Apple releases first developer beta of macOS 11.4 ahead of 11.3 public release
We just got the macOS 11.3 release candidate yesterday after Apple’s Spring Loaded event. And ahead of the 11.3 public launch that could coincide with iOS 14.5 next week, Apple has seeded developers with the first beta for macOS 11.4. more… The post appeared first on 9to5Mac.

Read more »

Sen. Amy Klobuchar calls AirTag release 'timely' ahead of Senate antitrust hearing
Sen. Amy Klobuchar, the chair of the U.S. Senate's antitrust subcommittee, called the release of AirTags "timely" ahead of a hearing examining the market power of Apple and Google.Credit: AppleThe U.S. Senate Judiciary Committee's Subcommittee on Competition Policy, Antitrust, and Consumer Rights is planning to hold a hearing examining Apple's App Store and the Google Play Store on Wednesday. Sen. Klobuchar is spearheading the hearing as the chair of the subcommittee. Read more...

Read more »

Apple Podcast Subscriptions – TMO Daily Observations 2021-04-21
Charlotte Henry and Dave Hamilton join host Kelly Guimont to discuss Apple’s latest updates to the Podcasts app, including the subscription option.

Read more »

Cases and keyboards for 2021 iPad Pro are ready for launch
For all its many improvements, the basic design of the 2021 iPad Pro changed hardly at all. That’s good news for anyone in the market for a case or keyboard for Apple’s new tablet, as it means there’s a wide variety available. There are already options from Logitech, Brydge, Otterbox and Apple itself that are […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

One Man Shows How The App Store Has a Scam Problem
As Apple faces scrutiny in the Senate, a man named Kosta Eleftheriou is challenging Apple in another way: By finding scam apps (via The Verge). App Store Scams Over the past few months Mr. Eleftheriou has found dozens of multimillion-dollar scam apps in the App Store. These apps use fake 5-star reviews to trick people into thinking they’re popular, then luring them in with a free trial. Then, they use expensive recurring subscriptions to get money out of thousands. The author of the report walks readers through the process of finding these scams on our own, and it isn’t difficult. Mr. Eleftheriou publicly shared one app two months ago but it remains in the App Store. He also says fake reviews isn’t a hard problem for Apple to solve: When you consider refund request rates, app usage, and other associated info that only Apple has, you could imagine a totally revamped discovery system that does away with the current crude star-rating system that hasn’t seen any innovation since Bezos pioneered it 20 years ago. Apple has a dedicated Discovery Fraud Team as well as a host of other tools, but scams continue to slip through, even from repeat offenders. One of Apple’s arguments against accusations of monopoly and antitrust is that it keeps the App Store safe. Heck, it even created a whole web page dedicated to that. But people like Mr. Eleftheriou are proving that Apple needs to do better.

Read more »

Apple now allows AppleCare+ for Mac to continue beyond three years
In certain major territories, including the U.S., Apple will now let users keep AppleCare+ for Mac active beyond its original three-year limit.AppleCare+ for Mac can now be extendedThere are arguments for and against paying for AppleCare+ when you have a Mac, but now Apple has added a new option. Where previously the maximum length of coverage you could have was three years from the date of purchase, it is now unlimited. Read more...

Read more »

Stacktrace Podcast 132: “The ‘M’ stands for ‘Marketing’”
John and Rambo discuss all of the major announcements from Apple’s “Spring Loaded” event, including the new iMac, AirTags, the M1-powered iPad Pro, and the updated Apple TV. Also, the key factors that can help make a code base easier to navigate, and the benefits of going all-in on HomeKit. Download MP3 more… The post appeared first on 9to5Mac.

Read more »

Ahead of Apple antitrust hearing, Sen. Klobuchar calls AirTag launch ‘timely’
The US Senate Judiciary Subcommittee on antitrust is holding a hearing today over competition concerns about Apple and Google. Just ahead of the hearing, Senator Klobuchar who chairs the subcommittee has said that Apple’s launch of its new AirTag item tracker is “timely” and that she believes both companies’ app stores need more scrutiny. more… The post appeared first on 9to5Mac.

Read more »

Elago Sport band for Apple Watch is too good to be just $19 [Review]
Elago’s brilliant Sport band has quickly become my favorite activity band for Apple Watch. It’s well-designed and built like a tank from super-sturdy materials. And it’s unbelievably good value for money at just $18.99. Want to know more? Here’s our full review. Silicone is typically the material accessory-makers choose when crafting activity bands for Apple […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV+ to release 'CODA,' its prize Sundance acquisition, August 13
"Coda," which Apple grabbed at the Sundance Film Festival for a reported $25 million, will head to Apple TV+ in August, with a theatrical release the same day.CODA, the Apple TV+ acquisiton that is coming in August. Back in January, Apple made a big splash at the (virtual) 2021 Sundance Film Festival, grabbing the rights to the award-winning dramatic film "CODA." The Hollywood press reported the film's acquisition price at $25 million — although Apple has never confirmed that figure — which would be a record for Sundance acquisitions. Read more...

Read more »

Brydge unveils new MAX+ keyboard/trackpad combo for 12.9-inch iPad Pro
The popular iPad accessory maker Brydge is out with its latest iPad Pro accessory today. The new Brydge 12.9 MAX+ features an all-new design exclusively for the 12.9-inch iPad Pro. This includes a new magnetic case and a larger trackpad. more… The post appeared first on 9to5Mac.

Read more »

Apple Releases New Behind the Mac Videos Celebrating College Acceptances and Finneas
Apple has released two new video in its 'Behind the Mac' series. They feature new students celebrating getting into college and Finneas, Billie Eilish's brother and producer. Headed for College The first 'Behind the Mac' video celebrates college acceptance season. Apple wanted to highlight "all those students starting their next chapter behind the Mac" with the clip. https://www.youtube.com/watch?v=KYTtjAG48dg Behind the Mac with Finneas In a separate clip, Finneas gives a sneak peak at how he creates music behind a Mac, which he refers to as “the last instrument I learned.” You can also see him in action in Apple TV+ documentary Billie Eilish: The World's a Little Blurry. https://www.youtube.com/watch?v=RUEtUaDcH2U

Read more »

Apple tries to limit ‘inappropriate’ AirTag engravings
After years with an engraving service for iPods and other products, Apple has measures in place to limit "inappropriate" AirTag engravings … The post appeared first on MacDailyNews.

Read more »

MacBook Pro models with mini LED reportedly arriving in 2021
Following Apple's addition of a mini LED display to the new 12.9-inch iPad Pro, a market report suggests Apple will add mini LED tech to upcoming 14-inch and 16-inch MacBooks.After the 12.9-inch iPad Pro, mini LED displays could arrive on the MacBook Pro later in 2021According to market intelligence firm TrendForce, the 14-inch MacBook Pro and 16-inch MacBook Pro models will arrive in the second half of 2021 with mini LED displays. Read more...

Read more »

Brydge unveils redesigned keyboard with trackpad for 12.9-inch iPad Pro
Brydge is taking the wraps off its latest iPad keyboard just in time for Apple's new iPad Pros. The Brydge 12.9 Max+ features a redesigned hinge, rear protection, and a truly massive multi-touch trackpad.Brydge 12.9 Max+The all-new 12.9 Max+ has done away with the signature Brydge hinges and replaced them with an integrated magnetic back panel. It takes advantage of the magnets built into the rear of iPad Pro to connect, without the need for the old clamps. It also protects your iPad at the same time. Read more...

Read more »

New World: Today at Apple imagines post-pandemic life through creativity
“The sessions have been like tiny art galleries.” Han, a Creative Pro at Apple Carnegie Library, summed it up best in a discussion with illustrator Ohni Lisle on April 14. The event was the 19th of 21 virtual sessions held over the past 12 weeks thanks to a partnership between Today at Apple and It’s Nice That. Through those tiny galleries, more than 20 leading artists and a global audience of creatives shared profound ideas for a post-pandemic world. more… The post appeared first on 9to5Mac.

Read more »

Apple Music editorial content gets its own Apple News channel
In an effort to amplify interviews, playlists, and other news surrounding Apple Music, Apple has created a dedicated channel in the Apple News app.Apple Music has been home to many interviews and music-related announcements, but users would need to discover this on their own. Interviews would be contained in video or audio formats, and text for the content rarely, if ever, existed. Now, Apple will offer Apple Music-specific news within a dedicated channel on its Apple News app.Apple News users can search for "Apple Music" in the search tab and follow the new channel. It will host content surrounding artist interviews, weekly playlist selections, and more from the Apple Music Radio stations. Read more...

Read more »

Sundance Award winner ‘Coda’ hitting Apple TV+ this summer
CODA is the first film in Sundance Festival history to win all top prizes in the US Dramatic Competition category. Today, Apple announces the movie is going to premiere for Apple TV+ users and in theaters at the same time. more… The post appeared first on 9to5Mac.

Read more »

Work/podcasting/gaming setup sees major upgrades [Setups]
After working remotely as a digital marketer for a startup for more than a year, EU-based Redditor WMR2 decided it was time to upgrade the ol’ MacBook Pro-based work/podcasting/gaming setup. Enter new desk, chair and external display. What, you were expecting a new computer? That’s not always necessary. This post contains affiliate links. Cult of […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Deals: M1 MacBook Air at $111 off, Nomad 25% off accessory sale, more
All of today’s best deals are headlined by Apple’s latest 13-inch M1 MacBook Air at $111 off, Nomad’s 25% off spring sale, and this Lutron Caseta HomeKit starter set at $80. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more… The post appeared first on 9to5Mac.

Read more »

Apple confirms Center Stage will work with rival video conference apps
The new Center Stage feature of iPad Pro video calls will not be confined to FaceTime, says Apple. The automatic panning and reframing technology is expected to be made available to developers.Apple demonstrated automatic panning and reframing with Center Stage in FaceTimeDuring its "Spring Loaded" launch of the new iPad Pro, Apple demonstrated a new camera feature in FaceTime. "Center Stage" automatically moves video calls to focus on the user, wherever they are in shot. Read more...

Read more »

Rewatch Apple’s ‘Spring Loaded’ Event
There was an awful lot packed into Apple's 'Spring Loaded' event on Tuesday. If you missed any of the announcements, you can rewatch the whole event on YouTube or via Apple's website.

Read more »

Democrat Senator Amy Klobuchar says Apple’s AirTags news is ‘timely’ regarding antitrust
U.S. Senator Amy Klobuchar, the top Senate Democrat on antitrust issues, said Apple's AirTag tracker device unveiling was "timely" as it was… The post appeared first on MacDailyNews.

Read more »

What to do if you find an AirTag or get an alert that an AirTag is with you
If you find an AirTag or a lost item with an AirTag attached: Tap and hold the top of your iPhone or NFC-capable smartphone to the white side of the AirTag. Tap the notification that appears. This opens a website that provides information about the AirTag, including its serial number. If the owner marked it as lost, you might see a message with information about how to contact the owner.* You can contact the owner to let them know that you found their AirTag. If you see an "AirTag Found Moving With You" message: Tap the message. Tap Continue. If you need help finding the AirTag, tap Play Sound. If the AirTag is attached to an item you're borrowing, you can tap Pause Safety Alerts to turn off "AirTag Detected" notifications for one day. If you're borrowing an AirTag from a member of your Family Sharing group, you can turn off Safety Alerts for one day or indefinitely. You can tap Learn About This AirTag to see its serial number if the owner marked it as lost. To disable the AirTag and stop sharing your location, tap Instructions to Disable AirTag and follow the onscreen steps. If you feel your safety is at risk, contact your local law enforcement who can work with Apple. You might need to provide the AirTag or its serial number. If AirTags is in your future, take the time to read the support document. Lots of important info there.∞ Read this on The Loop

Read more »

This week's top 5 Apple deals on Amazon
The Apple Event may be over, but the excitement is still building as Apple deals at Amazon heat up, including hidden discounts on the Apple Pencil 2 that works with the new M1 iPad Pro.1. Apple Pencil 2 on sale for $114.99A hidden $9.99 in-cart discount stacked with a $5 instant rebate on the Apple Pencil 2 at Amazon delivers the lowest price on the handy accessory the day after the Apple Event. Best of all, the new M1 iPad Pros support the second-generation Apple Pencil, making this deal one that is likely to sell out soon. Read more...

Read more »

Apple ransomware leak corroborates 2021 MacBook Pro features: HDMI, MagSafe, SD card slot
A hacker group called REvil is currently in the process of blackmailing Apple supplier Quanta for about $50 million. The group claims to have thousands of leaked files that include information about upcoming Apple products. 9to5Mac has had a look at some of the files already released. The documents include technical specifications for Apple’s upcoming Apple Silicon MacBook Pro, with the codenames J314 and J316. These specs corroborates previous reports that the new MacBook Pro will feature MagSafe, HDMI and an SD card slot. more… The post appeared first on 9to5Mac.

Read more »

∞ Apple shares a host of new videos from yesterday’s Apple Event
In no particular order, here are the videos from yesterday’s Apple event. And if you haven’t had the chance to watch the event, here’s a link. Enjoy…

Read more »

10 gigabit ethernet option now available for the M1 Mac mini
The Mac mini is Apple’s smallest desktop Mac. It may not be as fast as Apple’s other desktop computers—the iMac and the Mac Pro—but it remains fast enough for general-purpose use, and even for pro apps. The Mac mini not only appeals to first-time Mac users, but longtime Mac users like the price and use […]

Read more »

Nagios XI 5.7.3 Remote Code Execution
This Metasploit module exploits an OS command injection vulnerability in includes/components/nxti/index.php that enables an authenticated user with admin privileges to achieve remote code execution as the apache user. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios XI 5.7.3 running on CentOS 7.

Read more »

Apple Announces New iMacs, iPads, AirTags, and More
Here's everything that Apple announced at its spring event: new iMac, iPad Pro, AirTags, Apple TV, and even a purple iPhone. The post appeared first on The Mac Security Blog.

Read more »

Note to Self: Create Non-Exhaustive List of Competitors
What was the best news you heard so far this month? Mine was learning that KrebsOnSecurity is listed as a restricted competitor by Gartner Inc. [NYSE:IT] -- a $4 billion technology goliath whose analyst reports can move markets and shape the IT industry.

Read more »

Vulnerability Summary for the Week of April 12, 2021
Original release date: April 19, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges to NT SYSTEM. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 7.2 CVE-2020-13532 MISC fluidsynth -- fluidsynth FluidSynth 2.1.7 contains a use after free vulnerability in sfloader/fluid_sffile.c that can result in arbitrary code execution or a denial of service (DoS) if a malicious soundfont2 file is loaded into a fluidsynth library. 2021-04-13 7.5 CVE-2021-28421 MISC MISC google -- android In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a malicious NFC packet with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-178725766 2021-04-13 10 CVE-2021-0430 MISC indionetworks -- unibox_u50_firmware Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device. 2021-04-09 9.3 CVE-2020-21884 MISC MISC MISC indionetworks -- unibox_u50_firmware Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover. 2021-04-09 9 CVE-2020-21883 MISC MISC MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28481, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28480 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28482, CVE-2021-28483. 2021-04-13 10 CVE-2021-28481 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28483. 2021-04-13 9 CVE-2021-28482 MISC microsoft -- exchange_server Microsoft Exchange Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28480, CVE-2021-28481, CVE-2021-28482. 2021-04-13 7.7 CVE-2021-28483 MISC microsoft -- windows_10 Azure AD Web Sign-in Security Feature Bypass Vulnerability 2021-04-13 7.5 CVE-2021-27092 MISC microsoft -- windows_10 Windows Hyper-V Denial of Service Vulnerability 2021-04-13 7.8 CVE-2021-26416 MISC online_book_store_project -- online_book_store SQL injection in admin.php in Online Book Store 1.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication. 2021-04-09 7.5 CVE-2020-23763 MISC MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the compnomenclature parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27236 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the description parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27235 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the serviceUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27234 MISC openclinic_ga_project -- openclinic_ga An exploitable SQL injection vulnerability exists in ‘getAssets.jsp’ page of OpenClinic GA 5.173.3 in the supplierUID parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability. 2021-04-13 7.5 CVE-2020-27233 MISC rust-lang -- rust In the standard library in Rust before 1.53.0, a double free can occur in the Vec::from_iter function if freeing the element panics. 2021-04-14 7.5 CVE-2021-31162 MISC MISC sonicwall -- email_security A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host. 2021-04-09 7.5 CVE-2021-20021 CONFIRM sonicwall -- global_management_system A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root. 2021-04-10 10 CVE-2021-20020 CONFIRM trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a sensitive file could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25250 N/A N/A N/A trendmicro -- apex_one An improper access control vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service and OfficeScan XG SP1 on a resource used by the service could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-25253 N/A N/A N/A trendmicro -- apex_one An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. 2021-04-13 7.2 CVE-2021-28645 N/A N/A N/A windriver -- vxworks An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client. 2021-04-13 7.5 CVE-2021-29998 MISC windriver -- vxworks An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server. 2021-04-13 7.5 CVE-2021-29999 MISC zerof -- expert The ZEROF Expert pro/2.0 application for mobile devices allows SQL Injection via the Authorization header to the /v2/devices/add endpoint. 2021-04-13 7.5 CVE-2021-30176 MISC MISC zerof -- web_server ZEROF Web Server 1.0 (April 2021) allows SQL Injection via the /HandleEvent endpoint for the login page. 2021-04-13 7.5 CVE-2021-30175 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info accessally -- accessally In the AccessAlly WordPress plugin before 3.5.7, the file "resource/frontend/product/product-shortcode.php" responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required. 2021-04-12 5 CVE-2021-24226 CONFIRM atlassian -- data_center The dashboard gadgets preference resource of the Atlassian gadgets plugin used in Jira Server and Jira Data Center before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to obtain gadget related settings via a missing permissions check. 2021-04-09 5 CVE-2020-36287 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. COM Class Identifiers (CLSID), installed by Dream Report 5 20-2, reference LocalServer32 and InprocServer32 with weak privileges which can lead to privilege escalation when used. An attacker can provide a malicious file to trigger this vulnerability. 2021-04-09 6.8 CVE-2020-13534 MISC dreamreport -- dream_report A privilege escalation vulnerability exists in Dream Report 5 R20-2. IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs in and uses the application. 2021-04-09 4.4 CVE-2020-13533 MISC fortinet -- fortiadc A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may allow a remote authenticated attacker to read other local users' password in log files. 2021-04-12 4 CVE-2021-24024 CONFIRM google -- android In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth device due to a tapjacking/overlay attack. This could lead to local escalation of privilege and pairing malicious devices with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171221090 2021-04-13 5.4 CVE-2021-0433 MISC google -- android In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacking attack due to an incorrect FLAG_OBSCURED value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10Android ID: A-152064592 2021-04-13 4.4 CVE-2021-0438 MISC google -- android In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790 2021-04-13 4.4 CVE-2021-0432 MISC google -- android In updateInfo of android_hardware_input_InputApplicationHandle.cpp, there is a possible control of code flow due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174768985 2021-04-13 4.6 CVE-2021-0442 MISC google -- android In setPowerModeWithHandle of com_android_server_power_PowerManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174243830 2021-04-13 4.6 CVE-2021-0439 MISC google -- android In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-176168330 2021-04-13 4.6 CVE-2021-0437 MISC google -- android In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-175074139 2021-04-13 4.6 CVE-2021-0429 MISC google -- android In parsePrimaryFieldFirstUidAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174485572 2021-04-13 4.6 CVE-2021-0426 MISC google -- android In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174150451 2021-04-13 5 CVE-2021-0435 MISC google -- android In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174149901 2021-04-13 5 CVE-2021-0431 MISC google -- android In parseExclusiveStateAnnotation of LogEvent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174488848 2021-04-13 4.6 CVE-2021-0427 MISC google -- chrome Use after free in V8 in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21195 MISC MISC google -- chrome Use after free in screen sharing in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21194 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome on Windows prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21196 MISC MISC google -- chrome Heap buffer overflow in TabStrip in Google Chrome prior to 89.0.4389.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21197 MISC MISC google -- chrome Use after free in Aura in Google Chrome on Linux prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. 2021-04-09 6.8 CVE-2021-21199 MISC MISC google -- chrome Out of bounds read in IPC in Google Chrome prior to 89.0.4389.114 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2021-04-09 4.3 CVE-2021-21198 MISC MISC ibm -- collaborative_lifecycle_management IBM Jazz Team Server products use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192422. 2021-04-12 5 CVE-2020-4965 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 198441. 2021-04-12 4.3 CVE-2021-20519 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products contain an undisclosed vulnerability that could allow an authenticated user to present a customized message on the application which could be used to phish other users. IBM X-Force ID: 192419. 2021-04-12 4 CVE-2020-4964 XF CONFIRM ibm -- collaborative_lifecycle_management IBM Jazz Team Server products are vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191396. 2021-04-12 4.3 CVE-2020-4920 XF CONFIRM intelliants -- subrion Cross Site Scripting (XSS) vulnerability in subrion CMS Version

Read more »

Did Someone at the Commerce Dept. Find a SolarWinds Backdoor in Aug. 2020?
On Aug. 13, 2020, someone uploaded a suspected malicious file to VirusTotal, a service that scans submitted files against more than five dozen antivirus and security products. Last month, Microsoft and FireEye identified that file as a newly-discovered fourth malware backdoor used in the sprawling SolarWinds supply chain hack. An analysis of the malicious file and other submissions by the same VirusTotal user suggest the account that initially flagged the backdoor as suspicious belongs to IT personnel at the National Telecommunications and Information Administration (NTIA), a division of the U.S. Commerce Department that handles telecommunications and Internet policy.

Read more »

How to Encrypt and Password Protect Files on Your Mac
Encrypting folders and files on your Mac is a good idea. This ultimate guide covers how to encrypt files using Apple’s built-in password protection features. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI Remote Code Execution
This Metasploit module exploits a command injection vulnerability in the /admin/monitoringplugins.php page of Nagios XI versions prior to 5.8.0 when uploading plugins. Successful exploitation allows an authenticated admin user to achieve remote code execution as the apache user by uploading a malicious plugin. Valid credentials for a Nagios XI admin user are required. This module has been successfully tested against Nagios versions XI 5.3.0 and 5.7.5, both running on CentOS 7.

Read more »

500 Million More Reasons to Talk About Facebook – Intego Mac Podcast Episode 183
Scammers have a new technique for delivering malware: using online contact forms. A couple of browsers are nixing Google's FLoC ad tracking technology. The FBI has been playing white hat hacker. And e talk about Facebook, and especially the "off-Facebook activity" that tracks you across the internet. The post appeared first on The Mac Security Blog.

Read more »

Nagios XI getprofile.sh Remote Command Execution
This Metasploit module exploits a vulnerability in the getprofile.sh script of Nagios XI versions prior to 5.6.6 in order to upload a malicious check_ping plugin and thereby execute arbitrary commands. For Nagios XI 5.2.0 through 5.4.13, the commands are run as the nagios user. For versions 5.5.0 through 5.6.5, the commands are run as root. Note that versions prior to 5.2.0 will still be marked as being vulnerable however this module does not presently support exploiting these targets. The module uploads a malicious check_ping plugin to the Nagios XI server via /admin/monitoringplugins.php and then executes this plugin by issuing a HTTP GET request to download a system profile from the server. For all supported targets except Linux (cmd), the module uses a command stager to write the exploit to the target via the malicious plugin. This may not work if Nagios XI is running in a restricted Unix environment, so in that case the target must be set to Linux (cmd). The module then writes the payload to the malicious plugin while avoiding commands that may not be supported. Valid credentials for a user with administrative privileges are required. This module was successfully tested on Nagios XI 5.3.0 and Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before 5.5.0, it may take a significant amount of time for the payload to get back (up to 5 minutes). If exploitation fails against an older system, it is recommended to increase the WfsDelay setting (default is 300 seconds).

Read more »

Microsoft Patch Tuesday, April 2021 Edition
Microsoft today released updates to plug at least 110 security holes in its Windows operating systems and other products. The patches include four security fixes for Microsoft Exchange Server -- the same systems that have been besieged by attacks on four separate (and zero-day) bugs in the email software over the past month. Redmond also patched a Windows flaw that is actively being exploited in the wild.

Read more »

ParkMobile Breach Exposes License Plate Data, Mobile Numbers of 21M Users
Someone is selling account information for 21 million customers of ParkMobile, a mobile parking app that's popular in North America. The stolen data includes customer email addresses, phone numbers, license plate numbers, hashed passwords and mailing addresses.

Read more »

Expercom to offer preorder discounts on new M1 iPad Pros ranging up to $147 off Apple’s MSRP
Apple reseller Expercom will be offering preorder discounts on the new M1 iPad Pros ranging up to $147 off Apple’s MSRP. Their prices are the lowest we’ve seen so far on these new iPads. Ordering will be available starting April 30th, but we can show you the sale prices now. Shipping will be free: – 11″ M1 128GB WiFi iPad Pro: $750 $49 off – 11″ M1 256GB WiFi iPad Pro: $844 $55 off – 11″ M1 512GB WiFi iPad Pro: $1032 $67 off – 11″ M1 1TB WiFi iPad Pro: $1407 $92 off – 11″ M1 2TB WiFi iPad Pro: $1783 $116 off – 11″ M1 128GB WiFi + Cellular iPad Pro: $938 $61 off – 11″ M1 256GB WiFi + Cellular iPad Pro: $1032 $67 off – 11″ M1 512GB WiFi + Cellular iPad Pro: $1220 $79 off – 11″ M1 1TB WiFi + Cellular iPad Pro: $1595 $104 off – 11″ M1 2TB WiFi + Cellular iPad Pro: $1971 $128 off – 12″ M1 128GB WiFi iPad Pro: $1032 $67 off – 12″ M1 256GB WiFi iPad Pro: $1125 $74 off – 12″ M1 512GB WiFi iPad Pro: $1315 $84 off – 12″ M1 1TB WiFi iPad Pro: $1688 $111 off – 12″ M1 2TB WiFi iPad Pro: $2065 $134 off – 12″ M1 128GB WiFi + Cell iPad Pro: $1219 $80 off – 12″ M1 256GB WiFi + Cell iPad Pro: $1315 $84 off – 12″ M1 512GB WiFi + Cell iPad Pro: $1500 $99 off – 12″ M1 1TB WiFi + Cell iPad Pro: $1877 $122 off – 12″ M1 2TB WiFi + Cell iPad Pro: $2252 $147 off Keep an eye on our 11″ iPad Pro Price Tracker and our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

New sale: 13″ 2.0GHz Intel-based MacBook Pros for $200-$300 off Apple’s MSRP, starting at $1549
Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs on sale for $200-$300 off Apple’s MSRP today. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1549.99 $250 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1599.99 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1699.99 $300 off MSRP For the latest prices and sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Apple is blowing out clearance 2020 13″ Intel-based MacBook Pros in their Certified Refurbished store, now only $899
In addition to refurbished 13″ M1 MacBook Pros starting at $1099, Apple has dropped prices on Certified Refurbished 2020 13″ 1.4GHz 4-Core Intel-based MacBook Pros with models now available starting at $899 and up to $460 off original MSRP. These are the cheapest MacBook Pros for sale today at Apple. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/256GB Space Gray 4-Core MacBook Pro (MXK32LL/A): $899 $400 off MSRP – 13″ 1.4GHz/512GB Space Gray 4-Core MacBook Pro (MUHP2LL/A): $1039 $460 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core MacBook Pro (MXK52LL/A): $899 $400 off MSRP – 13″ 1.4GHz/512GB Silver 4-Core MacBook Pro (MXK72LL/A): $1039 $460 off MSRP Note that stock status may vary–check Apple’s site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

New at Apple: Buy any iPad with WiFi + Cellular and get up to $200 back with carrier activation
Apple has a new, and rate, offer for cellular iPad users. Buy any new iPad with WiFi + Cellular at Apple, and get up to $200 back with carrier activation via AT&T, T-Mobile/Sprint, or Verizon. Offer valid for a limited time. Here are the details for each carrier: AT&T: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get $150 in bill credits ($5/mo. over 30 months) after you activate your new iPad on an eligible AT&T wireless plan (min. $10/mo. and excludes Prepaid). T-Mobile/Sprint: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get a $200 virtual gift card after you activate your new iPad on an eligible T-Mobile or Sprint data plan. Verizon: For a limited time, buy an iPad with Wi-Fi + Cellular directly from Apple and get a $200 Verizon e-gift card after you activate your new iPad on an eligible Verizon data plan. Apple’s offer is live on their site right now. See their site for → Read More...

Read more »

Apple drops prices on clearance, Certified Refurbished, 13″ Intel-based MacBook Airs, now blowing out models for only $719
Apple has dropped prices on clearance, Certified Refurbished, 2020 13″ Intel-based MacBook Airs with models now available starting at only $719 and up to $370 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Silver: $719 $280 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Gold: $719 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Space Gray: $929 $370 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Silver: $929 $370 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Gold: $929 $370 off MSRP The dual-core model is the cheapest MacBook for sale today at Apple. Check their site for the latest stock status, and note that Apple may sell out at any time. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Apple introduces new iPad Pro with M1 Apple CPU
Apple today introduced a new iPad Pro with Apple’s M1 Apple CPU. Main features include: – M1 CPU – 8-Core CPU – 50% faster performance, 75X faster than original iPad Pro – 8-Core GPU with 40% faster performance, 1500% faster than original iPad Pro – All day battery life – New 2TB storage option – USB C port with Thunderbolt, 4X more bandwidth – Support for 6K external displays and many accessories – 5G cellular connectivity – Improved cameras – New ultrawide 12MP camera with Center Stage – 600 nit brightness display in 11″ model – 12.9″ model features Liquid Retina XDR mini-LED display with 1000 nits brightness Available April 30th and shipping the second week of may, the new 2021 M1 iPad Pros will start at $799 for the 11″ model and $1099 for the 12.9″ iPad Pro. We’ll be updating our iPad Pro Price Trackers with the latest prices & sales from Apple and its resellers as information → Read More...

Read more »

Apple introduces new 24″ M1 iMac in multiple colors
Apple today introduced the new 2021 24″ M1 iMac. The new iMac features a single sheet of glass with a small chin, seven different colors, aluminum stand, thin bezels, and Apple’s M1 processor. The new 24″ display occupies the same area as the previous 21″ display. Main features include: – 11.5mm thickness with a flat profile – 24″ 4.5K retina display – 500 nits brightness – True tone. – 1080p Facetime HD camera – Studio grade microphone & 6 improved speakers – Apple claims the best sound system ever in any Mac – 85% faster performance than the previous 21″ iMac – Up to 2X faster GPU performance, up to 50% faster graphics – 3X faster machine learning performance – Up to 4 USB C ports, support for 6K displays – Magnetic power cord connection – Power supply with incorporated ethernet – New Magic Keyboards with available emoji icons and Touch ID The new 24″ M1 iMac will be available April 30th with deliveries in the second half of May 2021. iMac starts at $1299 in 4 colors and an 8-Core CPU/7-Core GPU. A $1499 model with be available with an 8-Core CPU/8-Core GPU in 7 colors. We’ll be updating our iMac Price Tracker with prices & information on the new models as information comes in from Apple and → Read More...

Read more »

Apple updates 4K Apple TV
Apple today updated the 4K Apple TV with a new siri remote, better color balance, and better high fidelity. Sold for $179 32GB or $199 for 64GB, the updated models will be available in the second half of → Read More...

Read more »

Apple introduces AirTags to work with their FindMy network to find your stuff
Apple today introduced AirTags, a $29 accessory available starting 4/30/21 to work with Apple’s FindMy network to find your stuff. A 4-pack with sell for $99. AirTags work especially well with iPhones using Apple’s U1 chip, allowing on screen directions to an AirTag. AirTags will also support → Read More...

Read more »

Is Apple Looking To Its Past For Inspiration With The Designs Of Its New Macs?
FEATURE: 04.20.21 – Apple seems to be getting a bit nostalgic over the Mac when it comes to updating its design… back to the late 1990s and early 2000s to be exact. The first Apple Event of 2021 — teased as a, “Spring Loaded” special event — is predicted to see the unveiling of a brand new iMac with Apple silicon inside. While the exact details of its expected design overhaul are not yet known (could it hearken back to the spring-loaded floating display of the iMac G4 from 2002?), one thing’s for sure. Will a new Apple silicon-based iMac sporting a wide array of metallic color finishes, reminiscent of the “fruit-flavored” iMacs of the late 1990s as seen photographed above, be announced at the first Apple Event of 2021? (Photo: Apple, Inc.) No matter what new hardware and/or devices are announced by Apple at the “Spring Loaded” special event, there’s evidence that the Cupertino, California-based company may be going backwards in time and looking to its past (as opposed to springing forward, as it were) with the future product designs of its upcoming Macs. **AD: No matter what new products may be announced by Apple at its “Spring Loaded” special event? Before you pull out your Apple Card (or whatever form of payment you have on hand) and spring for one, or all, of the company’s newest hardware and devices, point your browser to MacPrices.net and consult our exclusive and award winning price trackers for the lowest prices, best deals, and latest discounts offered at Apple’s online and retail stores (as well as Apple Authorized Resellers, too). Pricing updated daily, seven days a week! iMacs With Color? ‘Yum.’ Back in February of this year, iMore — a website whose “authoritative team” helps people to get the most out of life from their Apple products — reported that Apple is expected to replace the iMac with an updated model later this year. Citing a report from Jon Prosser → Read More...

Read more »

No trade-in? AT&T still offers Apple iPhones to new and existing customers starting at only $5 per month
AT&T is offering Apple’s previous-generation 64GB iPhone 11 for $10 per month, for new or existing customers, no trade-in required. Discount is applied via monthly bill credits over a 30 month period. The fine print: “Get the iPhone 11 64GB for $10/mo., 128GB for $15/mo., or 256GB for $20/mo. for 30 mos. when you buy it on a qualifying installment agreement with eligible wireless. No trade-in required.” The same no trade-in deal is offered with a couple of other iPhone models as well: – iPhone SE: 64GB for $5/mo., 128GB for $10/mo., and 256GB for $15/month. – iPhone XS: 64GB for $5/mo., 256GB for $10 per month. AT&T’s offers are live on their site now. For the latest prices & deals, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

This wireless carrier has the Apple iPhone SE on sale for only $249, $150 off MSRP
Boost Mobile is offering Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249. 128GB models are offered at a $50 discount: $399. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is one of the cheapest no-contract 2020 iPhones we’ve seen available anywhere. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »