Prehistoric Planet: How to watch the new dinosaur docuseries
Today, a brand new dinosaur docuseries premieres on Apple TV+. You can watch Prehistoric Planet this week with a new episode dropping each day. Prehistoric Planet is narrated by David Attenborough and combines the latest scientific understanding with state-of-the-art visual effects. more… The post appeared first on 9to5Mac.

Read more »

Apple released a new Software Update
Apple just released a new Software Update:Download Security Update 2022-004 (Catalina)

Read more »

Bring a Stylish Yet Functional Laptop Stand to Your Setup with the Discounted Razer Laptop Stand Chroma V2
nyone can just buy a vanilla laptop stand and get the benefits associated with them, but if you want something that’s stylish and gamer ... Read more The post appeared first on iLounge.

Read more »

Apple Music releases ‘Essential Anniversaries’ collection
Apple Music highlights a collection of music, dubbed ‘Essential Anniversaries’ on the platform. The service has an ‘Essentials’ playlist, which features songs from bands ... Read more The post appeared first on iLounge.

Read more »

Updated Apple support page confirms India card payment suspension
Apple today has updated its support page to reveal that credit and debit card payments in India won’t be supported due to changes in ... Read more The post appeared first on iLounge.

Read more »

Unlocked iPhone used by son to order 31 cheeseburgers
A 2-year old boy in Texas used his mother’s unattended iPhone to order 31 McDonald’s cheeseburgers via DoorDash. Kelsey Golden shared the story on ... Read more The post appeared first on iLounge.

Read more »

Microsoft Office Home and Business for Mac 2021 License Promotion Lookup is 85% Off
iLounge has a special deal on the Microsoft Office Home & Business for Mac 2021: Lifetime License, which allows you to get all essential ... Read more The post appeared first on iLounge.

Read more »

Enjoy a $59 Discount on the Latest 10.2 inch iPad Cellular Models
If you’re in the market for a cost-effective, do-it-all tablet then this deal is for you. Today, you can get the cellular version of ... Read more The post appeared first on iLounge.

Read more »

Audi Promises Apple Music integration on Its 2022 vehicles
Car manufacturer Audi has recently announced that a significant number of its 2022 vehicles will have Apple Music integrated within its infotainment systems. With ... Read more The post appeared first on iLounge.

Read more »

iOS users can now play Fortnite via GeForce NOW platform
NVIDIA has recently announced that iOS users can now play Fortnite on the GeForce NOW streaming service. Fortnite had been removed since August 2020 ... Read more The post appeared first on iLounge.

Read more »

Costco now offers Apple service subscriptions at lower rates
Retail store giant Costco has begun offering Apple subscriptions to services Apple Arcade, Apple News+ and Apple TV+ at a lower price than what ... Read more The post appeared first on iLounge.

Read more »

Compared: Amazon Fire 7 2022 vs iPad mini & 10.2-inch iPad
Amazon has updated its Fire 7 tablet for 2022 to make it faster and boost battery life, but it's unlikely to draw many potential buyers away from Apple's standard 10.2-inch iPad or the iPad mini, except for the highly cost-conscious.Amazon's Fire 7 for 2022 (middle) with the iPad mini (right) and 10.2-inch iPad (left)Amazon's Fire tablet lineup is best known for being an effective way to get a tablet at a very low cost, at the expense of more premium features. The Kindle Fire 7 has also been Amazon's signature tablet, the cheapest in the catalog that offers all of the basics that a tablet needs. Read more...

Read more »

Graduation Gift Guide 2022: find the perfect gifts for graduating students
Graduation season is upon us, so check out our helpful gift guide to help you score some great gear for your favorite graduating students.Whether your grad is headed off to college or starting their career, these are our favorite gifts that are sure to please any young adult.iPad Air 5 Read more...

Read more »

Apple Health VP promotes Apple Watch monitoring in wearables TV spot
Dr. Sumbul Desai, Apple's VP of Health, took part in a CBS Sunday Morning segment on health trackers, with the piece showing not only the utility of hardware like the Apple Watch in health, but also the potential of wearable devices to do more.The opening segment of CBS Sunday Morning on Sunday had correspondent David Pogue talking to a trio of experts about wearable devices. Dr. Desai was prominently featured, using the time to show off many features of the Apple Watch in relation to health monitoring and tracking.The features covered include heart rate tracking, irregular heart rate notifications, blood oxygen monitoring, walking steadiness, noise notifications, and hand washing. Demonstrations included showing Pogue's heart rate, sound level warnings, and an electrocardiogram. Read more...

Read more »

Today in Apple history: Newton spins off as its own company
May 22, 1997: Apple spins off its Newton division. The new company’s first job? Selling the MessagePad 2000 PDA. Newton Inc. also has a mandate to develop new technologies and market existing ones. “We have a solid business plan and a strong management team in place to optimize the value of Newton technology for corporate […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

FCC filings reveal Apple’s mysterious iOS-powered ‘Network Adapter’
New U.S. FCC filings this week reveal a mysterious new iOS-powered “Network Adapter” from Apple codenamed “A2657.” The post appeared first on MacDailyNews.

Read more »

Students will now have to pay more for Apple Music
Apple has hiked the Apple Music subscription price for students in many parts of the world. The Cupertino company has emailed students to inform them about the rise in the subscription price. Apple Music student plan is now more expensive The price hike is not uniform and varies from country to country. In India, the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Woman claims $40,000 credit card fraud occurred after losing Apple Watch
A visitor to Disney World dubiously claims she is the victim of credit card fraud valued at over $40,000, after dropping her Apple Watch on a ride at Disney World.While stories of lost or misplaced Apple devices are a regular occurrence, it is rare for device owners to lose significant sums from the loss. In one report about an April 13 trip to Disney World in California, an Apple Watch owner claims just that.According to a report from the Orange County Sheriff's Office seen by WDW News Today, a park guest lost her Apple Watch on The Seas with Nemo & Friends at Epcot. At a point when the ride was at an elevated position, the guest dropped the Hermes edition Apple Watch through a grated floor on the ride. Read more...

Read more »

Aqara offers a third, more-advanced smart lock for HomeKit and Home Key
Aquara launched its third and most-advanced smart lock for HomeKit and Home Key on Thursday, the D100 Zigbee. Unlike the previously released N100 Zigbee and A100 Zigbee, which are handle locks, the new D100 is an automatic mortise lock that lets users open a door without pushing a handle or turning a knob. It’s expected […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple TV+ lands sci-fi romance drama ‘Fingernails’ at Cannes
In a worldwide rights deal, Apple TV+ has landed "Fingernails," the sci-fi love story starring Jessie Buckley ("The Lost Daughter") and… The post appeared first on MacDailyNews.

Read more »

watchOS 9: Here’s what we know so far about new features, supported devices, and more
Now that WWDC 2022 is a couple of weeks from now, we’re gearing up for the release of watchOS 9. This will mark the next major release of Apple’s software platform for the Apple Watch. Head below as we recap all of the latest rumors and expectations for watchOS 9 this year, including new features, release info, and more.  more… The post appeared first on 9to5Mac.

Read more »

Apple TV+ secures romantic sci-fi 'Fingernails' in Cannes deal
Apple has picked up "Fingernails" for Apple TV+ in a Cannes film festival deal, a sci-fi love story set to star Jessie Buckley and Riz Ahmed."Fingernails" is based on a future where a test measures if couples are truly in love with each other, leading to the creation of institutes to help foster successful relationships. One skeptical woman starts working at one institute to find out more, assisting a mysterious and dedicated instructor.The deal was struck on Saturday night during the 2022 Cannnes film festival, reports Deadline. Jessie Buckley of "The Lost Daughter" will star alongside Riz Ahmed, from "The Sound of Metal." Read more...

Read more »

Land your dream job with this top-rated AI resume-builder
There’s a secret trick to getting your resume to the top of the pile: Use a smart AI resume tool to supercharge your job application. One of the best out there is Resoume. And right now, you can grab a lifetime subscription on sale for just $39.99. That’s a 93% discount off the regular price […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple picks up sci-fi romance drama ‘Fingernails’ at Cannes film festival
Apple has acquired rights to upcoming sci-fi romance drama feature film ‘Fingernails’, via Deadline. Ahead of the festival, the package was highlighted as one of the hot properties on sale at the Cannes market. The film will stream worldwide, exclusively, on Apple TV+. more… The post appeared first on 9to5Mac.

Read more »

Daily deals May 22: $600 70-inch LG Smart TV, $104 Beyerdynamic headphones, $32 Lego space shuttle, more
Sunday's best deals include a 100W Ugreen GaN charger for $65, an Arris Surfboard cable modem for $147, $80 off a Mod The Luxe Camera Bag, and much more.Best deals for May 22Every day, AppleInsider searches online retailers for deals and discounts on a variety of products, including Apple products, smart TVs, cameras, and accessories. The best offers are compiled into our daily deals list. Read more...

Read more »

An Apple E Ink display could be a game-changer–even without a folding iPhone
Earlier this week, supply-chain analyst extraordinaire Ming-Chi Kuo suggested that Apple’s investigating E Ink displays for future foldable iPhones. Now, Apple surely investigates lots of things–and most of them never make it across the finish line to become real products. But as a long-time admirer of E Ink as a technology, I’m excited about the possibility that Apple might use it in future devices. E Ink is a niche technology with some very real limitations, but it’s also got some huge advantages. What’s E Ink? E Ink is a display technology that’s fundamentally different from LCD, OLED, and other display technologies. It works by using electricity to set tiny capsules of pigment to show or hide. The result is a surface that works more or less like traditional ink on paper, hence the name. Since an E Ink screen only uses power when the screen is being rewritten, it’s great for applications in which the display doesn’t update very often. Most people know E Ink displays from e-readers like Amazon’s Kindle and Rakuten’s Kobo. These devices can have very long battery lives because they’re generally only using battery power when you turn the page. E Ink crops up in a few other locations, too. There’s a lot of digital signage (think price tags on supermarket shelves) that’s starting to use E Ink–another case where the text remains fixed most of the time, so there’s very little power draw. (My favorite E Ink project may be this one that resembles a flattened original Mac.) I like E Ink because it’s easier on the eye and feels natural in natural light. However, the technology has lots of liabilities that have led to it not being used widely. For starters, it doesn’t emit light. In sunlight, E Ink screens are beyond reproach, but in darkness, they’re unreadable. (To compensate, most e-readers now come with a built-in ring of LED lights around the screen.) E Ink Gallery 3 was introduced in April, offering an improved color gamut and fast refresh rates, but it’s still too slow for multimedia.E Ink Worse is the slow refresh rates of E Ink screens. The refresh rate has increased over time–on state-of-the-art displays, it’s now 350 milliseconds–but it’s nothing like the ultra-fast refresh rates of computer displays. That means it’s inappropriate for animation, video, and pretty much any interface designed for quick animations. (Last year I reviewed an E Ink Android tablet and trying to use the Android interface at such a low refresh rate was painful.) E Ink displays also don’t offer the ultra-high resolutions of modern Apple displays. And while E Ink displays have begun to support color (after years of only supporting shades of gray), the quality is only now getting up to par, and the refresh rates are still quite slow. Where Apple might use E Ink According to Kuo, Apple is testing E Ink “for future foldable device’s cover screen & tablet-like applications.” It makes sense. Foldable devices generally fold inward to protect their displays–leaving an outer surface devoid of information. To counteract that, phone-makers have been adding supplementary “outer screens” to do things like display the time and basic information widgets while others have full-sized OLED displays that obviously use lots of battery life. Due to its ultra-low-power profile, an E Ink display would be a pretty good fit for a cover display. (Think of how the always-on Apple Watch display has a low-power mode that doesn’t update the display very often, making things like second hands disappear in order to save power.) With a color E Ink external display, Apple could display the time, notifications, and even widgets on a device’s outer screen. But auxiliary E Ink displays aren’t necessarily just for foldable phones. Consider a future MacBook that included a low-power E Ink screen on the outside so that you could see notifications and other basic status information without opening it. Imagine a new version of the iPad Smart Cover, but with E Ink that would display the time, notifications, and widgets, while protecting the iPad during transport. E Ink technology might also allow the creation of some interesting accessories, especially when coupled with something like the Smart Connector port on the iPad, which can transfer data and supply power. For example, imagine an iPad smart cover that included an E Ink Display (shoutout to reader Adam L. for this idea), to display widgets, status information, and maybe even static displays from apps, all of which would be visible even in bright sunlight. Alternately, how about an iPhone case that included an E Ink display on the back for status widgets? E Ink is probably never going to be a mainstream display technology. The OLEDs and LED/LCD displays of the world provide high resolutions and refresh rates that can’t be beaten. But there are many niches that E Ink can serve well. I’d love to see Apple deploy E Ink’s unique characteristics in some creative ways. iPhone

Read more »

Crime blotter: Federal indictment for Charlotte phone store owners
In the latest Apple Crime Blotter, an iPhone theft video goes viral, Find My iPhone helps bust a car theft ring, and an iPhone seller is threatened with a knife.Apple Store in Oakbrook, Ill. The latest in an occasional AppleInsider series, looking at the world of Apple-related crime. Read more...

Read more »

WhatsApp to drop support for iOS 10 and iOS 11 devices, here are the iPhones affected
WhatsApp is finally planning to drop support to a few more iOS devices soon, as the company will no longer work with iPhones running iOS 10 and iOS 11 starting later this year. Here’s what you need to know. more… The post appeared first on 9to5Mac.

Read more »

Apple Music raises prices for Student plan in multiple countries
Apple is increasing the cost of Apple Music subscriptions for students in a number of countries, with the price rising by a small amount for the steeply-discounted version.Apple Music is offered to college students at a lower rate than the usual plan pricing around the world. However, for some territories, students are being warned that the price of the service will go up a little.Emails are being sent out to Student subscription users in a number of countries, advising of an upcoming change to the cost of subscription. In one email received by Twitter user "Nikhil," their $1.49 subscription is going up in price to $1.99 from June 20. Read more...

Read more »

Apple opens new store in Wuhan, brings dedicated product pickup area
This Saturday, Apple opened a new store in Wuhan, China – the first in the Hubei Province. It also inaugurates an exclusive pickup area never seen before in the country, which will allow customers to more easily pick up products ordered online. more… The post appeared first on 9to5Mac.

Read more »

The Pros and Cons of Sideloading Apps on iOS – Intego Mac Podcast Episode 240
Apple claims that they need the App Store to ensure that iOS devices are safe. The company claims that sideloading, or installing apps from other sources, is dangerous. Yet this is what we have always done on the Mac. We take a deep dive into the pros and cons of sideloading on iPhones and iPads. The post appeared first on The Mac Security Blog.

Read more »

Senators Urge FTC to Probe ID.me Over Selfie Data
Some of more tech-savvy Democrats in the U.S. Senate are asking the Federal Trade Commission (FTC) to investigate identity-proofing company ID.me for "deceptive statements" the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the Internal Revenue Service, which until recently required anyone seeking a new IRS account online to provide a live video selfie to ID.me.

Read more »

When Your Smart ID Card Reader Comes With Malware
Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder's appropriate security level. But many government employees aren't issued an approved card reader device that lets them use these cards at home or remotely, and so turn to low-cost readers they find online. What could go wrong? Here's one example.

Read more »

DEA Investigating Breach of Law Enforcement Data Portal
The U.S. Drug Enforcement Administration (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.

Read more »

Requiem for the iPod – Intego Mac Podcast Episode 239
Apple has discontinued the last iPod, the iPod touch. We discuss some of the history of the iPod, and look at 17 reasons who you should use an iPod touch. We also look at the new FIDO initiative, which allows your phone to replace passwords, and we discuss AirTag false alarms. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Patch Tuesday, May 2022 Edition
Microsoft today released updates to fix at least 74 separate security problems in its Windows operating systems and related software. This month's patch batch includes fixes for seven "critical" flaws, as well as a zero-day vulnerability that affects all supported versions of Windows.

Read more »

Vulnerability Summary for the Week of May 2, 2022
Original release date: May 9, 2022 | Last revised: May 11, 2022  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info N/A -- N/A   On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated 2022-05-05 7.5 CVE-2022-1388 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info livehelperchat -- live_helper_chat Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious JS on Application 🙂 2022-04-29 4.3 CVE-2022-1530 MISC CONFIRM mediawiki -- mediawiki The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. 2022-04-29 4.3 CVE-2022-29907 MISC MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info There were no low vulnerabilities recorded this week. Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info tecson_and_gok -- multiple_products   In multiple Tecson Tankspion and GOKs SmartBox 4 products the affected application doesn't properly restrict access to an endpoint that is responsible for saving settings, to a unauthenticated user with limited access rights. Based on the lack of adequately implemented access-control rules, by accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to change the application settings without authenticating at all, which violates originally laid ACL rules. 2022-05-06 not yet calculated CVE-2019-12254 CONFIRM piwigo -- piwigo   SQL Injection vulnerability in admin/group_list.php in piwigo v2.9.5, via the group parameter to delete. 2022-05-06 not yet calculated CVE-2020-19212 MISC piwigo -- piwigo   SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. 2022-05-06 not yet calculated CVE-2020-19213 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=user_perm. 2022-05-06 not yet calculated CVE-2020-19215 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/user_perm.php in piwigo v2.9.5, via the cat_false parameter to admin.php?page=group_perm. 2022-05-06 not yet calculated CVE-2020-19216 MISC piwigo -- piwigo   SQL Injection vulnerability in admin/batch_manager.php in piwigo v2.9.5, via the filter_category parameter to admin.php?page=batch_manager. 2022-05-06 not yet calculated CVE-2020-19217 MISC totolink -- n200re_andn100re_routers   A cross site scripting (XSS) vulnerability in the error page of Totolink N200RE and N100RE Routers 2.0 allows attackers to execute arbitrary web scripts or HTML via SCRIPT element. 2022-05-02 not yet calculated CVE-2020-23617 MISC MISC xtend -- voice_logger   A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page. 2022-05-02 not yet calculated CVE-2020-23618 MISC MISC orlansoft -- erp   The Java Remote Management Interface of all versions of Orlansoft ERP was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23620 MISC MISC MISC squire-technologies -- ms_management_system   The Java Remote Management Interface of all versions of SVI MS Management System was discovered to contain a vulnerability due to insecure deserialization of user-supplied content, which can allow attackers to execute arbitrary code via a crafted serialized Java object. 2022-05-02 not yet calculated CVE-2020-23621 MISC MISC MISC sonicwall -- global_vpn_client   SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system. 2022-05-04 not yet calculated CVE-2021-20051 CONFIRM fuchsia -- multiple_products   The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache invalidation operations on pages that they don’t own, allowing them to control kernel memory from userspace. We recommend upgrading to kernel version 4.1 or beyond. 2022-05-03 not yet calculated CVE-2021-22556 MISC MISC google -- idtoken   The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's payload comes from valid provider, not from someone else. An attacker can provide a compromised token with custom payload. The token will pass the validation on the client side. We recommend upgrading to version 1.33.3 or above 2022-05-03 not yet calculated CVE-2021-22573 MISC multiple_vendors -- multiple_products   NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-22680 CONFIRM topthink -- framework   The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class. 2022-05-06 not yet calculated CVE-2021-23592 CONFIRM CONFIRM CONFIRM twelvemonkeys -- twelvemonkeys   The package com.twelvemonkeys.imageio:imageio-metadata before 3.7.1 are vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered. 2022-05-06 not yet calculated CVE-2021-23792 CONFIRM CONFIRM wordpress -- tipsacarrier_wordpress_plugin   The Tipsacarrier WordPress plugin through 1.4.4.2 does not have any authorisation check in place some functions, which could allow unauthenticated users to access Orders data which could be used to retrieve the client full address, name and phone via tracking URL 2022-05-02 not yet calculated CVE-2021-25002 MISC wordpress -- advanced_page_visit_counter_wordpress_plugin   The Advanced Page Visit Counter WordPress plugin through 5.0.8 does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it 2022-05-02 not yet calculated CVE-2021-25086 MISC wordpress -- all_in_one_wp_security_&_firewall_wordpress_plugin   The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before using it to redirect user, either via a Location header, or meta url attribute, when the Rename Login Page is active, which could lead to an Arbitrary Redirect as well as Cross-Site Scripting issue. Exploitation of this issue requires the Login Page URL value to be known, which should be hard to guess, reducing the risk 2022-05-02 not yet calculated CVE-2021-25102 MISC sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25267 CONFIRM sophos -- firewall   Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA. 2022-05-05 not yet calculated CVE-2021-25268 CONFIRM kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25745 MISC MISC kubernetes -- ingress-nginx   A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster. 2022-05-06 not yet calculated CVE-2021-25746 MISC MISC splunk -- enterprise   A potential vulnerability in Splunk Enterprise's implementation of DUO MFA allows for bypassing the MFA verification in Splunk Enterprise versions before 8.1.6. The potential vulnerability impacts Splunk Enterprise instances configured to use DUO MFA and does not impact or affect a DUO product or service. 2022-05-06 not yet calculated CVE-2021-26253 MISC micriumos -- multiple_products   Micrium OS Versions 5.10.1 and prior are vulnerable to integer wrap-around in functions Mem_DynPoolCreate, Mem_DynPoolCreateHW and Mem_PoolCreate. This unverified memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as very small blocks of memory being allocated instead of very large ones. 2022-05-03 not yet calculated CVE-2021-27411 CONFIRM CONFIRM ecoscentric -- ecospro_rtos   eCosCentric eCosPro RTOS Versions 2.0.1 through 4.5.3 are vulnerable to integer wraparound in function calloc (an implementation of malloc). The unverified memory assignment can lead to arbitrary memory allocation, resulting in a heap-based buffer overflow. 2022-05-03 not yet calculated CVE-2021-27417 CONFIRM CONFIRM uclibc-ng -- uclibc-ng   uClibc-ng versions prior to 1.0.37 are vulnerable to integer wrap-around in functions malloc-simple. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27419 CONFIRM CONFIRM nxp -- mcuxpresso   NXP MCUXpresso SDK versions prior to 2.8.2 are vulnerable to integer overflow in SDK_Malloc function, which could allow to access memory locations outside the bounds of a specified array, leading to unexpected behavior such segmentation fault when assigning a particular block of memory from the heap via malloc. 2022-05-03 not yet calculated CVE-2021-27421 CONFIRM CONFIRM cesanta_software -- mongoose-os   Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27425 CONFIRM CONFIRM riot -- os   RIOT OS version 2020.01.1 is vulnerable to integer wrap-around in its implementation of calloc function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27427 CONFIRM CONFIRM arm -- cmsis_rtos2   ARM CMSIS RTOS2 versions prior to 2.1.3 are vulnerable to integer wrap-around inosRtxMemoryAlloc (local malloc equivalent) function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or injected code execution. 2022-05-03 not yet calculated CVE-2021-27431 CONFIRM arm -- mbed-ualloc   ARM mbed-ualloc memory library version 1.3.0 is vulnerable to integer wrap-around in function mbed_krbs, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27433 CONFIRM CONFIRM arm -- mbed-ualloc   ARM mbed product Version 6.3.0 is vulnerable to integer wrap-around in malloc_wrapper function, which can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27435 CONFIRM CONFIRM tencentos-tiny -- tencentos-tiny TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory allocation size. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution. 2022-05-03 not yet calculated CVE-2021-27439 CONFIRM hcl_software -- commerce   HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible. 2022-05-06 not yet calculated CVE-2021-27751 CONFIRM hcl_software -- bigfix_inventory   There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account. 2022-05-06 not yet calculated CVE-2021-27758 CONFIRM hcl_software -- bigfix_inventory    This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application. 2022-05-06 not yet calculated CVE-2021-27759 CONFIRM hcl_software -- notes   An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code. 2022-05-06 not yet calculated CVE-2021-27760 CONFIRM hcl_software -- weak_tls   Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks 2022-05-06 not yet calculated CVE-2021-27761 CONFIRM hcl_software -- bigfix_platform   Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses 2022-05-06 not yet calculated CVE-2021-27762 CONFIRM hcl_software -- hcl_software   Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI) 2022-05-06 not yet calculated CVE-2021-27764 CONFIRM hcl_software -- installshield   The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27765 CONFIRM hcl_software -- bigfix_client_installer   The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27766 CONFIRM hcl_software -- bigfix_console_installer   The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed. 2022-05-06 not yet calculated CVE-2021-27767 CONFIRM ibm -- maximo_asset_management   IBM Maximo Asset Management 7.6.1.1 and 7.6.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to inject HTTP HOST header, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 205680. 2022-05-03 not yet calculated CVE-2021-29854 CONFIRM XF ibm -- user_management_system_component   IBM ICP4A - User Management System Component (IBM Cloud Pak for Business Automation V21.0.3 through V21.0.3-IF008, V21.0.2 through V21.0.2-IF009, and V21.0.1 through V21.0.1-IF007) could allow a user with physical access to the system to perform unauthorized actions or obtain sensitive information due to insufficient validation and recvocation another user logouting out. IBM X-Force ID: 206081. 2022-05-02 not yet calculated CVE-2021-29859 CONFIRM XF splunk -- enterprise_indexer   A crafted request bypasses S2S TCP Token authentication writing arbitrary events to an index in Splunk Enterprise Indexer 8.1 versions before 8.1.5 and 8.2 versions before 8.2.1. The vulnerability impacts Indexers configured to use TCPTokens. It does not impact Universal Forwarders. 2022-05-06 not yet calculated CVE-2021-31559 MISC cyclos -- cyclos_4_pro   A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter. 2022-05-02 not yet calculated CVE-2021-31673 MISC MISC cyclos -- cyclos_4_pro   Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant. 2022-05-02 not yet calculated CVE-2021-31674 MISC MISC secomea -- multiple_products   Inadequate Encryption Strength vulnerability in TLS stack of Secomea SiteManager, LinkManager, GateManager may facilitate man in the middle attacks. This issue affects: Secomea SiteManager All versions prior to 9.7. Secomea LinkManager versions prior to 9.7. Secomea GateManager versions prior to 9.7. 2022-05-04 not yet calculated CVE-2021-32010 MISC splunk -- enterprise   The Splunk Enterprise REST API allows enumeration of usernames via the lockout error message. The potential vulnerability impacts Splunk Enterprise instances before 8.1.7 when configured to repress verbose login errors. 2022-05-06 not yet calculated CVE-2021-33845 MISC MISC red_hat -- sox   A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to input a malicious file, leading to the disclosure of sensitive information. 2022-05-02 not yet calculated CVE-2021-3643 MISC suse -- rancher   A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE Rancher allows administrators of third-party repositories to gather credentials that are sent to their servers. This issue affects: SUSE Rancher Rancher versions prior to 2.5.12; Rancher versions prior to 2.6.3. 2022-05-02 not yet calculated CVE-2021-36778 CONFIRM suse -- rancher   A Improper Privilege Management vulnerability in SUSE Rancher allows users with the restricted-admin role to escalate to full admin. This issue affects: SUSE Rancher Rancher versions prior to 2.5.13; Rancher versions prior to 2.6.4. 2022-05-02 not yet calculated CVE-2021-36784 CONFIRM wordpress -- mythemeshop_wp_subscribe_plugin   Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MyThemeShop WP Subscribe plugin

Read more »

Your Phone May Soon Replace Many of Your Passwords
Apple, Google and Microsoft announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.

Read more »

Apple AirTags: One Year On – Intego Mac Podcast Episode 238
Apple has provided some clarification to its plan to remove old and in the way apps from the App Store. Microsoft has been working on a VPN that isn't a VPN it works a little differently from Apple's VPN that isn't a VPN. And it's been a year since Apple released AirTags... It hasn't exactly been smooth sailing, but if third-party accessories are an indication, AirTags are doing pretty well. The post appeared first on The Mac Security Blog.

Read more »

Russia to Rent Tech-Savvy Prisoners to Corporate IT?
Faced with a brain drain of smart people fleeing the country following its invasion of Ukraine, the Russian Federation is floating a new strategy to address a worsening shortage of qualified information technology experts: Forcing tech-savvy people within the nation's prison population to perform low-cost IT work for domestic companies.

Read more »

17 Reasons Why You Should Use an iPod touch in 2022
You may think the iPod touch is an out-of-date technology, but there are lots of reasons why you might want to use one. The post appeared first on The Mac Security Blog.

Read more »

This wireless carrier is offering your choice of two free Apple iPhones if you switch
Choose between a free 2022 iPhone SE or an iPhone 12 if you open a new line of service at Verizon. Value of the phone you choose is spread over a 36 month period of Unlimited service. No trade-in is required to qualify for these deals. Full details... The post first appeared on MacPrices.net.

Read more »

Details of Apple’s 2022 iPad discounts for Education customers
Apple will take $100 off 12" M1 iPad Pros, $50-$100 off 11" M1 iPad Pros, $50 off iPad Airs, $50 off 8.3" iPad minis, & $20 off 10.2" iPads for all teachers, students, and staff of any educational institution with a .edu email address as part of their Apple Education discount, including parents of students. Stock varies depending on model and configuration, but shipping is free. Check out their range of discounts available on all iPad models: The post first appeared on MacPrices.net.

Read more »

Apple has a range of M1 and Intel-powered Mac minis in stock starting at only $589, Certified Refurbished
Apple has a full line of Certified Refurbished M1-powered as well as previous-generation Intel-based Mac minis back in stock today starting at only $589, Certified Refurbished. Models with varying amounts of RAM and storage are also available: The post first appeared on MacPrices.net.

Read more »

New Set Of Accessible Tools Designed To Help Users With Disabilities Coming Soon From Apple
NEWS: 05.19.22 – Apple’s software platforms are about to get even more useful for persons who are disabled. Earlier this week — days ahead of Global Accessibility Awareness Day (and weeks in advance of Apple’s annual worldwide developers conference in June) — Apple (via a press release) gave a preview of a new set of accessible tools coming later this year to its software platforms. […] The post first appeared on MacPrices.net.

Read more »

Apple restocks 13″ M1 MacBook Pros with 16GB of RAM for up to $350 off MSRP
Apple has standard-configuration 13" M1 MacBook Pros with 8GB of RAM and 256GB or 512GB SSDs available for $200-$230 off MSRP, Certified Refurbished. If 8GB of RAM is not enough for you, Apple has restocked several custom-configurations with 16GB of RAM and various amount of storage for up to $350 off the cost of new models. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell. The following models are available today: The post first appeared on MacPrices.net.

Read more »

24″ M1 iMacs with 8-Core CPU/8-Core GPU in stock and on sale for $1349, save $150
Amazon has 24" M1 iMacs (8-Core CPU/8-Core GPU/256GB SSD) on sale for $150 off MSRP for a limited time, only $1349. All colors currently qualify for the $150 discount, and their prices are the lowest available for these models from any Apple reseller. Shipping is free. Stock varies based on color (see their site for details), but some are in stock today. The post first appeared on MacPrices.net.

Read more »

M1 Mac mini with 512GB SSD on sale for $749, save $150
Amazon has the Apple M1 Mac mini with a 512GB SSD on sale for $749.99 including free shipping. Their price is $150 off Apple's MSRP, and it's the lowest price available for this configuration. Be sure to purchase from Amazon rather than a third-party seller. These are the same Mac minis sold by Apple in their retail and online stores. Delivery is expected by June 4th, depending on your location. The post first appeared on MacPrices.net.

Read more »

Apple’s 16″ M1 Pro MacBook Pro is on sale today for $2249 shipped, $250 off MSRP
Amazon has new 16" 10-Core/512GB M1 Pro MacBook Pros on sale for $250 off MSRP including free shipping, only $2249.99. Their prices are the lowest available for new M1 Pro 16" MacBook Pro from any Apple reseller. Be sure to purchase from Amazon rather than a third-party seller, and note that prices and availability may change at any moment. Neither color is in stock today, but you can still price your order at the discounted sale price... The post first appeared on MacPrices.net.

Read more »

Visible is again offering $200 back with the iPhone SE plus free Apple AirPods 3
Verizon's low-cost wireless cell service, Visible, is again offering a free $200 gift card plus a free set of Apple AirPods 3 with the purchase of a new 2022 iPhone SE & a new line of service. Gift cards are available from MasterCard or a host of retailers such as Amazon, Target, and others, and will be made available to customers after 3 months of service. Free overnight delivery is available on all new phones. The post first appeared on MacPrices.net.

Read more »

This wireless carrier is offering Apple AirPods Pro for 20% off MSRP
Verizon has Apple AirPods Pro on sale again for $199.99 on their online store. Their price is $50 (20%) off Apple's MSRP, and it's among the lowest prices currently available for AirPods Pro. Verizon service is not required for purchase. Buy online and choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price may vary. The post first appeared on MacPrices.net.

Read more »

Apple AirPods Max headphones are on sale today for $100 off MSRP
Tiger Direct has Apple AirPods Max (all colors) on sale today for $449 shipped. Their price is $100 (18%) off Apple's MSRP, and it's the lowest price currently available for AirPods Max from any of the Apple resellers we track. For the latest prices and sale, see our Apple AirPods Price Tracker, updated daily. We track prices from 23+ resellers. The post first appeared on MacPrices.net.

Read more »

Open-box 14″ M1 Pro MacBook Pros in stock today starting at only $1749
QuickShip Electronics has open-box return 14" M1 Pro MacBook Pros in stock and on sale for $250-$450 off MSRP on their eBay store today. According to QuickShip, "The item in this listing is an Open Box (packaging maybe slightly distressed). The unit powers on with factory settings restored and includes the original accessories." The following standard-configuration models are available: (1) 14" M1 Pro MacBook Pro (8-Core CPU/Space Gray): $1749 $250 off MSRP, (2) 14" M1 Pro MacBook Pro (10-Core CPU/Space Gray): $2049 $450 off MSRP, (3) 14" M1 Pro MacBook Pro (10-Core CPU/Silver): $2049 $450 off MSRP. The post first appeared on MacPrices.net.

Read more »