Add dual 4K HDMI screens to your MacBook with this slim USB-...
The Aukey 9-in-2 USB-C Hub (CB-C81) lets you add a pair of 4K HDMI screens to your MacBook. But that’s just the start because it packs in nine ports, despite a relatively small size. It offers a pair of USB-A ports, SD/microSD card readers, Ethernet and more. After real-world testing, here’s how this multiport adapter […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Best AirPods Black Friday deals: new low prices from $109
Black Friday AirPods deals are in effect right now, with AirPods Pro dropping to an all-time low price of $169. Save up to $80 instantly, with deals starting at just $109.Apple's wireless earbuds became an overnight success following their initial launch in 2016. Apple now offers three variants, including the premium AirPods Pro, for customers to snag during Black Friday sales, with easy price comparison at your fingertips or broken down by store below.Quick access to the lowest AirPods prices Read more...

Read more »

New Powerbeats get biggest discount yet — now just $99
Amazon is today offering the biggest discount we’ve seen so far on Apple’s newest Powerbeats buds for Black Friday. You can bag yours for just $99 — more than $50 off the usual price — for a limited time only. Bag yours before they sell out! This post contains affiliate links. Cult of Mac may earn […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Get a pair of great Mac apps for the holidays
It’s clear that the holidays are going to be a little bit different this year. So why not do gifts a little differently, too? We’ve rounded up a pair of great Mac apps that offer quick reads and optimized WiFi, like digital stocking stuffers for your friends, family, or just for yourself. 12min Micro Book […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How U.S. states are using digital contact tracing to stop CO...
Exposure notification, a type of digital contact tracing, is an avenue to combat COVID-19 in the U.S., but each state and territory has to carry out their own tracing. Here's who's doing what, updated on Nov. 26.Digital contact tracing could help track and curb the spread of COVID-19 in the U.S. But each state will have their own solution.As governments across the globe relax social distancing and stay-at-home orders, many of them are considering digital contract tracing — and specifically, exposure notification — as a way to help continue controlling the spread of COVID-19. Read more...

Read more »

The 9to5Mac Black Friday BundleHunt sale features nearly 50 ...
The annual BundleHunt app sale in conjunction with 9to5Mac has now launched with deals from just $1. There are nearly 50 titles to choose from, all of which will become a permanent part of your library if you choose to purchase them. Additional discounts are available as you add more apps, making it a great time to load up your machine with fresh titles, which is particularly handy if you’ve scored one of the new Macs announced yesterday. Every app comes fully unlocked and compatible with the latest macOS. Head below for a few details on our top picks or dive into the entire sale here. more… The post The 9to5Mac Black Friday BundleHunt sale features nearly 50 top Mac apps from $1 appeared first on 9to5Mac.

Read more »

Apple patents new MacBook’s Touch Bar with Force Touch tec...
While we’re waiting for new redesigned MacBooks next year, a new patent application was published by the US Patent & Trademark Office today revealing a new version of the Touch Bar that looks exactly like the current one, except that this new model features Force Touch. more… The post Apple patents new MacBook’s Touch Bar with Force Touch technology appeared first on 9to5Mac.

Read more »

Save up to $79 on AirPods, AirPods Pro for Black Friday
Amazon is slashing prices on the newest Apple headphones for Black Friday. You can save up to $79.01 on AirPods and AirPods Pro for a limited time. Bag yours before they sell out!This post contains affiliate links. Cult of Mac may earn a commission when you use our links to buy items. Read our reviews […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Save 15% on stunning Juuk bands for Apple Watch
Juuk Design’s wonderfully high-end bands are the quickest way to take your Apple Watch from drab to fab — and you can save 15% on all of them in the Cult of Mac Store’s big Black Friday sale. This rare discount ends on Monday, November 30, so enjoy it while you can. Juuk was making bands […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

New Apple News+ users can get extended 3-month trial right n...
Apple is now offering new Apple News+ subscribers an extended three-month trial. The deal is available from today through Monday, November 30, in all four countries currently supported by Apple News+. In an effort to attract new subscribers to Apple News+, Apple has been offering a one-month free trial since the very beginning. The trial […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Meridio’s Italian-made leather and environmentally-conscio...
Meridio is now offering 50% off all of its Italian leather Watch bands and even deeper deals on a selection of its other accessories. Described as “where the strong character of Italian tradition meets cutting-edge technology,” Meridio bands are handmade in Italy by an ancient tannery in the Marche and span across a wide range of textured leather treatments, moody colorways, and more. Head below for a closer look at some of Meridio’s most interesting options and deep 50% price drops.  more… The post Meridio’s Italian-made leather and environmentally-conscious Apple Watch bands now 50% off appeared first on 9to5Mac.

Read more »

Amazon launches $279 iPad 8th Gen Black Friday deal, limited...
Apple's new 8th Generation iPad is on sale for $279 at Amazon, while the spacious 128GB Wi-Fi model is $70 off, thanks to clippable Black Friday coupons.$279 iPad 8th Generation Black Friday deal at AmazonBlack Friday iPad savings Read more...

Read more »

Mega Apple Watch Black Friday deal roundup: save up to $250 ...
Black Friday is on the horizon, and AppleInsider has rounded up the best deals on a wide assortment of Apple Watch styles and accessories with savings of up to $250 off, and discounts on even the latest Apple Watch Series 6 and SE.The Apple Watch is a hot-ticket item that countless holiday shoppers will snatch up thanks to aggressive Black Friday Apple Watch deals. This holiday week, stores are slashing prices on the latest Apple Watch Series 6, along with entry-level models and even closeout Series 5 styles.We've grouped the deals by store, so you can jump to your favorite retailer without having to scan countless Black Friday ads. You can also easily compare Apple Watch prices in our Price Guide, which is updated through the day to reflect the cheapest deals across a variety of Apple resellers. Read more...

Read more »

Apple investigating using Apple Watch to continually measure...
Instead of the periodic or on-demand measurement of heart rate that the Apple Watch can currently do, future devices may provide constant monitoring.Future Apple Watches may be able to measure blood pressure as well as heart ratePerhaps the very first health feature of the Apple Watch was its ability to sense heart rate. Five years and six versions on, it's still a key feature — and Apple continues to research how to add blood pressure measurements to it. Read more...

Read more »

Apple Powerbeats3 wireless earphones are 39% off
iLounge has a special deal on the Apple Powerbeats 3 Wireless Earphones, which allows you to experience outstanding Beats audio at a marvelous price. Apple’s Powerbeats 3 is a wicked companion for those who love working out. As a wireless earphones it won’t tangle or interfere with your fitness goals. Featuring a redesigned shell for […] The post appeared first on iLounge.

Read more »

iMyFone Black Friday Deals: Up to 80% Off! Free iPhone 12 &a...
Black Friday 2020 is here, and the deals are so good they’ll make up for the rest of this year! We have incredible deals for Apple World Today readers from our friends at iMyFone. The deals are available right now, so let’s get into the details:

Read more »

iMyFone Black Friday Deals: Up to 80% Off! Free iPhone 12 &a...
Black Friday 2020 is here, and the deals are so good they’ll make up for the rest of this year! We have incredible deals for Apple World Today readers from our friends at iMyFone. The deals are available right now, so let’s get into the details:

Read more »

The Retro TV game console is 64% off
iLounge has a special deal on the Retro TV Game Console, which allows you to play classic 8-bit games on your TV. Been reminiscing on good old days when 8-bit pixel graphics dominated the arcades and homes? Now you can relive the glory with the Retro TV Game Console. It has a built-in library of […] The post appeared first on iLounge.

Read more »

AUKEY’s 100W MacBook Pro USB-C charger is now 30% off
Upgrade your stock charger with one that can power up your MacBook Pro, iPhone 11 Pro Max and others. Today, the AUKEY Omnia 100W USB Charger is down to just $31.99 from its original price of $45.99 on Amazon. That’s a 30% discount on both white and black model variants. What makes Aukey’s charger special? […] The post appeared first on iLounge.

Read more »

Deadline for Apps that offer virtual events using In-App pur...
In September, Apple changed its App Store rules regarding in-app purchases for apps that offer virtual events. Originally, Apple wanted developers to comply with this regulation by the end of this year but has pushed it back to June 30, 2021. The rules mention how apps that offer person to person experiences allow other purchase […] The post Deadline for Apps that offer virtual events using In-App purchases extended appeared first on iLounge.

Read more »

Vienna, Austria gets new transit directions on Apple Maps
Apple has recently updated its Apple Maps app to provide transit directions in Austria, specifically its capital, Vienna. Directions on where the public transportation routes are now uploaded on the app. Users can now choose their preferred transit route when moving from point a to point b. S-Bahn and U-Bahn train routes are prominently included […] The post appeared first on iLounge.

Read more »

Black Friday deals: save up to 20% on Thunderbolt 3 docks, N...
Anker, Synology, and CalDigit all have new Black Friday deals which include some of the best prices we've ever seen on Thunderbolt 3 docks.Left: CalDigit TS3 Plus Thunderbolt 3 Dock. Right: Anker Docking StationCalDigit Black Friday deals on Amazon Read more...

Read more »

Taiwan and Mexico get HomePod Mini shipment
HomePod mini debuted November 6 after it was announced during this years Apple event. Today, countries such as Taiwan and Mexico can now buy it and see the smart speaker in action. Taiwan and Mexico customers can visit their respective Apple official websites and buy the HomePod mini, priced at NT $3,000 and MX $2,599, […] The post appeared first on iLounge.

Read more »

Apple chip-maker on track to start building more advanced CP...
Apple chip supplier TSMC this week completed construction on a new plant that will manufacture 3-nanometer chipsets. The company hopes to start production during the second half of 2022. Apple and Samsung are currently the only two companies shipping commercial 5-nanometer chipsets. Apple’s include the A14 Bionic found inside iPhone 12 and iPad Air 4, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple’s homegrown 5G modem may first be used in next-gen i...
Apple plans to use its own mmWave 5G modem for the first time in the next-gen iPad Pro, dues in early 2021 and, of course, in the next-gen… The post Apple’s homegrown 5G modem may first be used in next-gen iPad Pro appeared first on MacDailyNews.

Read more »

∞ Happy Thanksgiving
I just wanted to wish everyone a Happy Thanksgiving. Dave and I really appreciate your support throughout the year for the words written on these pages and the podcast. It's been a tough year, but we're all doing our best to make it through. Please be safe during the holiday.

Read more »

Family-friendly games to play at your virtual Thanksgiving
Whether you're into board games, card games, or just looking for ways to interact between turkey and pie, these iOS games let you play virtually. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

UK blames Apple and Amazon for 'tsunami' of electr...
The UK government's Environmental Audit Committee says Apple makes it "nearly impossible" to repair devices such as the iPhone, and not "playing their part" in recycling.Credit: AppleFollowing a nine-month consultation, the UK's Environmental Audit Committee (EAC) has concluded that companies such as Apple should be required to be more responsible about electronic waste. Apple, which declined to contribute to the research, is accused of deliberately making its products so expensive to repair that consumers buy new devices instead. Read more...

Read more »

Best Black Friday Apple Deals: Latest M1-powered MacBooks fr...
Welcome to Black Friday week at 9to5Mac. Throughout Thanksgiving and the following days, we are expecting to see one of the biggest stretches of online deals we’ve ever seen. Our team at 9to5Toys is working around the clock to bring you all of the best deals on the latest tech, TVs, home goods, fashion, and much more throughout Black Friday week. As always, the major players will be center stage this week, with Amazon, Walmart, Target, Best Buy, and many others offering up notable deals. Below you’ll find all of the best Black Friday deals with a particular focus on the latest from Apple. more… The post Best Black Friday Apple Deals: Latest M1-powered MacBooks from $948, AirPods starting at $99, more appeared first on 9to5Mac.

Read more »

Deals: save up to $20 on Eve HomeKit switches, sensors, and ...
A whole range of Eve smart home products have just gone on sale for Black Friday, meaning now is the time to stock up on HomeKit devices.Eve's smart plug is one of the company's devices on sale for Black FridayEve Black Friday deals on Amazon Read more...

Read more »

How to Color Calibrate Your Mac’s Display
It's easy calibrate your display so you see colors as they should be; it can make your computing more comfortable, especially if you work with photos or video. The post appeared first on The Mac Security Blog.

Read more »

Black Friday; Securely Dispose of Your Old Mac; The HomePod ...
With Black Friday coming up, we give some tips on buying older devices that may be insecure. We discuss how to audit your subscriptions with Apple, so you don't pay for what you're no longer using. We look at how to securely dispose of a Mac when you're selling or giving it away. And we talk about the new HomePod mini: is it the right smart speaker for you? The post Black Friday; Securely Dispose of Your Old Mac; The HomePod mini – Intego Mac Podcast Episode 163 appeared first on The Mac Security Blog.

Read more »

Caution! These Black Friday “deals” may be bad for your ...
Each year, retailers announce door-busting deals on items they think will attract customers to their stores the day after the U.S. Thanksgiving holiday. Black Friday is one of the most popular shopping days of the year. Along with its neighbor Cyber Monday, these shopping days (and any “early Black Friday” deals) ostensibly initiate the Christmas […] The post Caution! These Black Friday “deals” may be bad for your security appeared first on The Mac Security Blog.

Read more »

Apple HomePod mini Review: Siri in a Compact Speaker
The HomePod mini is a compact device that combines audio, Siri, and home control. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of November 16, 2020
Original release date: November 23, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. 2020-11-18 7.5 CVE-2020-28367 MISC CONFIRM MLIST MLIST FEDORA golang -- go Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. 2020-11-18 7.5 CVE-2020-28366 MISC CONFIRM MLIST FEDORA jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler. 2020-11-16 10 CVE-2020-25207 MISC CONFIRM riken -- xoonips Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. 2020-11-16 7.5 CVE-2020-5664 MISC MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info chronoengine -- chronoforums Chronoforeum 2.0.11 allows Stored XSS vulnerabilities when inserting a crafted payload into a post. If any user sees the post, the inserted XSS code is executed. 2020-11-16 4.3 CVE-2020-27459 MISC cmsuno_project -- cmsuno An authenticated attacker can inject malicious code into "lang" parameter in /uno/central.php file in CMSuno 1.6.2 and run this PHP code in the web page. In this way, attacker can takeover the control of the server. 2020-11-13 6.5 CVE-2020-25538 MISC golang -- go Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service. 2020-11-18 5 CVE-2020-28362 CONFIRM MLIST FEDORA intel -- proset/wireless_wifi Insufficient control flow management in some Intel(R) PROSet/Wireless WiFi products before version 21.110 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. 2020-11-13 5.8 CVE-2020-12313 MISC ivanti -- endpoint_manager LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device request. 2020-11-16 6.5 CVE-2020-13769 MISC MISC ivanti -- endpoint_manager In /ldclient/ldprov.cgi in Ivanti Endpoint Manager through 2020.1.1, an attacker is able to disclose information about the server operating system, local pathnames, and environment variables with no authentication required. 2020-11-16 5 CVE-2020-13772 MISC MISC jetbrains -- toolbox JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler. 2020-11-16 5 CVE-2020-25013 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.7955, an attacker could access workflow rules without appropriate access grants. 2020-11-16 5 CVE-2020-25210 MISC CONFIRM jetbrains -- youtrack JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27626 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues. 2020-11-16 5 CVE-2020-27625 MISC jetbrains -- youtrack JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF. 2020-11-16 5 CVE-2020-27624 MISC CONFIRM jetbrains -- youtrack In JetBrains YouTrack before 2020.3.6638, improper access control for some subresources leads to information disclosure via the REST API. 2020-11-16 5 CVE-2020-25209 MISC CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting all version prior to 7.1.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS) 2020-11-17 4.3 CVE-2020-11860 CONFIRM microfocus -- arcsight_logger Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploited resulting in Cross-Site Scripting (XSS). 2020-11-17 4.3 CVE-2020-25834 CONFIRM netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session. 2020-11-13 5 CVE-2020-8583 MISC netapp -- hci Element Software versions prior to 12.2 and HCI versions prior to 1.8P1 are susceptible to a vulnerability which could allow an authenticated user to view sensitive information. 2020-11-13 4 CVE-2020-8582 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6147 FULLDISC MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance USDC file format path element token index. 2020-11-13 6.8 CVE-2020-6156 MISC pixar -- openusd A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow, which can result in remote code execution. To trigger this vulnerability, the victim needs to access an attacker-provided malformed file. 2020-11-13 6.8 CVE-2020-6155 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6150 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. To trigger this vulnerability, the victim needs to open an attacker-provided malformed file in an instance in USDC file format PATHS section. 2020-11-13 6.8 CVE-2020-6149 MISC pixar -- openusd A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS section decompression heap overflow. 2020-11-13 6.8 CVE-2020-6148 MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.5 CVE-2020-25695 MISC MISC postgresql -- postgresql A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. 2020-11-16 6.8 CVE-2020-25694 MISC MISC riken -- xoonips SQL injection vulnerability in the XooNIps 3.49 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors. 2020-11-16 6.5 CVE-2020-5659 MISC MISC riken -- xoonips Stored cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 4 CVE-2020-5663 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info ibm -- infosphere_information_server IBM InfoSphere Information Server 11.7 stores sensitive information in the browser's history that could be obtained by a user who has access to the same system. IBM X-Force ID: 190910. 2020-11-13 2.1 CVE-2020-4886 XF CONFIRM jetbrains -- youtrack Sensitive information could be disclosed in the JetBrains YouTrack application before 2020.2.0 for Android via application backups. 2020-11-16 2.1 CVE-2020-24366 MISC CONFIRM microfocus -- filr Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack. 2020-11-17 3.5 CVE-2020-25832 CONFIRM microfocus -- idol Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability could be exploited to perform Persistent XSS attack. 2020-11-17 3.5 CVE-2020-25833 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). 2020-11-16 3.5 CVE-2020-27988 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard). 2020-11-16 3.5 CVE-2020-27989 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent). 2020-11-16 3.5 CVE-2020-27990 CONFIRM nagios -- nagios_xi Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field). 2020-11-16 3.5 CVE-2020-27991 CONFIRM riken -- xoonips Reflected cross-site scripting vulnerability in XooNIps 3.49 and earlier allows remote authenticated attackers to inject arbitrary script via unspecified vectors. 2020-11-16 3.5 CVE-2020-5662 MISC MISC salesagility -- suitecrm SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting (XSS) in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML. 2020-11-18 3.5 CVE-2020-14208 MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info airleader -- master_and_easy_devices   Airleader Master and Easy =12.8, =13.4, =13.5, =8.14, =13.4, =13.5, cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font. 2020-11-21 not yet calculated CVE-2020-25725 CONFIRM MISC reddoxx -- maildepot_2033   REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message. 2020-11-18 not yet calculated CVE-2020-26554 MISC MISC resourcexpress -- qubi3_devices   QED ResourceXpress Qubi3 devices before 1.40.9 could allow a local attacker (with physical access to the device) to obtain sensitive information via the debug interface (keystrokes over a USB cable), aka wireless password visibility. 2020-11-17 not yet calculated CVE-2020-25746 CONFIRM MISC rsa -- archer   RSA Archer 6.8 through 6.8.0.3 and 6.9 contains a URL injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user into executing malicious JavaScript code in the context of the web application. 2020-11-18 not yet calculated CVE-2020-26884 CONFIRM schneider_electric -- easergy_t300   A CWE-284: Improper Access Control vulnerability exists in Easergy T300 (with firmware 2.7 and older) that could cause a wide range of problems, including information exposure, denial of service, and command execution when access to a resource from an attacker is not restricted or incorrectly restricted. 2020-11-19 not yet calculated CVE-2020-7561 MISC schneider_electric -- ecostruxure_building_operation_enterprise_server   A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central installer V2.0 - V3.1 that could cause any local Windows user who has write permission on at least one of the subfolders of the Connect Agent service binary path, being able to gain the privilege of the user who started the service. By default, the Enterprise Server and Enterprise Central is always installed at a location requiring Administrator privileges so the vulnerability is only valid if the application has been installed on a non-secure location. 2020-11-19 not yet calculated CVE-2020-28209 MISC schneider_electric -- ecostruxure_building_operation_webreports A CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary XML code and obtain disclosure of confidential data, denial of service, server side request forgery due to improper configuration of the XML parser. 2020-11-19 not yet calculated CVE-2020-7572 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Stored) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Cross-Site Scripting stored attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7570 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution. 2020-11-19 not yet calculated CVE-2020-7569 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site Scripting Reflected) vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker to inject arbitrary web script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site Scripting reflected attack against other WebReport users. 2020-11-19 not yet calculated CVE-2020-7571 MISC schneider_electric -- ecostruxure_building_operation_webreports   A CWE-284 Improper Access Control vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause a remote attacker being able to access a restricted web resources due to improper access control. 2020-11-19 not yet calculated CVE-2020-7573 MISC schneider_electric -- ecostruxure_building_operation_webstation   A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in EcoStruxure Building Operation WebStation V2.0 - V3.1 that could cause an attacker to inject HTML and JavaScript code into the user's browser. 2020-11-19 not yet calculated CVE-2020-28210 MISC schneider_electric -- ecostruxure_control_expert A CWE-494: Download of Code Without Integrity Check vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when sending specially crafted requests over Modbus. 2020-11-19 not yet calculated CVE-2020-28213 MISC schneider_electric -- ecostruxure_control_expert   A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause unauthorized command execution when a brute force attack is done over Modbus. 2020-11-19 not yet calculated CVE-2020-28212 MISC schneider_electric -- ecostruxure_control_expert   A CWE-863: Incorrect Authorization vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause bypass of authentication when overwriting memory using a debugger. 2020-11-19 not yet calculated CVE-2020-28211 MISC schneider_electric -- ecostruxure_control_expert   A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7559 MISC schneider_electric -- ecostruxure_operator_terminal_expert   A CWE-269 Improper Privilege Management vulnerability exists in EcoStruxureª Operator Terminal Expert runtime (Vijeo XD) that could cause privilege escalation on the workstation when interacting directly with a driver installed by the runtime software of EcoStruxureª Operator Terminal Expert. 2020-11-19 not yet calculated CVE-2020-7544 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7556 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7558 MISC schneider_electric -- igss_definition   A CWE-125 Out-of-bounds Read vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7557 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7555 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7550 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7551 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7552 MISC schneider_electric -- igss_definition   A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7554 MISC schneider_electric -- igss_definition   A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition. 2020-11-19 not yet calculated CVE-2020-7553 MISC schneider_electric -- modicon_m221 A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys. 2020-11-19 not yet calculated CVE-2020-7567 MISC schneider_electric -- modicon_m221   A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7566 MISC schneider_electric -- modicon_m221   A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7565 MISC schneider_electric -- modicon_m221   A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. 2020-11-19 not yet calculated CVE-2020-7568 MISC schneider_electric -- multiple_products A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7564 MISC schneider_electric -- multiple_products   A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7562 MISC schneider_electric -- multiple_products   A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP. 2020-11-18 not yet calculated CVE-2020-7563 MISC schneider_electric -- plc_simulator_on_ecostruxure_control_expert   A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity Pro) (all versions) that could cause a crash of the PLC simulator present in EcoStruxureª Control Expert software when receiving a specially crafted request over Modbus. 2020-11-19 not yet calculated CVE-2020-7538 MISC scratchverifier -- scratchverifier   In ScratchVerifier before commit a603769, an attacker can hijack the verification process to log into someone else's account on any site that uses ScratchVerifier for logins. A possible exploitation would follow these steps: 1. User starts login process. 2. Attacker attempts login for user, and is given the same verification code. 3. User comments code as part of their normal login. 4. Before user can, attacker completes the login process now that the code is commented. 5. User gets a failed login and attacker now has control of the account. Since commit a603769 starting a login twice will generate different verification codes, causing both user and attacker login to fail. For clients that rely on a clone of ScratchVerifier not hosted by the developers, their users may attempt to finish the login process as soon as possible after commenting the code. There is no reliable way for the attacker to know before the user can finish the process that the user has commented the code, so this vulnerability only really affects those who comment the code and then take several seconds before finishing the login. 2020-11-20 not yet calculated CVE-2020-26236 MISC CONFIRM semantic-release -- semantic-release   In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3. 2020-11-18 not yet calculated CVE-2020-26226 MISC CONFIRM sensormatics_electronics -- american_dynamics_victor_web_client_and_software_house_c.cure_web_client   A vulnerability in specified versions of American Dynamics victor Web Client and Software House C•CURE Web Client could allow an unauthenticated attacker on the network to create and sign their own JSON Web Token and use it to execute an HTTP API Method without the need for valid authentication/authorization. Under certain circumstances, this could be used by an attacker to impact system availability by conducting a Denial of Service attack. 2020-11-19 not yet calculated CVE-2020-9049 CERT CONFIRM sokrates -- sowa   A Cross Site Scripting (XSS) vulnerability exists in OPAC in Sokrates SOWA SowaSQL through 5.6.1 via the sowacgi.php typ parameter. 2020-11-19 not yet calculated CVE-2020-28350 MISC sourcecodester -- gym_management_system   Stored Cross-site scripting (XSS) vulnerability in SourceCodester Gym Management System 1.0 allows users to inject and store arbitrary JavaScript code in index.php?page=packages via vulnerable fields 'Package Name' and 'Description'. 2020-11-17 not yet calculated CVE-2020-28129 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a SQL Injection via the txtUserName parameter to login.php. 2020-11-17 not yet calculated CVE-2020-28138 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by an arbitrary file upload via the image upload feature of Products.php. 2020-11-17 not yet calculated CVE-2020-28140 MISC MISC sourcecodester -- online_clothing_store   SourceCodester Online Clothing Store 1.0 is affected by a cross-site scripting (XSS) vulnerability via a Offer Detail field in offer.php. 2020-11-17 not yet calculated CVE-2020-28139 MISC MISC sourcecodester -- online_library_management_system   An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root). 2020-11-17 not yet calculated CVE-2020-28130 MISC MISC sourcecodester -- simple_grocery_store_sales_and_inventory_system   An issue was discovered in SourceCodester Simple Grocery Store Sales And Inventory System 1.0. There was authentication bypass in web login functionality allows an attacker to gain client privileges via SQL injection in sales_inventory/login.php. 2020-11-17 not yet calculated CVE-2020-28133 MISC MISC sourcecodester -- tourism_management_system   An Arbitrary File Upload is discovered in SourceCodester Tourism Management System 1.0 allows the user to conduct remote code execution via admin/create-package.php vulnerable page. 2020-11-17 not yet calculated CVE-2020-28136 MISC MISC sourcecodester -- water_billing_system   SQL injection vulnerability in SourceCodester Water Billing System 1.0 via the username and password parameters to process.php. 2020-11-17 not yet calculated CVE-2020-28183 MISC MISC MISC suitecrm -- suitecrm SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document. 2020-11-18 not yet calculated CVE-2020-15300 MISC suitecrm -- suitecrm   SuiteCRM through 7.11.13 allows CSV Injection via registration fields in the Accounts, Contacts, Opportunities, and Leads modules. These fields are mishandled during a Download Import File Template operation. 2020-11-18 not yet calculated CVE-2020-15301 MISC symantec -- endpoint_detection_and_response   Symantec Endpoint Detection & Response, prior to 4.5, may be susceptible to an information disclosure issue, which is a type of vulnerability that could potentially allow unauthorized access to data. 2020-11-18 not yet calculated CVE-2020-12593 CONFIRM taskcafe -- project_management_tool   Cross domain policies in Taskcafe Project Management tool before version 0.1.0 and 0.1.1 allows remote attackers to access sensitive data such as access token. 2020-11-17 not yet calculated CVE-2020-25400 MISC tenable -- tp-link_archer   UNIX Symbolic Link (Symlink) Following in TP-Link Archer C9(US)_V1_180125 firmware allows an unauthenticated actor, with physical access and network access, to read sensitive files and write to a limited set of files after plugging a crafted USB drive into the router. 2020-11-21 not yet calculated CVE-2020-5797 MISC tobesoft -- xplatform   Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string is begun with http://, https://, mailto:// 2020-11-17 not yet calculated CVE-2020-7841 MISC tp-link -- multiple_devices   Buffer overflow in in the copy_msg_element function for the devDiscoverHandle server in the TP-Link WR and WDR series, including WDR7400, WDR7500, WDR7660, WDR7800, WDR8400, WDR8500, WDR8600, WDR8620, WDR8640, WDR8660, WR880N, WR886N, WR890N, WR890N, WR882N, and WR708N. 2020-11-20 not yet calculated CVE-2020-28877 MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (versions 2 through 4) allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-24297 MISC MISC tp-link -- tl-wpa4220_devices   httpd on TP-Link TL-WPA4220 devices (hardware versions 2 through 4) allows remote authenticated users to trigger a buffer overflow (causing a denial of service) by sending a POST request to the /admin/syslog endpoint. Fixed version: TL-WPA4220(EU)_V4_201023 2020-11-18 not yet calculated CVE-2020-28005 MISC MISC trend_micro -- apex_one   A vulnerability in Trend Micro Apex One could allow an unprivileged user to abuse the product installer to reinstall the agent with additional malicious code in the context of a higher privilege. 2020-11-18 not yet calculated CVE-2020-28572 MISC trend_micro -- interscan_web_security_virtual_appliance A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28581 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28578 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28579 MISC MISC trend_micro -- interscan_web_security_virtual_appliance   A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges. 2020-11-18 not yet calculated CVE-2020-28580 MISC MISC trend_micro -- security_2020 Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27697 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a local directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27695 MISC trend_micro -- security_2020   Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product. 2020-11-18 not yet calculated CVE-2020-27696 MISC trend_micro -- worry-free_business_security   A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console. 2020-11-18 not yet calculated CVE-2020-28574 MISC MISC trusted_computing_group -- trusted_platform_module_library_family   Trusted Computing Group (TCG) Trusted Platform Module Library Family 2.0 Library Specification Revisions 1.38 through 1.59 has Incorrect Access Control during a non-orderly TPM shut-down that uses USE_DA_USED. Improper initialization of this shut-down may result in susceptibility to a dictionary attack. 2020-11-18 not yet calculated CVE-2020-26933 MISC CONFIRM typ03 -- typ03   An issue was discovered in the view_statistics (aka View frontend statistics) extension before 2.0.1 for TYPO3. It saves all GET and POST data of TYPO3 frontend requests to the database. Depending on the extensions used on a TYPO3 website, sensitive data (e.g., cleartext passwords if ext:felogin is installed) may be saved. 2020-11-18 not yet calculated CVE-2020-28917 MISC typo3 -- fluid   TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory. 2020-11-17 not yet calculated CVE-2020-26216 MISC CONFIRM MISC valve -- game_networking_sockets   Valve's Game Networking Sockets prior to version v1.2.0 improperly handles unreliable segments with negative offsets in function SNP_ReceiveUnreliableSegment(), leading to a Heap-Based Buffer Underflow and a free() of memory not from the heap, resulting in a memory corruption and probably even a remote code execution. 2020-11-18 not yet calculated CVE-2020-6016 MISC vmware -- esxi   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG) contains a privilege-escalation vulnerability that exists in the way certain system calls are being managed. A malicious actor with privileges within the VMX process only, may escalate their privileges on the affected system. Successful exploitation of this issue is only possible when chained with another vulnerability (e.g. CVE-2020-4004) 2020-11-20 not yet calculated CVE-2020-4005 CONFIRM vmware -- multiple_products   VMware ESXi (7.0 before ESXi70U1b-17168206, 6.7 before ESXi670-202011101-SG, 6.5 before ESXi650-202011301-SG), Workstation (15.x before 15.5.7), Fusion (11.x before 11.5.7) contain a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. 2020-11-20 not yet calculated CVE-2020-4004 CONFIRM volkswagon -- discover_media_infotainment_system   The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed, which can cause attacker-controlled files to be written to the infotainment system and executed as root. 2020-11-16 not yet calculated CVE-2020-28656 MISC werkzeug -- werkzeug   Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL. 2020-11-18 not yet calculated CVE-2020-28724 MISC MISC MISC western_digital -- inand_devices   Western Digital iNAND devices through 2020-06-03 allow Authentication Bypass via a capture-replay attack. 2020-11-18 not yet calculated CVE-2020-13799 MISC CONFIRM wordpress -- wordpress   The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles. 2020-11-16 not yet calculated CVE-2020-28650 MISC wordpress -- wordpress   The orbisius-child-theme-creator plugin before 1.5.2 for WordPress allows CSRF via orbisius_ctc_theme_editor_manage_file. 2020-11-16 not yet calculated CVE-2020-28649 MISC MISC xstream -- xstream   XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14. 2020-11-16 not yet calculated CVE-2020-26217 CONFIRM CONFIRM CONFIRM y18n -- y18n   This affects the package y18n before 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('__proto__'); y18n.updateLocale({polluted: true}); console.log(polluted); // true 2020-11-17 not yet calculated CVE-2020-7774 MISC MISC MISC MISC yzmcms -- yzmcms   In YzmCMS v5.5 the member contribution function in the editor contains a cross-site scripting (XSS) vulnerability. 2020-11-19 not yet calculated CVE-2020-22394 MISC zte -- multiple_devices   Some ZTE devices have input verification vulnerabilities. The devices support configuring a static prefix through the web management page. The restriction of the front-end code can be bypassed by constructing a POST request message and sending the request to the creation of a static routing rule configuration interface. The WEB service backend fails to effectively verify the abnormal input. As a result, the attacker can successfully use the vulnerability to tamper parameter values. This affects: ZXHN Z500 V1.0.0.2B1.1000 and ZXHN F670L V1.1.10P1N2E. This is fixed in ZXHN Z500 V1.0.1.1B1.1000 and ZXHN F670L V1.1.10P2N2. 2020-11-19 not yet calculated CVE-2020-6879 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

How to Use Apple’s Built-in Features to Encrypt Files and ...
Use features built in to macOS to encrypt files, folders, and disks to ensure that your data is secure. The post How to Use Apple’s Built-in Features to Encrypt Files and Folders appeared first on The Mac Security Blog.

Read more »

GoDaddy Employees Used in Attacks on Multiple Cryptocurrency...
Fraudsters redirected email and web traffic destined for several cryptocurrency trading platforms over the past week. The attacks were facilitated by scams targeting employees at GoDaddy, the world's largest domain name registrar, KrebsOnSecurity has learned.

Read more »

Convicted SIM Swapper Gets 3 Years in Jail
A 21-year-old Irishman who pleaded guilty to charges of helping to steal millions of dollars in cryptocurrencies from victims has been sentenced to just under three years in prison. The defendant is part of an alleged conspiracy involving at least eight others in the United States who stand accused of theft via SIM swapping, a […]

Read more »

How To Prepare Your Mac for macOS Big Sur – Intego Mac Pod...
Apple released macOS Big Sur last week. On release day, there were a number of issues, including problems launching apps on Macs. We discuss what happened, and how Apple is changing its Gatekeeper security check. We also talk about when you should upgrade to Big Sur and how you should prepare your Mac for the big upgrade. The post How To Prepare Your Mac for macOS Big Sur – Intego Mac Podcast Episode 162 appeared first on The Mac Security Blog.

Read more »

Trump Fires Security Chief Christopher Krebs
President Trump on Tuesday fired his top election security official Christopher Krebs (no relation). The dismissal came via Twitter two weeks to the day after Trump lost an election he baselessly claims was stolen by widespread voting fraud.

Read more »

Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain...
The macOS and iOS keychain allows you to store passwords securely, and access them on all your Apple devices. The post Mac and iOS Keychain Tutorial: How Apple’s iCloud Keychain Works appeared first on The Mac Security Blog.

Read more »

Black Friday 2020 sale at Verizon: Apple Watches for $99 wit...
Verizon is offering Apple Watches for only $99 with the purchase of a new iPhone, new lines of service required. Promo is via $230 monthly bill credits spread over a 24 month period, and is valid with any Apple Watch Series 6, SE, or 3. The fine print: “Get up to $9.57/mo in promo credit over 24 months. 5G Ultra Wideband available only in parts of select cities. 5G Nationwide available in 1800+ cities. $1399.99 purchase on device payment on smartphone required. $329.99 purchase on device payment on smartwatch required. Less $230 promo credit applied to account over 24 mos; promo credit ends if eligibility requirements are no longer met; 0% APR.” This deal is live at → Read More...

Read more »

This Black Friday sale at Amazon yields 2020’s cheapest ne...
Amazon has dropped prices on clearance 2020 13″ Intel-powered MacBook Airs to only $799.99 as part of their Black Friday 2020 sale. Their prices are the lowest available for these MacBooks from any of Apple’s resellers. These are the same 13″ MacBook Airs that were sold by Apple in their retail and online stores. – 13″ 1.1GHz Dual-Core MacBook Air (Space Gray): $799.99 $200 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air (Silver): $799.99 $200 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air (Gold): $799.99 $200 off MSRP Amazon’s prices are highly dynamic, meaning they can change hourly. We list their lowest price of the day for each MacBook Air. If you see a higher price, check their site later or add a MacBook Air to your shopping cart and check later in the day to see if the price has dropped. Stock status at Amazon also changes rapidly. Keep an eye on our 13″ MacBook Air Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Black Friday 2020 Sale: Get a 13″ 2GHz MacBook Pro for up ...
B&H Photo has new 2020 13″ 2.0GHz MacBook Pros with 10th generation Intel CPUs on sale for $150-$230 off Apple’s MSRP, starting at $1649, as part of their Black Friday 2020 sale. These are the same MacBook Pros sold by Apple in their retail and online stores: – 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1649 $150 off MSRP – 13″ 2.0GHz/512GB MacBook Pro Silver: $1649 $150 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1769 $230 off MSRP – 13″ 2.0GHz/1TB MacBook Pro Silver: $1769 $230 off MSRP Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs now on sale for $150-$250 off Apple’s MSRP as part of their Black Friday week 2020 sale. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1649 $150 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1649 $150 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1769 $230 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1749.99 $250 off MSRP For the latest prices and sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Amazon has 7.9″ iPad minis on sale this Black Friday for o...
Amazon has 7.9″ 64GB iPad mini WiFis on sale for $334.99 as part of their Black Friday 2020 sale. That’s $65 off Apple’s MSRP and the lowest price available for an iPad mini anywhere. Space Gray, Silver, and Gold models are available. For the latest prices and sale, see our iPad mini Price Tracker, → Read More...

Read more »

Apple Silicon for only $649! Hot Black Friday sale at B&...
Apple reseller B&H Photo has Apple’s new Mac minis with M1 Apple Silicon CPUs on sale starting at only $649 as part of their Black Friday 2020 sale. These are the lowest prices we’ve seen so far for new Macs with Apple M1 processors: – Mac mini M1 CPU/256GB SSD: $649 $50 off MSRP – Mac mini M1 CPU/512GB SSD: $829 $70 off MSRP These are the same Mac minis sold by Apple in their retail and online stores. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Apple Silicon for only $649! Hot Black Friday sale at B&...
Apple reseller B&H Photo has Apple’s new Mac minis with M1 Apple Silicon CPUs on sale starting at only $649 as part of their Black Friday 2020 sale. These are the lowest prices we’ve seen so far for new Macs with Apple M1 processors: – Mac mini M1 CPU/256GB SSD: $649 $50 off MSRP – Mac mini M1 CPU/512GB SSD: $829 $70 off MSRP These are the same Mac minis sold by Apple in their retail and online stores. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Black Friday 2020: Apple’s base 21″ 2.3GHz iMac for only...
B&H Photo and Amazon both have Apple’s base 21″ 2.3GHz iMac on sale for $999 as part of their Black Friday 2020 sales. That’s $100 off Apple’s MSRP, and it’s the cheapest price available today for a new iMac: – 21″ 2.3GHz iMac: $999 at B&H, $100 off MSRP – 21″ 2.3GHz iMac: $999 at Amazon, $100 off MSRP For the latest prices and sales, keep an eye on our iMac Price Tracker, → Read More...

Read more »

Black Friday 2020: Apple’s base 21″ 2.3GHz iMac for only...
B&H Photo and Amazon both have Apple’s base 21″ 2.3GHz iMac on sale for $999 as part of their Black Friday 2020 sales. That’s $100 off Apple’s MSRP, and it’s the cheapest price available today for a new iMac: – 21″ 2.3GHz iMac: $999 at B&H, $100 off MSRP – 21″ 2.3GHz iMac: $999 at Amazon, $100 off MSRP For the latest prices and sales, keep an eye on our iMac Price Tracker, → Read More...

Read more »

Black Friday deal at Amazon now live: Get Apple AirPods Pro ...
Amazon has Apple AirPods Pro on sale for only $169 as part of their Black Friday 2020 sale, now live on their site. Amazon’s price is $80 off Apple’s MSRP, and it’s the lowest price we’ve ever seen for Apple AirPods Pro. Act now if you’re interested! For the latest prices and sales, see our AirPods Price Tracker, → Read More...

Read more »

Buy Apple’s hot new M1 Mac mini this Black Friday/Cyber Mo...
Apple reseller Datavision has received stock of Apple’s popular new M1 Mac minis. DataVision charges sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you can save on sales tax by purchasing through DataVision, depending on your state’s current rate: – Mac mini M1 CPU/256GB SSD: $699 – Mac mini M1 CPU/512GB SSD: $895, $4 off These are the same Mac minis sold by Apple in their retail and online stores. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

OWC has Apple HomePods on sale for $80-$90 off MSRP as part ...
Other World Computing has discounted, new, Apple HomePods on sale for $80-$90 off Apple’s MSRP as part of their Black Friday week 2020 sale: – HomePod Space Gray: $219.88 $80 off MSRP – HomePod White: $209.88 $90 off MSRP These are the same HomePods sold by Apple in their retail and online stores, and OWC’s prices are the lowest available for new HomePods anywhere. Keep an eye on our HomePod Price Tracker for the latest deals and sales from Apple and → Read More...

Read more »

Owners Of Apple’s iPhone 12 Series Report Being Plagued Wi...
NEWS: 11.25.20 – No, the OLED display on your new iPhone isn’t on LSD (and neither are you)… it really has been exhibiting a greenish, or, in other cases, grayish or yellowish, hue. According to a report last Wednesday from the website, MacRumors, Apple has acknowledged a display issue with its new iPhone 12 models. The problem appears to be either a green or gray glow — or other unintended lighting variations under some conditions — as well as flickering of the screen. A photo uploaded to the Apple Communities discussion threads by user “m4x1k” illustrating the green glow on the display of an iPhone 12 Pro, left, compared to a normal screen on the iPhone X S to its right. (Photo: Apple Communities) Based on reports from iPhone 12 owners on the Apple Communities discussion threads and the MacRumors reader forums, the quirk appears to occur when the screen brightness is set to approximately 90% or lower. The flickering or glowing is not always persistent, disappearing after a short time for some individuals. Many have been experiencing the display issue on iOS 14.1, iOS 14.2, and even the first two beta versions of iOS 14.3. MacRumors reported that the display issue can affect all iPhone 12 models from the iPhone 12 and iPhone 12 mini to the iPhone 12 Pro and iPhone 12 Pro Max. How does one know if their particular iPhone 12 model is affected by the display issue? According to a report last Friday from the website, Lifehacker, owners of these iPhones shouldn’t panic just yet and should do the following steps to confirm signs that their screen is exhibiting the problem: turn off the lights in the room and restart the iPhone view a darker image or pull up an all-black background on the screen if the display has a strange green glow, it will be evident After determining that one’s iPhone exhibits the display issue, Lifehacker recommended that people contact Apple — → Read More...

Read more »