NSO Targets: A List of People Infected With Pegasus Spyware
Omer Benjakob has put together a helpful list of NSO targets that includes every individual believed to have been infected with the group's Pegasus spyware. So far, targets have been found across the world: from India and Uganda to Mexico and the West Bank, with high-profile victims including U.S. officials and a New York Times journalist. Now, for the first time, Haaretz has assembled a list of confirmed cases involving Pegasus spyware.

Read more »

Deals: iPhone 12/mini sees $232 refurb discounts, plus Philips Hue and Eve HomeKit gear
All of today’s best deals kick off with $232 iPhone 12/mini discounts. That’s alongside HomeKit gear from Philips Hue and Eve starting at $30. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more… The post appeared first on 9to5Mac.

Read more »

Apple TV+ garners 9 NAACP Image Awards nominations
Five Apple TV+ Original films and three series received a total of nine nominations Tuesday for the upcoming 53rd annual NAACP Image Awards. Last year the streaming service netted 11 nominations and won Outstanding Independent Motion Picture for The Banker. Nominations for 5 Apple TV+ films Five Apple TV+ Original films received NAACP Image Awards […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Valentine's Day Gift Guide 2022: Top tech treats for Apple lovers
AppleInsider's 2022 Valentine's Day gift guide is here and is filled to the brim with tech treats sure to put a smile on your sweetheart's face.Valentine's day is rapidly approaching, and AppleInsider is here to help you pick out a perfect present for the tech fan in your life. Whether you're looking for something stylish or something useful, we've picked out some great gifts for that someone special.Solo NY's Re:new Briefcase Read more...

Read more »

Guide: iPhone Gamers Can Enjoy Two More Netflix Games
Two additional Netflix games are rolling out for iPhone and Android gamers. One is called Arcanium: Rise of Akhan and the other is Krispee Street. Two Additions for Netflix Netflix's gaming service launched late last year to compete with other services such as Apple Arcade. Like Arcade, the offerings from Netflix are more "casual" games for players. The company recently tweeted about them: https://twitter.com/NetflixGeeked/status/1483559835786518528?s=20 The first game is called Arcanium: Rise of Akhan and it's an open-world strategy card game for single players. Developed by Rogue Games, the goal is to create a team of heroes and defeat a boss called Akhan the Calamity to save the world of Arzu. The second game is Krispee Street and was developed by Frosty Pop. In this puzzle game, players need to find characters and objects throughout each level, and there are hundreds. It's based on a web comic called Krispee. This brings the total of number to 12, and they include Stranger Things 3, Stranger Things 1984, Dominos Cafe, Card Blast, Bowling Ballers, Wonderputt Forever, Knittens, Shooting Hoops, Asphalt Xtreme, and Teeter Up. How to Find Netflix Games on iPhone To find these games you'll have to scroll down on your homepage until you see the Games section. The company says games don't appear in Kids profiles. Open the Netflix app and scroll to find the Games row. Tap on the game. Tap Get Game. The App Store will open. Select Get or tap the Cloud icon. The game will download and install to your device. When complete, choose Open. After a game is installed, you can find it under the Netflix Games row in the Netflix app. It may also be on your device's home screen.  Enter your Netflix email address and password. Select Log In. Netflix plans to add more games over time.

Read more »

Apple expected top launch 5G iPhone SE as early as April
Apple’s third-generation iPhone SE with 5G connectivity is expected to launch as early as April. Display Supply Chain Consultants analyst… The post appeared first on MacDailyNews.

Read more »

Apple expected to launch 5G iPhone SE as early as April
Apple’s third-generation iPhone SE with 5G connectivity is expected to launch as early as April. Display Supply Chain Consultants analyst… The post appeared first on MacDailyNews.

Read more »

How to clean your Apple Polishing Cloth without ruining it
If you have to spend $19 on Apple’s fancy Polishing Cloth, you should know how to properly look after it so that it doesn’t get ruined. You can’t just throw it in the washing machine with your mucky laundry when it starts to get dirty. Fortunately, Apple has now provided official instructions on keeping the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Businesses have stark differences of opinion on proposed anti-Big Tech bills
Two groups both claiming to represent small business interests in the United States have each released open letters, one urging Congress to leave big tech alone as it gives a platform to businesses that might not get one — and one supporting the bill.Following Apple's assertion that proposed antitrust bills would hurt consumers and security, two groups have written to Congress about the American Innovation and Choice Online Act. Both represent small businesses, both believe the proposals will harm their members, and each completely disagrees with the other.One group consists of "more than 35" technology firms, including Yelp, Sonos, and DuckDuckGo. In its full letter to Congress, this group says that the Act would "help restore competition in the digital marketplace and remove barriers for consumers to choose the services they want." Read more...

Read more »

iPhone SE 3 displays enter production ahead of April or May debut
Apple will this month begin manufacturing display panels for the next-generation iPhone SE ahead of its launch in late April or early May, according to a new report. The new entry-level handset is expected to bring 5G connectivity to the iPhone SE series for the first time — as well as the same A15 Bionic chip […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

FuboTV overhauls Apple TV app with enhanced Multiview experience
FuboTV, the popular live TV streaming platform, is rolling out a notable update to its Apple TV application today. The update brings a handful of new features that expand upon the popular Multiview functionality, which allows sports fans to watch up to four games at once on the same screen. more… The post appeared first on 9to5Mac.

Read more »

Apple TV+ shares trailer for WeWork drama series 'WeCrashed'
Apple TV+ has released an official teaser trailer for "WeCrashed," an upcoming drama series chronicling the rise and fall of WeWork coming to the streaming platform in March.Apple TV+ WeCrashedIn the one-minute trailer, viewers are introduced to WeWork cofounder Adam Neumann, played by Jared Leto, and his wife Rebekah, played by Anne Hathaway. Read more...

Read more »

Jared Leto and Anne Hathaway star in new Apple TV+ limited series ‘WeCrashed’
Apple TV+ today unveiled the teaser trailer and premiere date for “WeCrashed,” starring Academy Award winners Jared Leto and Anne Hathaway … The post appeared first on MacDailyNews.

Read more »

Ericsson Sues Apple Again Over 5G Patent Licensing
Sweden's Ericsson has filed another set of patent infringement lawsuits against Apple in the latest salvo between the two companies over royalty payment for use of 5G wireless patents in iPhones. From a report: Both companies have already sued each other in the United States as negotiations failed over the renewal of a seven-year licensing contract for telecoms patents first struck in 2015. Ericsson sued first in October, claiming that Apple was trying to improperly cut down the royalty rates. The iPhone maker then filed a lawsuit in December accusing the Swedish company of using "strong-arm tactics" to renew patents. "Ericsson has refused to negotiate fair terms for renewing our patent licensing agreement, and instead has been suing Apple around the world to extort excessive royalties ... we are asking the court to help determine a fair price," an Apple spokesman said on Tuesday. Patent lawsuits are quite common among technology companies because every dollar saved could amount to significant amounts over the duration of the agreement, with companies such as Ericsson charging $2.50 to $5 for every 5G handset. Read more of this story at Slashdot.

Read more »

We booped the Sun
Marina Koren, The Atlantic: Kelly Korreck is still thinking about the time her spacecraft flew into the sun, how one moment, the probe was rushing through a stormy current of fast-moving particles, and the next, it was plunging somewhere quieter, where the plasma rolled like ocean waves. No machine had ever crossed that mysterious boundary before. But Korreck and her team had dispatched a mission for that exact purpose, and their plan worked. For the first time in history, a spacecraft had entered the sun’s atmosphere. This is an amazing story about an astonishing feat. NASA's Parker Probe dove into the sun last April and lived to tell the tale. Just wow.∞ Read this on The Loop

Read more »

∞ Apple TV+ shares trailer for “Severance”
This looks terrific. First episode drops February 18th. Looks like Severance is already picked up for a second season. Great cast. Reminder set.

Read more »

Google Analytics declared illegal in the EU
Tutanota (via Hacker News): Max Schrems, the lawyer who successfully sued Facebook for privacy violations against European citizens, has scored another victory, this time against Google: In a landmark court ruling, Austria's data protection authority has found that Google Analytics is illegal to use on European websites. As to how this came about: On August 14, 2020, a Google user had accessed an Austrian website about health issues. This website used Google Analytics, and data about the user was transmitted to Google. Based on this data, Google was able to deduce who he or she was. On August 18, 2020, the Google user complained to the Austrian data protection authority with the help of the data protection organization NOYB. And: Google is "subject to surveillance by US intelligence services and can be ordered to disclose data of European citizens to them". Therefore, the data of European citizens may not be transferred across the Atlantic. Lots of changes happening around the world, both for and to the detriment of privacy.∞ Read this on The Loop

Read more »

Apple explains how to clean its Polishing Cloth (without buying a new Polishing Cloth)
One of the most popular products from Apple in 2021 was certainly its polishing cloth. With stock gone for weeks, the product only recently reappeared, but a question remained: how to actually clean it without the need to buy a new polishing cloth? Apple has explained. more… The post appeared first on 9to5Mac.

Read more »

Army wife uses AirTag to track late moving truck driver during a relocation
An Army spouse says she used an AirTag to keep tabs on her family's belongings during a move when a shady moving truck driver didn't deliver the items on time.An Apple AirTagMilitary members doing permanent change of station (PCS) moves have historically had issues with shippers' accountability of household goods. Shipments often get stalled for weeks or months by contractors, with little or no communications on the location, or the reason why, the goods were lost or delayed. In fact, AppleInsider staffers have dealt with lack of accountability or good tracking of the shipments multiple times. Read more...

Read more »

Apple TV+ shares teaser trailer for ‘WeCrashed’, a limited series about the fall of WeWork
Apple TV+ today released a trailer for a new limited series ‘WeCrashed’, which charts the rise and fall of WeWork, one of the most controversial technology startups of recent years. The series will debut on March 18 … more… The post appeared first on 9to5Mac.

Read more »

New iPhone SE production starts in late January with May launch, claims leaker
A new leak claims that production will begin on the next iPhone SE in January, with a launch most likely to be in late May, or early April.The current iPhone SEFollowing his claim that the 2022 iPhone SE will be a minor update, compared to 2023's redesign, analyst Ross Young now says that the phone is entering production. Read more...

Read more »

Explore the latest videos
Discover how you can add support for in-app events, develop for Apple Watch, learn about Metal for A15, and more. Tech Talks Build and deploy Safari Extensions for iOS Tech Talks Get started with custom product pages Tech Talks Get started with product page optimization Tech Talks Deploy iOS 15 in your organization Tech Talks Prepare your organization for macOS Monterey Tech Talks Tips for preventing common review issues Tech Talks Explore and manipulate data in Swift with TabularData Tech Talks Metal Compute on MacBook Pro Tech Talks Get the most out of CloudKit Sharing Tech Talks Tune CPU job scheduling for Apple silicon games Tech Talks Support customers with StoreKit 2 and App Store Server API Tech Talks Get started with in-app events Tech Talks Meet Apple Watch Series 7 Tech Talks Discover advances in Metal for A15 Bionic

Read more »

Apple slashes trade-in prices on a bunch of Android phones
We have disappointing news for those who are currently thinking about swapping their Android smartphone for an iPhone. Apple just cut its trade-in prices for a bunch of popular handsets from Google and Samsung. The reductions are pretty significant in most cases. A Galaxy S21+ 5G, which was previously worth up to $435, now fetches […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iPhone SE with 5G expected to launch in April or May as production moves ahead
We’re inching closer to the release of Apple’s third-generation iPhone SE with 5G connectivity. According to reliable analyst Ross Young, panel production for the display that will be used in the iPhone SE 3 is starting this month, suggesting a launch in the second half of April or early May. more… The post appeared first on 9to5Mac.

Read more »

Verizon’s 5G UWB to hit 1,700 cities this month with new plans, more [Update: Rollout now complete]
Verizon has made a major announcement about its 5G coverage today. This month, the carrier will offer ultra-fast 5G UWB connectivity to over 1,700 US cities that will cover more than 100 million people. Verizon is also improving its 5G smartphone plans with up to 6 free entertainment subscriptions and offering customers up to 50% off its 5G Home Internet. Update 1/19: Verizon has shared this morning that the major rollout of 5G UWB to 1,700 US cities is now complete. more… The post appeared first on 9to5Mac.

Read more »

Best deals Jan. 19: $190 AirPods Pro, $400 off 65-inch 4K 120Hz TV, more!
In addition to discounted AirPods Pro, Wednesday's best deals include $250 off a Roomba smart vacuum, $250 off Linksys WiFi 6E router 3-pack, 12% off a Polaroid instant camera, and a $35 Air Fryer.Best deals January 19As we do every day, we've collected some of the best deals we could find on Apple products, tech accessories, and other items for the AppleInsider audience. If an item is out of stock, it may still be able to be ordered for delivery at a later date. Read more...

Read more »

Protect yourself online with this all-in-one security bundle
Who said you needed a ton of different subscriptions to protect your privacy, fight viruses and shield your devices from harm? You can keep things simple and do it with a single account with Surfshark One: VPN, Antivirus, Search, & Alert. And, for a limited time, a year’s subscription to this security bundle is on […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How to tell the difference between real AirPods Pro and counterfeit ones
Details are key in spotting a fake set of AirPods or AirPods Pro. We picked up a set of widely available clones and compared them to genuine AirPods Pro so you can better protect yourself from getting scammed by counterfeit Apple earbuds.AirPods Pro arriving in a fake boxThe markets are inundated by fake AirPods and AirPods Pro. With the incredible popularity of Apple's earbuds, it comes as no surprise. They've become available through shady third-party websites as well as person-to-person resale sites. Read more...

Read more »

At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates
The Russian government said today it arrested 14 people accused of working for "REvil," a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin's decision to station 100,000 troops along the nation's border with Ukraine.

Read more »

SysJoker: Cross-Platform Backdoor Malware for Mac, Windows, and Linux
  SysJoker is one of the most recently discovered Mac malware families. But SysJoker is not just Mac malware—it’s cross-platform malware that can also infect PCs running Windows or Linux. Intego detects this malware’s various components as OSX/SysJoker.gen, OSX/SysJoker.lct, Linux/SysJoker.A, and Win32/SysJoker.A. Let’s examine this new threat and what makes it unique. How was SysJoker […] The post appeared first on The Mac Security Blog.

Read more »

SysJoker Malware and Scams in the App Store – Intego Mac Podcast Episode 222
New SysJoker malware attacks Mac, Windows, and Linux computers. Apple has difficulty managing scams and copycat apps in its App Stores. And iCloud Private Relay is provoking ire among phone carriers. The post appeared first on The Mac Security Blog.

Read more »

Who is the Network Access Broker ‘Wazawaka?’
In a great many ransomware attacks, the criminals who pillage the victim's network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene.

Read more »

‘Wormable’ Flaw Leads January 2022 Patch Tuesday
Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is "wormable," meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.

Read more »

Vulnerability Summary for the Week of January 3, 2022
Original release date: January 10, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info beyondtrust -- appliance_base_software BeyondTrust Secure Remote Access Base Software through 6.0.1 allows an attacker to achieve full admin access to the appliance, by tricking the administrator into creating a new admin account through an XSS/CSRF attack involving a crafted request to the /appliance/users?action=edit endpoint. This cross-site-scripting (XSS) vulnerability occurs when it does not properly sanitize an unauthenticated crafted web request to the server 2022-01-05 9.3 CVE-2021-31589 MISC MISC MISC sun_moon_jingyao -- network_computer_terminal_protection_system_firmware The server-request receiver function of Shockwall system has an improper authentication vulnerability. An authenticated attacker of an agent computer within the local area network can use the local registry information to launch server-side request forgery (SSRF) attack on another agent computer, resulting in arbitrary code execution for controlling the system or disrupting service. 2022-01-03 7.7 CVE-2021-45917 CONFIRM transloadit -- uppy uppy is vulnerable to Server-Side Request Forgery (SSRF) 2022-01-04 7.5 CVE-2022-0086 MISC CONFIRM Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info artifex -- ghostscript Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). 2022-01-01 4.3 CVE-2021-45944 MISC MISC DEBIAN artifex -- ghostscript Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). 2022-01-01 4.3 CVE-2021-45949 MISC MISC MISC DEBIAN assimp -- assimp Open Asset Import Library (aka assimp) 5.1.0 and 5.1.1 has a heap-based buffer overflow in _m3d_safestr (called from m3d_load and Assimp::M3DWrapper::M3DWrapper). 2022-01-01 4.3 CVE-2021-45948 MISC MISC asus -- rt-ac52u_b1_firmware Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack. 2022-01-03 4.3 CVE-2021-46109 MISC atlassian -- jira_server_and_data_center Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. 2022-01-04 4.3 CVE-2021-43942 MISC booking_calendar_project -- booking_calendar The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting 2022-01-03 4.3 CVE-2021-25040 MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’ passwords with minimal to no computational effort. 2022-01-05 4 CVE-2022-22110 CONFIRM MISC daybydaycrm -- daybyday_crm In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application. 2022-01-05 6.5 CVE-2022-22111 CONFIRM MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information. 2022-01-05 4 CVE-2022-22108 CONFIRM MISC daybydaycrm -- daybyday_crm In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all. 2022-01-05 4 CVE-2022-22107 CONFIRM MISC dhrystone_project -- dhrystone A NULL pointer dereference in the main() function dhry_1.c of dhrystone 2.1 causes a denial of service (DoS). 2022-01-03 5 CVE-2020-23026 MISC dmproadmap_project -- dmproadmap DMP Roadmap before 3.0.4 allows XSS. 2022-01-01 4.3 CVE-2021-44896 MISC MISC MISC fluxbb -- fluxbb Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. 2022-01-04 4.3 CVE-2021-43677 MISC MISC geminilabs -- site_reviews The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin 2022-01-03 4.3 CVE-2021-24973 CONFIRM MISC github_readme_stats_project -- github_readme_stats Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError. 2022-01-06 4.3 CVE-2020-23986 MISC gpac -- gpac A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via __strlen_avx2, which causes a Denial of Service. 2022-01-05 4.3 CVE-2021-45831 MISC gpac -- gpac A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent). 2022-01-05 4.3 CVE-2021-46038 MISC ideabox -- powerpack_addons_for_elementor The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue 2022-01-03 4.3 CVE-2021-25027 CONFIRM MISC premio -- chaty The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting 2022-01-03 4.3 CVE-2021-25016 MISC updraftplus -- updraftplus The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues 2022-01-03 4.3 CVE-2021-25022 CONFIRM CONFIRM MISC uwebsockets_project -- uwebsockets uWebSockets 19.0.0 through 20.8.0 has an out-of-bounds write in std::__1::pair uWS::HttpParser::fenceAndConsumePostPadded

Read more »

How to Run Windows on an Intel or M1 Mac
There used to be many options for running Windows on a Mac, and now it's more limited, but you can still run Windows on your Mac if you want. The post appeared first on The Mac Security Blog.

Read more »

500M Avira Antivirus Users Introduced to Cryptomining
Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn't alone in this dubious endeavor: Avira antivirus -- which has built a base of 500 million users worldwide largely by making the product free -- was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.

Read more »

Norton 360 Now Comes With a Cryptominer
Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers' computers. Norton's parent firm says the cloud-based service that activates the program and enables customers to profit from the scheme -- in which the company keeps 15 percent of any currencies mined -- is "opt-in," meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, "Dude, where's my crypto?"

Read more »

Look-Alike Letters Lead Users to Lose Moola – Intego Mac Podcast Episode 221
Attackers can simulate an iPhone restart to keep malware alive, and an interesting HomeKit vulnerability could brick your device. We discuss malicious QR codes, and we take a deep dive into Apple's two-factor authentication, which more and more users need to use Apple devices. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of December 27, 2021
Original release date: January 4, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no high vulnerabilities recorded this week. Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- log4j Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2. 2021-12-28 6 CVE-2021-44832 MISC MISC MLIST CONFIRM MLIST livehelperchat -- live_helper_chat livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-26 4.3 CVE-2021-4169 MISC CONFIRM mediawiki -- mediawiki In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. 2021-12-24 5 CVE-2021-45471 MISC MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. 2021-12-24 4.3 CVE-2021-45472 MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). 2021-12-24 4.3 CVE-2021-45473 MISC MISC mediawiki -- mediawiki In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. 2021-12-24 4.3 CVE-2021-45474 MISC MISC netgear -- rbk752_firmware Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK752 before 3.2.16.6, RBR750 before 3.2.16.6, RBS750 before 3.2.16.6, RBK852 before 3.2.16.6, RBR850 before 3.2.16.6, and RBS850 before 3.2.16.6. 2021-12-26 5.2 CVE-2021-45584 MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info invoiceninja -- invoice_ninja invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-24 3.5 CVE-2021-3977 MISC CONFIRM Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info netgear -- ac2600_firmware Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects AC2100 before 1.2.0.88, AC2400 before 1.2.0.88, AC2600 before 1.2.0.88, R6220 before 1.1.0.110, R6230 before 1.1.0.110, R6260 before 1.1.0.84, R6330 before 1.1.0.84, R6350 before 1.1.0.84, R6700v2 before 1.2.0.88, R6800 before 1.2.0.88, R6850 before 1.1.0.84, R6900v2 before 1.2.0.88, R7200 before 1.2.0.88, R7350 before 1.2.0.88, R7400 before 1.2.0.88, and R7450 before 1.2.0.88. 2021-12-26 not yet calculated CVE-2021-45644 MISC netgear -- d7000v2_firmware Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7000v2 before 1.0.0.66, D8500 before 1.0.3.58, R7000 before 1.0.11.110, R7100LG before 1.0.0.72, R7900 before 1.0.4.30, R8000 before 1.0.4.62, XR300 before 1.0.3.56, R7000P before 1.3.2.132, R8500 before 1.0.2.144, R6900P before 1.3.2.132, and R8300 before 1.0.2.144. 2021-12-26 not yet calculated CVE-2021-45624 MISC 4nb -- videooffice   An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check. 2021-12-28 not yet calculated CVE-2020-7878 MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25025 MISC MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25024 MISC MISC actix -- actix-web   An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption. 2021-12-27 not yet calculated CVE-2018-25026 MISC MISC apache -- apisix_dashboard   In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication. 2021-12-27 not yet calculated CVE-2021-45232 CONFIRM MLIST archivy -- archivy   archivy is vulnerable to Cross-Site Request Forgery (CSRF) 2021-12-25 not yet calculated CVE-2021-4162 CONFIRM MISC asus -- rt-n53_devices   ASUS RT-N53 3.0.0.4.376.3754 devices have a buffer overflow via a long lan_dns1_x or lan_dns2_x parameter to Advanced_LAN_Content.asp. 2021-12-28 not yet calculated CVE-2019-20082 MISC MISC attendance_management_system -- attendance_management_system   Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system. 2021-12-26 not yet calculated CVE-2021-44598 MISC authguard -- authguard   basic/BasicAuthProvider.java in AuthGuard before 0.9.0 allows authentication via an inactive identifier. 2021-12-27 not yet calculated CVE-2021-45890 MISC MISC MISC MISC avast -- antivirus Privilege escalation vulnerability in Avast Antivirus prior to 20.4 allows a local user to gain elevated privileges by "hollowing" trusted process which could lead to the bypassing of Avast self-defense. 2021-12-27 not yet calculated CVE-2021-45339 MISC MISC avast -- antivirus   Privilege escalation vulnerability in the Sandbox component of Avast Antivirus prior to 20.4 allows a local sandboxed code to gain elevated privileges by using system IPC interfaces which could lead to exit the sandbox and acquire SYSTEM privileges. 2021-12-27 not yet calculated CVE-2021-45336 MISC MISC avast -- antivirus   Privilege escalation vulnerability in the Self-Defense driver of Avast Antivirus prior to 20.8 allows a local user with SYSTEM privileges to gain elevated privileges by "hollowing" process wsc_proxy.exe which could lead to acquire antimalware (AM-PPL) protection. 2021-12-27 not yet calculated CVE-2021-45337 MISC MISC avast -- antivirus   Multiple privilege escalation vulnerabilities in Avast Antivirus prior to 20.4 allow a local user to gain elevated privileges by calling unnecessarily powerful internal methods of the main antivirus service which could lead to the (1) arbitrary file delete, (2) write and (3) reset security. 2021-12-27 not yet calculated CVE-2021-45338 MISC MISC MISC MISC avast -- antivirus   Sandbox component in Avast Antivirus prior to 20.4 has an insecure permission which could be abused by local user to control the outcome of scans, and therefore evade detection or delete arbitrary system files. 2021-12-27 not yet calculated CVE-2021-45335 MISC MISC biostar -- racing_gt_evo   An issue was discovered in BS_RCIO64.sys in Biostar RACING GT Evo 2.1.1905.1700. A low-integrity process can open the driver's device object and issue IOCTLs to read or write to arbitrary physical memory locations (or call an arbitrary address), leading to execution of arbitrary code. This is associated with 0x226040, 0x226044, and 0x226000. 2022-01-01 not yet calculated CVE-2021-44852 MISC bitmask -- riseup   Bitmask Riseup VPN 0.21.6 contains a local privilege escalation flaw due to improper access controls. When the software is installed with a non-default installation directory off of the system root, the installer fails to properly set ACLs. This allows lower privileged users to replace the VPN executable with a malicious one. When a higher privileged user such as an Administrator launches that executable, it is possible for the lower privileged user to escalate to Administrator privileges. 2021-12-30 not yet calculated CVE-2021-44466 MISC brave -- brave_desktop   In Brave Desktop 1.17 through 1.33 before 1.33.106, when CNAME-based adblocking and a proxying extension with a SOCKS fallback are enabled, additional DNS requests are issued outside of the proxying extension using the system's DNS settings, resulting in information disclosure. NOTE: this issue exists because of an incomplete fix for CVE-2021-21323 and CVE-2021-22916. 2021-12-27 not yet calculated CVE-2021-45884 MISC MISC MISC MISC carinal -- tien_hospital_health_report_system   Carinal Tien Hospital Health Report System’s login page has improper authentication, a remote attacker can acquire another general user’s privilege by modifying the cookie parameter without authentication. The attacker can then perform limited operations on the system or modify data, making the service partially unavailable to the user. 2021-12-29 not yet calculated CVE-2021-44160 MISC celery -- celery   This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. 2021-12-29 not yet calculated CVE-2021-23727 MISC MISC cscms -- cscms   An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks. 2021-12-27 not yet calculated CVE-2020-21238 MISC damicms -- damicms   A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie. 2021-12-27 not yet calculated CVE-2020-21236 MISC dl-axist -- devices   The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings. 2022-01-01 not yet calculated CVE-2021-43333 MISC CONFIRM dmp -- roadmap   DMP Roadmap before 3.0.4 allows XSS. 2022-01-01 not yet calculated CVE-2021-44896 MISC MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). 2022-01-01 not yet calculated CVE-2021-45957 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in check_bad_address (called from check_for_bogus_wildcard and FuzzCheckForBogusWildcard). 2022-01-01 not yet calculated CVE-2021-45951 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). 2022-01-01 not yet calculated CVE-2021-45956 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). 2022-01-01 not yet calculated CVE-2021-45952 MISC MISC dnsmasq -- dnsmasq Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from hash_questions and fuzz_util.c). 2022-01-01 not yet calculated CVE-2021-45953 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from answer_auth and FuzzAuth). 2022-01-01 not yet calculated CVE-2021-45954 MISC MISC dnsmasq -- dnsmasq   Dnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c). 2022-01-01 not yet calculated CVE-2021-45955 MISC MISC elgg -- elgg   elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') 2021-12-24 not yet calculated CVE-2021-4072 MISC CONFIRM emerson -- xweb_300d_evo   Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse and delete files without any authentication due to incorrect access control and directory traversal. 2021-12-30 not yet calculated CVE-2021-45427 MISC MISC MISC emuse -- eservices_and_envoice   Emuse - eServices / eNvoice SQL injection can be used in various ways ranging from bypassing login authentication or dumping the whole database to full RCE on the affected endpoints. The SQLi caused by CWE-209: Generation of Error Message Containig Sensetive Information, showing parts of the aspx code and the webroot location , information an attacker can leverage to further compromise the host. 2021-12-29 not yet calculated CVE-2021-36722 CONFIRM emuse -- eservices_and_envoice   Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service. 2021-12-29 not yet calculated CVE-2021-36723 CONFIRM evga -- precision_xoc   The WinRin0x64.sys and WinRing0.sys low-level drivers in EVGA Precision XOC version v6.2.7 were discovered to be configured with the default security descriptor which allows attackers to access sensitive components and data. 2021-12-28 not yet calculated CVE-2020-22057 MISC expat -- expat   In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory). 2022-01-01 not yet calculated CVE-2021-45960 MISC MISC MISC fatek -- winproladder   FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code. 2021-12-28 not yet calculated CVE-2021-43556 MISC fatek -- winproladder   FATEK WinProladder Versions 3.30_24518 and prior are vulnerable to an out-of-bounds write while processing project files, which may allow an attacker to execute arbitrary code. 2021-12-28 not yet calculated CVE-2021-43554 MISC forescout -- secureconnector_local_service   ForeScout - SecureConnector Local Service DoS - A low privilaged user which doesn't have permissions to shutdown the secure connector service writes a large amount of characters in the installationPath. This will cause the buffer to overflow and override the stack cookie causing the service to crash. 2021-12-29 not yet calculated CVE-2021-36724 CONFIRM gdal -- gdal   GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromFile and PCIDSK::CPCIDSKBinarySegment::CPCIDSKBinarySegment). 2022-01-01 not yet calculated CVE-2021-45943 MISC MISC MISC MISC gerapy -- gerapy   Gerapy is a distributed crawler management framework. Gerapy prior to version 0.9.8 is vulnerable to remote code execution, and this issue is patched in version 0.9.8. 2021-12-27 not yet calculated CVE-2021-43857 CONFIRM MISC MISC ghostscript -- ghostpdl Ghostscript GhostPDL 9.50 through 9.53.3 has a use-after-free in sampled_data_sample (called from sampled_data_continue and interp). 2022-01-01 not yet calculated CVE-2021-45944 MISC MISC ghostscript -- ghostpdl   Ghostscript GhostPDL 9.50 through 9.54.0 has a heap-based buffer overflow in sampled_data_finish (called from sampled_data_continue and interp). 2022-01-01 not yet calculated CVE-2021-45949 MISC MISC MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data outside of the allocated buffer. The attacker has control over a part of the address that data is written to, control over the written data, and (to some extent) control over the amount of data that is written. 2021-12-28 not yet calculated CVE-2021-45910 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacker to write a large amount of arbitrary data outside the boundaries of a buffer. 2021-12-28 not yet calculated CVE-2021-45909 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted. 2021-12-28 not yet calculated CVE-2021-45907 MISC gif2apng -- gif2apng An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted. 2021-12-28 not yet calculated CVE-2021-45908 MISC gif2apng -- gif2apng   An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes outside the boundaries of the buffer. 2021-12-28 not yet calculated CVE-2021-45911 MISC giftrans -- giftrans   The giftrans function in giftrans 1.12.2 contains a stack-based buffer overflow because a value inside the input file determines the amount of data to write. This allows an attacker to overwrite up to 250 bytes outside of the allocated buffer with arbitrary data. 2022-01-01 not yet calculated CVE-2021-45972 MISC MISC MISC glewlwyd -- glewlwyd   Glewlwyd 2.0.0, fixed in 2.6.1 is affected by an incorrect access control vulnerability. One user can attempt to log in as another user without its password. 2021-12-30 not yet calculated CVE-2021-45379 MISC MISC go -- go   net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests. 2022-01-01 not yet calculated CVE-2021-44716 CONFIRM go -- go   Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion. 2022-01-01 not yet calculated CVE-2021-44717 CONFIRM google -- android   An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later 2021-12-29 not yet calculated CVE-2021-38688 CONFIRM grok -- grok   Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func

Read more »

Select 24″ M1 iMacs are on sale for $100 off Apple’s MSRP with free 1-2 day shipping
Sales of Apple’s new 24″ M1 iMacs have been rare since its introduction, perhaps due to global supply issues. However, B&H is offering a $100 discount on select 24″ iMacs, and they’re in stock today with free 1-2 day shipping to most US addresses: – 24″ M1 iMac 8-Core CPU/7-Core GPU/256GB (Pink): $1199 $100 off MSRP – 24″ M1 iMac 8-Core CPU/8-Core GPU/256GB (Green, Silver, […] The post first appeared on MacPrices.net.

Read more »

M1 Mac minis are back in stock today at Apple starting at only $589
Apple has M1-powered Mac minis available in their Certified Refurbished section starting at only $589 and up to $140 off MSRP. Each mini comes with Apple’s one-year warranty, and shipping is free: – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP Step up to a mini with 512GB of storage for $759: – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP […] The post first appeared on MacPrices.net.

Read more »

B&H has M1-powered Mac minis on sale for $50-$100 off MSRP with free 1-2 day shipping
B&H Photo has Apple’s Mac minis with M1 Apple Silicon CPUs in stock today and on sale for $50-$100 off MSRP, starting at $649. Free 1-2 shipping is free to many US addresses. Their prices are among the lowest available for new M1 Mac minis today, and both models are in stock: – Mac mini M1 CPU/256GB SSD: $649 $50 off MSRP – Mac mini […] The post B&H has M1-powered Mac minis on sale for $50-$100 off MSRP with free 1-2 day shipping first appeared on MacPrices.net.

Read more »

B&H has M1-powered Mac minis on sale for $50-$100 off MSRP with free 1-2 day shipping
B&H Photo has Apple’s Mac minis with M1 Apple Silicon CPUs in stock today and on sale for $50-$100 off MSRP, starting at $649. Free 1-2 shipping is free to many US addresses. Their prices are among the lowest available for new M1 Mac minis today, and both models are in stock: – Mac mini M1 CPU/256GB SSD: $649 $50 off MSRP – Mac mini […] The post B&H has M1-powered Mac minis on sale for $50-$100 off MSRP with free 1-2 day shipping first appeared on MacPrices.net.

Read more »

New Amazon sale: Apple’s 13″ M1 MacBook Airs in stock and on sale for $100 off MSRP, starting at $899
Amazon has Apple 13″ M1 MacBook Airs on sale for $100 off MSRP, starting at only $899. Their prices are the lowest available for new MacBook Airs today. Stock may come and go, so check their site frequently. However, at the time of this post, all models were in stock with free shipping: 8-Core M1 Silicon CPU, 7-Core GPU: – 13″ M1 MacBook Air/256GB Space […] The post first appeared on MacPrices.net.

Read more »

Get an Apple Watch Series 7 for $50 off MSRP, prices start at $349
Amazon has Apple Watch Series 7 models on sale for $50 off MSRP including free shipping. Their prices are the lowest available for Apple Watch Series 7 models today: – 41mm Apple Watch Series 7 GPS + Cellular: $449, save $50 – 45mm Apple Watch Series 7 GPS + Cellular: $479, save $50 – 41mm Apple Watch Series 7 GPS: $349, save $50 – 45mm […] The post first appeared on MacPrices.net.

Read more »

Here are the details of Apple’s 2022 Education discounts for students, teachers, and staff
Need a new Apple Mac or iPad for school? Whether you’re a student, teacher, or staff member, you can use your .edu email address when ordering at Apple Education to take up to $400 off the price of a new Mac and up to off the price of a new iPad. All teachers, students, and staff of any educational institution with a .edu email address […] The post first appeared on MacPrices.net.

Read more »

Amazon is blowing out 2020 21″ iMacs for only $599
Amazon has clearance 2020 21″ iMacs (2.3GHz Dual-Core i5, 8GB RAM, 256GB SSD) on sale right now for $599.99 including free shipping. Original MSRP for this model was $1099. Amazon expects delivery in February, so the iMac is not in stock today. However, they are accepting orders at this discounted price. Check their site for the latest stock status. For the latest prices and deals, […] The post first appeared on MacPrices.net.

Read more »

Find the best deal on an Apple MacBook using our exclusive MacBook Price Trackers
In the market for a new 13″ MacBook Air, 13″ MacBook Pro, 14″ MacBook Pro, or 16″ MacBook Pro with M1, M1 Pro, or M1 Max Apple Silicon? Use our Apple award-winning and exclusive price trackers to find the best deal or lowest price on one of Apple’s Silicon MacBooks, as well as the rest of their lineup of Macs, iPads, iPhones, and accessories: – […] The post first appeared on MacPrices.net.

Read more »

Red Pocket Mobile is offering the Apple iPhone 13 for up to $50 off with free 6 months of Unlimited nationwide 5G service
Switch to Red Pocket Mobile and get an Apple iPhone 13 Pro for $50 off MSRP, plus get free 6 months of Unlimited nationwide 5G service with the purchase of any iPhone 13. Red Pocket Mobile is a nationwide service using all the major wireless carrier networks and offers 50GB plans for $50 per month, no contract required, and cheaper plans starting at $20/month for […] The post first appeared on MacPrices.net.

Read more »

24″ M1 iMacs on sale for $1249, $50 off Apple’s MSRP
Amazon has base 24″ M1 iMacs (8-Core CPU/7-Core GPU/8GB RAM/256GB SSD) on sale today for $1249 shipped. Their price is $50 off Apple’s MSRP, and it’s the lowest price available for a new 24″ M1 iMac. Check their site for the stock status of your chosen color, as Amazon’s stock continues to flucuate. For the latest prices and sales, see our iMac Price Tracker, updated […] The post first appeared on MacPrices.net.

Read more »

Open-Box 16″ M1 Pro MacBook Pros available for $200-$300 off MSRP, prices start at $2249
QuickShip Electronics has open-box return 16″ M1 Pro MacBook Pros in stock and on sale for $200-$300 off MSRP on their eBay store right now with free express delivery. According to QuickShip, “The item in this listing is an Open Box (packaging maybe slightly distressed) The unit powers on with factory settings restored and includes the original accessories.” The following standard-configuration models are available: – […] The post first appeared on MacPrices.net.

Read more »