

Read more »

Apple Watch Series 7 and SE now come with USB-C cable; fast charging may not work with MagSafe Duo
One of the few new features of the Apple Watch Series 7 is support for fast charging, which results in 33% faster charging time when compared to the Apple Watch Series 6. However, Apple says that fast charging requires a new USB-C cable (which now comes bundled in the box), but MagSafe Duo owners may not be able to take advantage of this feature. more… The post appeared first on 9to5Mac.

Read more »

New iPad mini gets 5G, but lacks mmWave support
Apple is bringing 5G connectivity to iPad mini, but the pint-sized tablet does not include support for speedy mmWave bands.Unveiled on Tuesday, the sixth-generation iPad mini delivers a host of upgrades including an all-screen design, A15 Bionic integration, improved front- and rear-facing cameras, USB-C and more.The smallest model in Apple's iPad lineup now boasts 5G connectivity, though only sub-6GHz bands are supported. As noted in Apple tech specs, iPad mini is unable to connect to mmWave 5G bands, reducing its theoretical data transfer capabilities. Read more...

Read more »

Analyst: iPhone 13 will further boost 5G adoption around the world
5G on the iPhone is not a new thing, as Apple first introduced support for the new ultra-fast network last year with the iPhone 12 line. iPhone 13 not only still supports 5G, but also expands it with more bands — and that should drive 5G adoption even further around the world. more… The post appeared first on 9to5Mac.

Read more »

Apple executives talk impact of diversity initiatives at Congressional Black Caucus Foundation conference
Apple executives Alisha Johnson, program lead for the company's Racial Equality and Justice Initiative, and Lyn Stanfield, external relations leader of the Inclusion and Diversity team, spoke about the company's racial equity programs at the Congressional Black Caucus Foundation's 50th Annual Legislative Conference.In a session sponsored by Apple, Johnson and Stanfield joined Nicol Turner Lee, senior fellow at The Brookings Institution, Spencer Overton, president of the Joint Center for Political and Economic Studies, and law professor at George Washington University Law School, and Veronica Nelson, executive director at AMIE, for a discussion on racial equity, diversity, inclusion and a range of related topics.Apple VP of Environment, Policy and Social Initiatives Lisa Jackson offered a prepared statement to open the session, recapping the company's various racial equity and justice efforts. Apple's $100 million Racial Equity and Justice Initiative, which was recently boosted by a $30 million commitment for students, innovators, and organizations, focuses on forwarding equity through strategic investments. Read more...

Read more »

Apple refutes FlickType developer’s account of App Store issues
William Gallagher, AppleInisder: Apple has told AppleInsider how it denies FlickType developer Kosta Eleftheriou's claims in a lawsuit, over the App Store handling of his accessibility keyboard app for Apple Watch. And: Apple has now told AppleInsider that a letter Eleftheriou posted on Twitter after the "California Streaming" event, dates from 2019. At that point, FlickType had been removed for contravening the App Store's then-rule about Apple Watch keyboards. However, after Eleftheriou resubmitted the app to the App Store review team with an explanation of its accessibility functions, Apple says that the update was allowed. This response concerned the story we posted yesterday, titled Apple blocked the FlickType Watch keyboard… then announced a clone of it. Read the rest of the AppleInsider piece. There's more. But, key to all this: Now, says Apple, there are multiple Apple Watch keyboard apps available on the App Store. And FlickType itself was highlighted in a Top Apps of 2020 promotion on the store. ∞ Read this on The Loop

Read more »

Apple sunsets the 256GB iPhone SE
The change makes the iPhone SE compete less directly with the iPhone 13 mini.

Read more »

Here are all the best Apple Watch trade in values after Series 7 launch
In case you missed it, the Apple Watch Series 7 has arrived, and while it might not be the overhaul everyone expected, it’s still a worthy upgrade for many! We’re always trying to keep you updated on all the best iPhone, iPad, and MacBook trade in deals every month, and here’s what we’re finding for trade in values for Apple Watch Series 1 through 6 in the wake of the announcement. more… The post appeared first on 9to5Mac.

Read more »

Elevate your iPhone charging with Forté MagSafe stand [Review]
The Twelve South Forté turns Apple’s MagSafe iPhone charging puck into a stand. So rather than your handset lying flat on a table it’s held up where you can more easily see the display. And the elevated charging mat swivels so you can pick your viewing angle for watching video or making FaceTime calls. I […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple's new iPhone 13 Pro case illustrates massively enlarged camera 'bump'
Apple's latest iPhone 13 Pro lineup features improved camera hardware capabilities across the board, enhancements that required a redesign of the handset's camera "bump."Announced on Tuesday, iPhone 13 Pro and iPhone 13 Pro Max receive a number of camera upgrades including larger apertures on wide, ultra-wide and telephoto lenses for enhanced low-light performance. Wide and telephoto modules add an additional lens element, while the telephoto camera nets a 77mm equivalent focal length for increased optical zoom capabilities. The ultra-side shooter also adds an autofocus system.To fit the new and improved technologies, Apple enlarged the rear camera "bump" on iPhone 13 Pro and Pro Max, as evidenced by the company's cases. Read more...

Read more »

Apple TV+ is becoming a powerhouse
Apple TV+ is a streaming service featuring Apple Originals, award-winning series, compelling dramas, and more - it's becoming a powerhouse … The post appeared first on MacDailyNews.

Read more »

Apple shareholders press company to reverse 'anti-competitive repair policies'
A recently filed Apple shareholder resolution is pressuring the company to reverse its "anti-repair practices," which it says conflicts with Apple's reputation as a climate leader.Credit: AppleU.S. PIRG, a public interest research federation, and Green Century Capital Funds, its associated mutual fund company, recently filed resolutions with both Apple and John Deer asking them to account for their "anti-competitive repair policies." Read more...

Read more »

New iPad mini has 2.9GHz A15 vs. iPhone 13 lineup’s 3.2GHz A15
The new iPad mini is equipped with Apple's latest A15 Bionic chip, but benchmark results reveal that the chip is downclocked to 2.9GHz … The post appeared first on MacDailyNews.

Read more »

Apple Watch SE now comes with a USB-C Magnetic Charging cable
, and upgrade over the SE's former USB-A connector… The post appeared first on MacDailyNews.

Read more »

New Nomad iPhone 13 cases can replace your business cards
With the new iPhone 13 series on the way, Nomad has introduced a new line of cases for the handsets tricked out with NFC chips to enable storing and sharing information with a tap. And in an interesting twist, for once Nomad is offering non-leather goods (at least in one case, so to speak). Nomad […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

9to5Mac Daily: September 16, 2021 – iPad mini 6 and iPhone 13 tidbits
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by iMazing: iMazing is the Swiss Army Knife of iOS device management. Get 30% off iMazing for a limited time. more… The post appeared first on 9to5Mac.

Read more »

Preorders for iPhone 13 outpace iPhone 12, likely due to Huawei struggles
Customers in China have placed more than 2 million preorders for Apple's iPhone 13 lineup, surpassing the number of iPhone 12 preorders in 2020, likely because of the void left by high-end Huawei handsets.Credit: AppleAccording to the South China Morning Post, Chinese customers have already placed more than 2 million preorders on retailer JD.com alone as of Thursday. That eclipses the 1.5 million iPhone 12 initial preorders placed after those models launched. Read more...

Read more »

Take files to go with new LaCie portable SSDs, including Apple Store exclusive
Storage provider LaCie has rolled out two new portable solid state drives (SSDs), including one model offered exclusively at the Apple Store in space gray to match Apple gear. Apple will offer it later this month. In the wake of the Cupertino tech giant’s “California Streaming” event announcing the new iPhone 13 lineup and more, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple releases new marketing tools for developers
App developers can use a new Apple web tool to generate promotional images on the fly.This marketing image was made using Apple's simple web toolThe new marketing tool generates images using four templates, three colors, and different image sizes. Simply select the platform and search for any app to make multiple social media-friendly images. Read more...

Read more »

Russia threatens to fine Apple, Google for not blocking Alexey Navalny content
Russia is upping pressure by threatening to fine Apple for failing to block access to content related to opposition leader Alexey Navalny … The post appeared first on MacDailyNews.

Read more »

Apple launches all-new App Store marketing tools for developers
Apple today has announced a handful of new marketing tools for App Store developers looking to promote their applications. The launch of the new marketing tools comes ahead of the release of iOS 15 and watchOS 8 on Monday. more… The post appeared first on 9to5Mac.

Read more »

Russia threatens fines if Apple & Google don't remove opposition app
A Russian media watchdog reportedly plans to fine Apple and Google if they refuse to remove an opposition leader's app from their respective app stores.Credit: Evgenit/PixabayRoskomnadzor, a Russian federal organization responsible for monitoring and controlling mass media in the country, recently signaled its plans to fine the companies if they don't remove the app. According to Russian news agency TASS, a decision could be made soon if the companies don't take action, though the watchdog is not yet at that point. Read more...

Read more »

Here’s everything Apple didn’t announce at its iPhone 13 event
Apple’s September event included the unveiling of iPhone 13, Apple Watch Series 7, the redesigned iPad mini 6, and more. However, there were a number of things absent. Let’s look at everything Apple didn’t announce at its iPhone 13 event. more… The post appeared first on 9to5Mac.

Read more »

Trial Ends in Guilty Verdict for DDoS-for-Hire Boss
A jury in California today reached a guilty verdict in the trial of Matthew Gatrel, a St. Charles, Ill. man charged in 2018 with operating two online services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against Internet users and websites. Gatrel's conviction comes roughly two weeks after his co-conspirator pleaded guilty to criminal charges related to running the services.

Read more »

Apple’s Consistent Iteration – Intego Mac Podcast Episode 205
Apple has patched two in-the-wild vulnerabilities, and you should update your devices right away. We look at the dangers of "corrupt my file" websites. And we discuss Apple's new product announcements. The post appeared first on The Mac Security Blog.

Read more »

Which iPad Is Best for You in 2021?
With so many options, it's not easy to know which iPad is best for you. This guide explains which iPad you should get, based on how you plan to use it. The post appeared first on The Mac Security Blog.

Read more »

Customer Care Giant TTEC Hit By Ransomware?
TTEC, [NASDAQ: TTEC], a company used by some of the world's largest brands to help manage customer support and sales online and over the phone, is dealing with disruptions from a network security incident that appears to be the result of a ransomware attack, KrebsOnSecurity has learned.

Read more »

Apple Introduces the iPhone 13, Apple Watch Series 7, and New iPads
Apple has announce new iPhones, Apple Watches, and iPads. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, September 2021 Edition
Microsoft today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, Apple has issued an emergency update to fix a flaw that's reportedly been abused to install spyware on iOS products, and Google's got a new version of Chrome that tackles two zero-day flaws. Finally, Adobe has released critical security updates for Acrobat, Reader and a slew of other software.

Read more »

Are “corrupt my file” sites safe? Here’s why to avoid corrupt-a-file services
File corruption sites claim they can make any file unreadable, so you can get extra time to submit a project. Ethics aside, is it safe to submit documents to such services? The post appeared first on The Mac Security Blog.

Read more »

Apple patches two in-the-wild vulnerabilities for macOS, iOS, iPadOS, watchOS
Apple has released a series of security updates to patch two critical vulnerabilities that the company says were “actively exploited” in the wild. The following updates were released on Monday, September 13, 2021: iOS 14.8 iPadOS 14.8 macOS Big Sur 11.6 Security Update 2021-005 Catalina Safari 14.1.2 (build 14611.3.10.1.7 for Mojave and 15611.3.10.1.7 for Catalina) […] The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of September 6, 2021
Original release date: September 13, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adaptivescale -- lxdui A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system. 2021-09-03 10 CVE-2021-40494 MISC arubanetworks -- arubaos A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37724 MISC arubanetworks -- arubaos A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37723 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37718 MISC arubanetworks -- sd-wan A remote buffer overflow vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 7.5 CVE-2021-37716 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.6; Prior to 8.7.1.4, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37717 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37722 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37721 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37720 MISC arubanetworks -- sd-wan A remote arbitrary command execution vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.7.1.4, 8.6.0.9, 8.5.0.13, 8.3.0.16, 6.5.4.20, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 9 CVE-2021-37719 MISC bluecms_project -- bluecms BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php. 2021-09-08 7.5 CVE-2020-19853 MISC espressif -- esp-idf The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload. 2021-09-07 8.3 CVE-2021-28139 MISC MISC MISC MISC moxa -- wac-2004_firmware Certain MOXA devices allow Authenticated Command Injection via /forms/web_importTFTP. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3. 2021-09-07 9 CVE-2021-39279 MISC MISC simple_water_refilling_station_management_system_project -- simple_water_refilling_station_management_system SQL Injection can occur in Simple Water Refilling Station Management System 1.0 via the water_refilling/classes/Login.php username parameter. 2021-09-07 7.5 CVE-2021-38840 MISC MISC MISC MISC sketch -- sketch Sketch before 75 mishandles external library feeds. 2021-09-06 7.5 CVE-2021-40531 MISC telegram -- web_k_alpha Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. 2021-09-06 7.5 CVE-2021-40532 MISC ulfius_project -- ulfius ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info- >request NULL check for certain malformed HTTP requests. 2021-09-07 7.5 CVE-2021-40540 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info alipay_project -- alipay A proid GET parameter of the WordPress支付å®?Alipay|财付通Tenpay|è´?å®?PayPal集æˆ?æ?’件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection. 2021-09-06 6.5 CVE-2021-24390 MISC MISC arubanetworks -- arubaos A remote path traversal vulnerability was discovered in Aruba Operating System Software version(s): Prior to 8.8.0.1, 8.7.1.4, 8.6.0.11, 8.5.0.13. Aruba has released patches for ArubaOS that address this security vulnerability. 2021-09-07 5.5 CVE-2021-37728 MISC arubanetworks -- arubaos A remote path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.3, 8.6.0.9, 8.5.0.12, 8.3.0.16, 6.5.4.19, 6.4.4.25. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 5.5 CVE-2021-37729 MISC arubanetworks -- sd-wan A remote cross-site request forgery (csrf) vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software version(s): Prior to 8.6.0.4-2.2.0.4; Prior to 8.8.0.1, 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.15. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address this security vulnerability. 2021-09-07 5.8 CVE-2021-37725 MISC cashtomer_project -- cashtomer An editid GET parameter of the Cashtomer WordPress plugin through 1.0.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. 2021-09-06 6.5 CVE-2021-24391 MISC MISC cliniccases -- cliniccases Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. 2021-09-07 4.3 CVE-2021-38704 MISC MISC cliniccases -- cliniccases messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL commands through a vulnerable parameter. 2021-09-07 6.5 CVE-2021-38706 MISC MISC cliniccases -- cliniccases ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary administrator account for the attacker. 2021-09-07 6.8 CVE-2021-38705 MISC MISC comment_highlighter_project -- comment_highlighter A c GET parameter of the Comment Highlighter WordPress plugin through 0.13 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. 2021-09-06 6.5 CVE-2021-24393 MISC MISC contiki-os -- contiki In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the WILL/WONT or DO/DONT response for DO and WILL commands because of improper handling of exception condition, which leads to property violations and denial of service. Specifically, a server sometimes sends no response, because a fixed buffer space is available for all responses and that space may have been exhausted. 2021-09-05 5 CVE-2021-40523 MISC cozyvision -- sms_alert_order_notifications The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page. 2021-09-06 4.3 CVE-2021-24588 MISC easy_testimonial_manager_project -- easy_testimonial_manager An id GET parameter of the Easy Testimonial Manager WordPress plugin through 1.2.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection 2021-09-06 6.5 CVE-2021-24394 MISC MISC eyoucms -- eyoucms EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. 2021-09-07 5.8 CVE-2021-39501 MISC MISC eyoucms -- eyoucms A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function. 2021-09-07 4.3 CVE-2021-39499 MISC MISC f-secure -- atlant A vulnerability affecting F-Secure Antivirus engine was discovered whereby scanning WIM archive file can lead to denial-of-service (infinite loop and freezes AV engine scanner). The vulnerability can be exploit remotely by an attacker. A successful attack will result in Denial-of-Service of the Anti-Virus engine. 2021-09-07 4.3 CVE-2021-33599 MISC MISC file-upload-with-preview_project -- file-upload-with-preview This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file). 2021-09-05 4.3 CVE-2021-23439 CONFIRM CONFIRM CONFIRM fortinet -- fortimanager An improper access control vulnerability in FortiManager versions 6.4.0 to 6.4.3 may allow an authenticated attacker with a restricted user profile to access the SD-WAN Orchestrator panel via directly visiting its URL. 2021-09-06 6.5 CVE-2021-24006 CONFIRM fortinet -- fortisandbox An improper access control vulnerability (CWE-284) in FortiSandbox versions 3.2.1 and below and 3.1.4 and below may allow an authenticated, unprivileged attacker to download the device configuration file via the recovery URL. 2021-09-06 4 CVE-2020-15939 CONFIRM gambit -- titan_framework The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues 2021-09-06 4.3 CVE-2021-24435 MISC geekwebsolution -- embed_youtube_video The editid GET parameter of the Embed Youtube Video WordPress plugin through 1.0 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. 2021-09-06 6.5 CVE-2021-24395 MISC MISC ghost -- ghost Ghost is a Node.js content management system. An error in the implementation of the limits service between versions 4.0.0 and 4.9.4 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability. This issue is patched in Ghost version 4.10.0. As a workaround, disable all non-Administrator accounts to prevent API access. It is highly recommended to regenerate all API keys after patching or applying the workaround. 2021-09-03 6.5 CVE-2021-39192 CONFIRM MISC gibbonedu -- gibbon A reflected XSS vulnerability exists in multiple pages in version 22 of the Gibbon application that allows for arbitrary execution of JavaScript (gibbonCourseClassID, gibbonPersonID, subpage, currentDate, or allStudents to index.php). 2021-09-03 4.3 CVE-2021-40492 MISC MISC gifsicle_project -- gifsicle The find_color_or_error function in gifsicle 1.92 contains a NULL pointer dereference. 2021-09-07 5 CVE-2020-19752 MISC gnu -- inetutils The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl. 2021-09-03 4.3 CVE-2021-40491 MISC MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome prior to 93.0.4577.63 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30614 MISC MISC FEDORA google -- chrome Use after free in Permissions in Google Chrome prior to 93.0.4577.63 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30607 MISC MISC FEDORA google -- chrome Use after free in Autofill in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30624 MISC MISC FEDORA google -- chrome Use after free in Bookmarks in Google Chrome prior to 93.0.4577.63 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30623 MISC MISC FEDORA google -- chrome Use after free in WebApp Installs in Google Chrome prior to 93.0.4577.63 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30622 MISC MISC FEDORA google -- chrome Insufficient policy enforcement in Blink in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to bypass content security policy via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30620 MISC MISC FEDORA google -- chrome Inappropriate implementation in DevTools in Google Chrome prior to 93.0.4577.63 allowed a remote attacker who had convinced the user to use Chrome headless with remote debugging to execute arbitrary code via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30618 MISC MISC FEDORA google -- chrome Use after free in Media in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30616 MISC MISC FEDORA google -- chrome Use after free in WebRTC in Google Chrome on Linux, ChromeOS prior to 93.0.4577.63 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30612 MISC MISC FEDORA google -- chrome Use after free in Sign-In in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30609 MISC MISC FEDORA google -- chrome Use after free in Blink in Google Chrome prior to 93.0.4577.63 allowed an attacker who convinced a user to drag and drop a malicous folder to a page to potentially perform a sandbox escape via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30606 MISC MISC FEDORA google -- chrome Use after free in Extensions API in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30610 MISC MISC FEDORA google -- chrome Inappropriate implementation in Autofill in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to spoof security UI via a crafted HTML page. 2021-09-03 4.3 CVE-2021-30621 MISC MISC FEDORA google -- chrome Inappropriate implementation in Autofill in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to spoof security UI via a crafted HTML page. 2021-09-03 4.3 CVE-2021-30619 MISC MISC FEDORA google -- chrome Policy bypass in Blink in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to bypass site isolation via a crafted HTML page. 2021-09-03 4.3 CVE-2021-30617 MISC MISC FEDORA google -- chrome Inappropriate implementation in Navigation in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to leak cross-origin data via a crafted HTML page. 2021-09-03 4.3 CVE-2021-30615 MISC MISC FEDORA google -- chrome Use after free in Base internals in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30613 MISC MISC FEDORA google -- chrome Use after free in WebRTC in Google Chrome on Linux, ChromeOS prior to 93.0.4577.63 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30611 MISC MISC FEDORA google -- chrome Use after free in Web Share in Google Chrome prior to 93.0.4577.63 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-09-03 6.8 CVE-2021-30608 MISC MISC FEDORA gpac -- gpac An issue was discovered in gpac 0.8.0. The strdup function in box_code_base.c has a heap-based buffer over-read. 2021-09-07 5 CVE-2020-19750 MISC gpac -- gpac An issue was discovered in gpac 0.8.0. The gf_odf_del_ipmp_tool function in odf_code.c has a heap-based buffer over-read. 2021-09-07 6.4 CVE-2020-19751 MISC jbl -- tune500bt_firmware The Bluetooth Classic implementation on JBL TUNE500BT devices does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service and shutdown a device by flooding the target device with LMP Feature Response data. 2021-09-07 6.1 CVE-2021-28155 MISC MISC jiangqie -- official_website_mini_program The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues 2021-09-06 6.5 CVE-2021-24303 MISC MISC linux -- linux_kernel A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. 2021-09-03 4.4 CVE-2021-40490 MISC moxa -- wac-2004_firmware Certain MOXA devices allow reflected XSS via the Config Import menu. This affects WAC-2004 1.7, WAC-1001 2.1, WAC-1001-T 2.1, OnCell G3470A-LTE-EU 1.7, OnCell G3470A-LTE-EU-T 1.7, TAP-323-EU-CT-T 1.3, TAP-323-US-CT-T 1.3, TAP-323-JP-CT-T 1.3, WDR-3124A-EU 2.3, WDR-3124A-EU-T 2.3, WDR-3124A-US 2.3, and WDR-3124A-US-T 2.3. 2021-09-07 4.3 CVE-2021-39278 MISC mrdoc -- mrdoc mrdoc is vulnerable to Deserialization of Untrusted Data 2021-09-06 6.8 CVE-2021-32568 MISC CONFIRM ntracker -- ntracker_usb_enterprise A SQL-Injection vulnerability in the nTracker USB Enterprise(secure USB management solution) allows a remote unauthenticated attacker to perform SQL query to access username password and other session related information. 2021-09-07 5 CVE-2020-7819 MISC otrs -- otrs It's possible to create an email which can be stuck while being processed by PostMaster filters, causing DoS. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions; 8.0.x version 8.0.15 and prior versions. 2021-09-06 5 CVE-2021-36093 CONFIRM otrs -- otrs Malicious attacker is able to find out valid user logins by using the "lost password" feature. This issue affects: OTRS AG ((OTRS)) Community Edition version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions. 2021-09-06 5 CVE-2021-36095 CONFIRM parity -- frontier Frontier is Substrate's Ethereum compatibility layer. Prior to commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26, a bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints. A patch is available in commit number 0b962f218f0cdd796dadfe26c3f09e68f7861b26. There are no workarounds aside from applying the patch. 2021-09-03 5 CVE-2021-39193 MISC MISC CONFIRM MISC phpwcms -- phpwcms phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. 2021-09-08 4.3 CVE-2020-19855 MISC pureftpd -- pure-ftpd In Pure-FTPd 1.0.49, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. 2021-09-05 5 CVE-2021-40524 MISC python -- pillow The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function. 2021-09-03 5 CVE-2021-23437 CONFIRM CONFIRM CONFIRM simplesystems -- libtiff Buffer Overflow in LibTiff v4.0.10 allows attackers to cause a denial of service via the "invertImage()" function in the component "tiffcrop". 2021-09-07 5 CVE-2020-19131 MISC MISC swiftcrm -- club-management-software An id GET parameter of the WordPress Membership SwiftCloud.io WordPress plugin through 1.0 is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. 2021-09-06 6.5 CVE-2021-24392 MISC MISC versa-networks -- versa_director A XSS vulnerability exists in Versa Director Release: 16.1R2 Build: S8. An attacker can use the administration web interface URL to create a XSS based attack. 2021-09-07 4.3 CVE-2021-39285 MISC MISC vim -- vim vim is vulnerable to Heap-based Buffer Overflow 2021-09-06 4.6 CVE-2021-3770 MISC CONFIRM FEDORA weechat -- weechat WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bounds read in plugins/relay/relay-websocket.c in the Relay plugin. 2021-09-05 5 CVE-2021-40516 MISC MISC wp-webhooks -- email_encoder The Email Encoder – Protect Email Addresses WordPress plugin before 2.1.2 has an endpoint that requires no authentication and will render a user supplied value in the HTML response without escaping or sanitizing the data. 2021-09-06 4.3 CVE-2021-24599 MISC zmartzone -- mod_auth_openidc mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version. 2021-09-03 5.8 CVE-2021-39191 MISC MISC MISC CONFIRM Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info addtoany -- addtoany_share_buttons The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed 2021-09-06 3.5 CVE-2021-24568 MISC bluetrum -- ab5301a_firmware The Bluetooth Classic implementation on Bluetrum AB5301A devices with unknown firmware versions does not properly handle the reception of oversized DM1 LMP packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity. 2021-09-07 3.3 CVE-2021-34150 MISC MISC bookstackapp -- bookstack bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-09-06 3.5 CVE-2021-3768 MISC CONFIRM bookstackapp -- bookstack bookstack is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-09-06 3.5 CVE-2021-3767 CONFIRM MISC cliniccases -- cliniccases Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft. 2021-09-07 3.5 CVE-2021-38707 MISC MISC dna88 -- highlight The Highlight WordPress plugin before 0.9.3 does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed 2021-09-06 3.5 CVE-2021-24591 MISC espressif -- esp-idf The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet. 2021-09-07 3.3 CVE-2021-28136 MISC MISC MISC MISC eyoucms -- eyoucms Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. 2021-09-07 3.5 CVE-2021-39496 MISC MISC gdprinfo -- cookie_notice_&_consent_banner_for_gdpr_&_ccpa_compliance The Cookie Notice & Consent Banner for GDPR & CCPA Compliance WordPress plugin before 1.7.2 does not properly sanitize inputs to prevent injection of arbitrary HTML within the plugin's design customization options. 2021-09-06 3.5 CVE-2021-24590 MISC geminilabs -- site_reviews The Site Reviews WordPress plugin before 5.13.1 does not sanitise some of its Review Details when adding a review as an admin, which could allow them to perform Cross-Site Scripting attacks when the unfiltered_html is disallowed 2021-09-06 3.5 CVE-2021-24603 MISC jforum -- jforum ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature. 2021-09-04 3.5 CVE-2021-40509 MISC MISC FULLDISC MISC nextcloud -- circles Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly. 2021-09-07 3.5 CVE-2021-32782 CONFIRM MISC MISC otrs -- otrs It's possible to craft a request for appointment edit screen, which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions. 2021-09-06 3.5 CVE-2021-36094 CONFIRM ti -- cc256xcqfn-em_firmware The Bluetooth Classic implementation on the Texas Instruments CC256XCQFN-EM does not properly handle the reception of continuous LMP_AU_Rand packets, allowing attackers in radio range to trigger a denial of service (deadlock) of the device by flooding it with LMP_AU_Rand packets after the paging procedure. 2021-09-07 3.3 CVE-2021-34149 MISC MISC MISC trumani -- stop_spammers The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed 2021-09-06 3.5 CVE-2021-24517 MISC web-settler -- form_builder The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed 2021-09-06 3.5 CVE-2021-24513 MISC wpfront -- wpfront_notification_bar The WPFront Notification Bar WordPress plugin before 2.1.0.08087 does not properly sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. 2021-09-06 3.5 CVE-2021-24601 MISC zh-jieli -- ac6901_firmware The Bluetooth Classic implementation on Zhuhai Jieli AC690X and AC692X devices does not properly handle the reception of a truncated LMP packet during the LMP auto rate procedure, allowing attackers in radio range to immediately crash (and restart) a device via a crafted LMP packet. 2021-09-07 3.3 CVE-2021-31613 MISC MISC MISC MISC zh-jieli -- fw-ac63_bt_sdk The Bluetooth Classic implementation in the Zhuhai Jieli AC6366C BT SDK through 0.9.1 does not properly handle the reception of truncated LMP_SCO_Link_Request packets while no other BT connections are active, allowing attackers in radio range to prevent new BT connections (disabling the AB5301A inquiry and page scan procedures) via a crafted LMP packet. The user needs to manually perform a power cycle (restart) of the device to restore BT connectivity. 2021-09-07 3.3 CVE-2021-34144 MISC MISC MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apple -- multiple_products A logic issue was addressed with improved restrictions. This issue is fixed in iOS 14.5 and iPadOS 14.5, tvOS 14.5. A local user may be able to create or modify privileged files. 2021-09-08 not yet calculated CVE-2021-1836 MISC MISC apple -- multiple_products Multiple issues in apache were addressed by updating apache to version 2.4.46. This issue is fixed in Security Update 2021-004 Mojave. Multiple issues in apache. 2021-09-08 not yet calculated CVE-2021-30690 MISC gdpm -- gdpm qdPM V9.1 is vulnerable to Cross Site Scripting (XSS) via qdPMinstallmodulesdatabase_config.php. 2021-09-09 not yet calculated CVE-2020-19515 MISC accounting -- accounting   An issue in the noReentrance() modifier of the Ethereum-based contract Accounting 1.0 allows attackers to carry out a reentrancy attack. 2021-09-07 not yet calculated CVE-2020-19765 MISC adobe -- after_effects   Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-28571 MISC adobe -- creative_cloud_desktop   Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the attacker's local machine. 2021-09-08 not yet calculated CVE-2021-28581 MISC adobe -- genuine_services   Adobe Genuine Services version 7.1 (and earlier) is affected by an Insecure file permission vulnerability during installation process. A local authenticated attacker could leverage this vulnerability to achieve privilege escalation in the context of the current user. 2021-09-08 not yet calculated CVE-2021-28568 MISC adobe -- illustrator   Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-21103 MISC adobe -- illustrator   Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-21104 MISC adobe -- illustrator   Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-21105 MISC adobe -- magento Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation. 2021-09-08 not yet calculated CVE-2021-28567 MISC adobe -- magento   Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation. 2021-09-08 not yet calculated CVE-2021-28566 MISC adobe -- media_encoder   Adobe Media Encoder version 15.1 (and earlier) is affected by an Out-of-bounds Read vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose sensitive memory information in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-28569 MISC adobe -- medium   Medium by Adobe version 2.4.5.331 (and earlier) is affected by a buffer overflow vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-09-08 not yet calculated CVE-2021-28580 MISC advantech -- webaccess   A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. 2021-09-09 not yet calculated CVE-2021-38408 MISC android -- samsung NULL pointer dereference vulnerability in ION driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. 2021-09-09 not yet calculated CVE-2021-25458 MISC android -- samsung An improper access control vulnerability in sspExit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to terminate BlockchainTZService. 2021-09-09 not yet calculated CVE-2021-25460 MISC android -- samsung An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack. 2021-09-09 not yet calculated CVE-2021-25465 MISC android -- samsung   An improper access control vulnerability in sspInit() in BlockchainTZService prior to SMR Sep-2021 Release 1 allows attackers to start BlockchainTZService. 2021-09-09 not yet calculated CVE-2021-25459 MISC android -- samsung   Some improper access control in Bluetooth APIs prior to SMR Sep-2021 Release 1 allows untrusted application to get Bluetooth information. 2021-09-09 not yet calculated CVE-2021-25453 MISC android -- samsung   An improper input validation vulnerability in loading graph file in DSP driver prior to SMR Sep-2021 Release 1 allows attackers to perform permanent denial of service on the device. 2021-09-09 not yet calculated CVE-2021-25452 MISC android -- samsung   Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token. 2021-09-09 not yet calculated CVE-2021-25466 MISC android -- samsung   An improper file management vulnerability in SamsungCapture prior to version 4.8.02 allows sensitive information leak. 2021-09-09 not yet calculated CVE-2021-25464 MISC android -- samsung   NULL pointer dereference vulnerability in NPU driver prior to SMR Sep-2021 Release 1 allows attackers to cause memory corruption. 2021-09-09 not yet calculated CVE-2021-25462 MISC android -- samsung   An improper length check in APAService prior to SMR Sep-2021 Release 1 results in stack based Buffer Overflow. 2021-09-09 not yet calculated CVE-2021-25461 MISC android -- samsung   An improper input validation vulnerability in DSP driver prior to SMR Sep-2021 Release 1 allows local attackers to get a limited kernel memory information. 2021-09-09 not yet calculated CVE-2021-25457 MISC android -- samsung   OOB read vulnerability in libswmfextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute memcpy at arbitrary address via forged wmf file. 2021-09-09 not yet calculated CVE-2021-25456 MISC android -- samsung   OOB read vulnerability in libsaviextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to access arbitrary address through pointer via forged avi file. 2021-09-09 not yet calculated CVE-2021-25455 MISC android -- samsung   OOB read vulnerability in libsaacextractor.so library prior to SMR Sep-2021 Release 1 allows attackers to execute remote DoS via forged aac file. 2021-09-09 not yet calculated CVE-2021-25454 MISC android -- samsung   Improper access control vulnerability in PENUP prior to version 3.8.00.18 allows arbitrary webpage loading in webview. 2021-09-09 not yet calculated CVE-2021-25463 MISC any23 -- any23   A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities. 2021-09-11 not yet calculated CVE-2021-40146 CONFIRM MLIST any23 -- any23   An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. 2021-09-11 not yet calculated CVE-2021-38555 CONFIRM apache -- airflow   The variable import endpoint was not protected by authentication in Airflow >=2.0.0, =2.0.0,

Read more »

KrebsOnSecurity Hit By Huge New IoT Botnet “Meris”
On Thursday evening, KrebsOnSecurity was the subject of a rather massive (and mercifully brief) distributed denial-of-service (DDoS) attack. The assault came from "Meris," the same new "Internet of Things" (IoT) botnet behind record-shattering attacks against Russian search giant Yandex this week and internet infrastructure firm Cloudflare earlier this summer.

Read more »

How Much RAM Is in an iPhone? Why Apple Doesn’t Give Specs
Have you ever wondered how much RAM is in your iPhone? Have you ever felt that it mattered? The post appeared first on The Mac Security Blog.

Read more »

Verizon offers 25% discount on Apple MagSafe Chargers through September 30th
Verizon has Apple MagSafe Chargers on sale for 25% off MSRP from 9/16/21 to 9/30/21. Verizon service is not required to take advantage of these savings. With the discount, Verizon’s sale prices are among the lowest prices anywhere for MagSafe Chargers: – MagSafe Charger: $29.99, regularly $39 – MagSafe Duo Charger: $96.74, regularly $129 Shipping is free, or order online and pick up in-store (if […] The post first appeared on MacPrices.net.

Read more »

Verizon offers $1000 discount on new Apple iPhone 13 Pro and 13 Pro Max with qualified trade-in
Verizon is offering a $1000 discount on Apple’s new iPhone 13 Pro and iPhone 13 Pro Max for new and existing customers with a qualified trade-in. Price of the iPhone 13 Pro will be spread over 24 or 30 months of payments, depending on the chosen Unlimited service plan. Final price of the discount will be based on the value of your trade-in. Verizon’s discount […] The post first appeared on MacPrices.net.

Read more »

New at AT&T: Apple iPhone 13 and 13 mini discounted up to $700 off MSRP
We’ve already told you about AT&T’s $1000 discounts on the Apple iPhone 13 Pro and iPhone 13 Pro Max. AT&T now has Apple’s new iPhone 13 and iPhone 13 mini discounted to $700 off MSRP for new and existing customers with an eligible trade-in. Discount is applied via monthly bill credits over a 36 month period (from $13.89/mo. up to $30.56/mo. based on device purchased). […] The post New at AT&T: Apple iPhone 13 and 13 mini discounted up to $700 off MSRP first appeared on MacPrices.net.

Read more »

‘Mac Potpourri’ Story On Apple And Folding Smartphones Featured As Editor’s Pick By LinkedIn News
FEATURE: 09.16.21 – A certain writer has been seemingly thrust into the limelight thanks to an article published last month on MacPrices. The article — a commentary on how Apple must “‘flip’ the script” (so to speak) on folding smartphones — was my take on what the Cupertino, California-based company needs to do in order to innovate should it ever decide to release an iPhone […] The post first appeared on MacPrices.net.

Read more »

AT&T to offer $1000 discounts on Apple iPhone 13 Pro and iPhone 13 Pro Max
AT&T will offer Apple’s new iPhone 13 Pro and iPhone 13 Pro Max for $1000 off MSRP for new and existing customers with an eligible trade-in. Discount is applied via monthly bill credits over a 36 month period (from $27.78/mo. up to $44.45/mo. based on device purchased). The level of this offer will depend on the final value of your trade-in. Orders for Apple’s new […] The post AT&T to offer $1000 discounts on Apple iPhone 13 Pro and iPhone 13 Pro Max first appeared on MacPrices.net.

Read more »

First discounts arrive on Apple’s new 9th generation iPad and 8.3″ iPad mini
Apple reseller Expercom is offering preorder discounts on Apple’s new 2021 9th generation iPad and 8.3″ iPad mini. They are the first reseller to offer such discounts. Expercom expects shipping within 3-6 weeks, officially, although we expect that number could decrease next week as stock becomes available: iPad: – 10″ 64GB WiFi iPad: $315 $14 off MSRP – 10″ 256GB WiFi iPad: $450 $29 off […] The post first appeared on MacPrices.net.

Read more »

First discounts arrive on Apple’s new 9th generation iPad and 8.3″ iPad mini
Apple reseller Expercom is offering preorder discounts on Apple’s new 2021 9th generation iPad and 8.3″ iPad mini. They are the first reseller to offer such discounts. Expercom expects shipping within 3-6 weeks, officially, although we expect that number could decrease next week as stock becomes available: iPad: – 10″ 64GB WiFi iPad: $315 $14 off MSRP – 10″ 256GB WiFi iPad: $450 $29 off […] The post first appeared on MacPrices.net.

Read more »

Apple now offering 2nd generation 4K Apple TVs with Siri remote $30 off MSRP
Apple is now offering Certified Refurbished 2nd generation 32GB and 64GB 4K Apple TVs with Siri remotes for $30 off the cost of new models. Apple’s standard one-year warranty is included with each model, and shipping is free: – 32GB 4K Apple TV: $149 $30 off – 64GB 4K Apple TV: $169 $30 off – 32GB Apple TV HD: $129 $20 off For the latest […] The post first appeared on MacPrices.net.

Read more »

Apple drops prices on Certified Refurbished iPhones, now offers models from only $319
With the introduction of the iPhone 13 today, Apple has dropped prices on a range of Certified Refurbished iPhones, with models now available starting at only $319. Apple includes a standard one-year warranty, new outer shell, and shipping is free. According to Apple, “Each product is backed with our standard one-year warranty and is eligible for AppleCare to extend the coverage further. with the same […] The post first appeared on MacPrices.net.

Read more »

Apple introduces the iPhone 13
Apple today introduced their next generation iPhone, the iPhone 13, iPhone 13 Pro/Max, and iPhone 13 mini. While featuring a designs, and sizes, as iPhone 12 models, the iPhone 13 models have several new updated features. For the iPhone 13 and 13 mini: – Durable ceramic front display shield – Super Retina XDR OLED display. 28% brighter, 800 nits brightness with a 1200 nits peak […] The post first appeared on MacPrices.net.

Read more »

Apple introduces the next-generation Watch: Apple Watch Series 7
Apple today introduced their next-generation Watch: The Apple Watch Series 7. The new 7 Series features an improved larger display with 20% more area than the Series 6 Watches, 1.7mm borders, and a case & display softer more rounder corners giving the Watch display a wrap around effect. The display is also 70% brighter indoors and can display 50% more text than Series 6 Watches. […] The post first appeared on MacPrices.net.

Read more »

Apple introduces updated iPad and all-new iPad mini
Apple today released an updated 10″ iPad featuring an A13 Bionic processor capable of 20% faster performance. Apple also updated the new iPad with a 12MP ultra wide camera with Center Stage and True Tone display. The new 2021 10.2″ iPad features the same basic design as before, will run iPadOS 15, and starts at $329 ($299 for Education). It’s available for order today and […] The post first appeared on MacPrices.net.

Read more »