Apple could be planning to kill iTunes for Windows too
Windows users might not have to use iTunes much longer. Mac users were freed from this often-criticized multimedia software by macOS Catalina, but it lives on computers running Microsoft’s operating system. However, Apple seems to be staffing up to create a replacement for Windows too. Apple placed a job posting on LinkedIn for a Senior […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple releases Boot Camp Assistant drivers for 16-inch MacBo...
Apple today released new Boot Camp Assistant drivers for the 16-inch MacBook Pro. These drivers are required for installing and running Windows on Macs. more… The post Apple releases Boot Camp Assistant drivers for 16-inch MacBook Pro appeared first on 9to5Mac.

Read more »

Apple spent ‘billions’ on revamped Maps service
Apple, in response to questions from a U.S. congressional probe into tech antitrust matters, revealed it has invested billions of dollars in the revamped Maps app and corresponding service, a product designed to compete against segment stalwart Google Maps.

Read more »

‘The Morning Show’ producers say many of the negative re...
Early critic reviews of The Morning Show on Apple TV+ were widely negative, despite its star-studded cast. Speaking at the Recode Code Media conference today, producers of The Morning Show said that some of those reviews came from people “wanting Apple to fail.” more… The post ‘The Morning Show’ producers say many of the negative reviews came from ‘Apple haters’ appeared first on 9to5Mac.

Read more »

How to switch Disney+ plans or cancel before your free trial...
Have you tried out Disney’s new streaming service and decided it’s not for you? Or maybe you’ve realized you want a different plan? Read along for how to switch plans or cancel Disney+ before your free trial ends. more… The post How to switch Disney+ plans or cancel before your free trial ends appeared first on 9to5Mac.

Read more »

Apple working on new media apps for Windows
A recent job listing reveals Apple is looking to grow its presence on Windows with new media-centric apps, potentially hinting at plans to expand beyond the company's current iTunes and iCloud offerings.

Read more »

Porsche CEO talks iPhone vs Android popularity among owners ...
Speaking today at the Automobility conference in Los Angeles, Porsche’s North American president and CEO, Klaus Zellmer, touched on the popularity of iPhone and Android among Porsche owners. Zellmer also explained how those statistics affect development of Porsche features. more… The post Porsche CEO talks iPhone vs Android popularity among owners in the United States and China appeared first on 9to5Mac.

Read more »

The meaning of life, according to Tim Cook
Apple CEO Tim Cook sat down with Salesforce co-CEO Marc Benioff for his company’s Dreamforce conference this afternoon but instead of diving into Apple’s boring enterprise efforts, Cook was ready to discuss heavier topics. Sitting in the Yerba Buena Center for the Arts where Apple revealed some of its biggest product updates before Apple Park […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple AirPods Pro are on sale, but time is already running o...
Apple AirPods Pro, a hot gift this holiday season, are on sale right now at Amazon, but time is running out for delivery by Christmas. Find out how to snap up a $15 discount and secure your spot in line today.

Read more »

Apple job listing suggests new media apps are coming for Win...
Apple has already some softwares for Windows, such as iTunes and the iCloud Utility. But it may be that even more apps from Apple will be released soon for the Microsoft platform. First spotted by Neowin, Apple is looking for engineers to “build the next generation of media apps for Windows.” more… The post Apple job listing suggests new media apps are coming for Windows appeared first on 9to5Mac.

Read more »

Tim Cook talks Apple values, Steve Jobs, more at Salesforce ...
Apple CEO Tim Cook took part in a fireside chat with Salesforce co-CEO Marc Benioff at the latter's annual Dreamforce conference on Tuesday, where the pair discussed a range of well-trod topics ranging from Apple's values to human rights issues.

Read more »

DEVONthink 3.0.2
Surprisingly significant update to the recently upgraded information management app with numerous additions, improvements, and bug fixes. ($99/$199/$499 new, upgrades available, 100.3 MB)

Read more »

Tim Cook talks Steve Jobs, ‘Think Different’ philosophy,...
Apple CEO Tim Cook was in attendance at the Salesforce Dreamforce conference in San Francisco this afternoon, and he sat down with Salesforce co-CEO Marc Benioff for a fireside chat interview. The interview just wrapped up, but if you weren’t able to tune in, here’s what Cook had to say. more… The post Tim Cook talks Steve Jobs, ‘Think Different’ philosophy, and more during Salesforce interview appeared first on 9to5Mac.

Read more »

Apple falls in true wireless hearables market, but it still ...
AirPods have become the favorite truly wireless earphones for many people, and this has put the product in the top-selling position in its category. According to a new report from Counterpoint Research, Apple’s AirPods still leads the wireless hearables segment, but the company has lost some space in the market with the competition steadily increasing. more… The post Apple falls in true wireless hearables market, but it still leads the segment appeared first on 9to5Mac.

Read more »

Amazon Music Opens Ad-Supported Free Tier for iOS Users
Amazon is now offering an ad-supported free tier of its music service—which was previously exclusive to users of Amazon Echo devices—to iOS, Android, Fire TV, and Web users.Read original article

Read more »

Apple TV+ Review: ‘The Elephant Queen’ – Beautifully P...
The Elephant Queen is one of the best Nature stories you will ever watch. John gives it a 10 out of 10.

Read more »

Apple proposes VR glove that lets you feel virtual textures
Apple engineers laid the groundwork for a pair of gloves that would let users feel objects displayed by virtual reality or augmented reality. The idea of gloves with haptic feedback isn’t new, but a newly-received patent shows Apple continues to put considerable research and development effort into cutting-edge VR and AR. The company today was […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Get $5 Off this Charging Station for Apple Watch and iPhone
Recently snagged an Apple Watch from a Black Friday sale and need a minimalist, yet stylish dock to charge them both? Lamicall’s 2 in 1 Charging Station Dock can fill… The post appeared first on iLounge.

Read more »

WWDC App Updated with New Name and Content
Apple has recently changed the name of its WWDC app to ‘Apple Developer’ and promises to update content regularly. The new Apple Developer app’s description has been updated to reflect… The post appeared first on iLounge.

Read more »

Apple Sends Out Invites for ‘Favorite Games & Apps of ...
Apple has begun sending invites for a surprise media event, which will honor the best games and apps for the year. It’s set to go live on December 2, 4pm… The post Apple Sends Out Invites for ‘Favorite Games & Apps of 2019’ Event appeared first on iLounge.

Read more »

Amazon Now Offering Free, Ad-Supported Music on iOS
In a bid to become the top streaming music service in the market, Amazon is now offering a new, ad-supported tier on its Amazon Music for the iOS platform. This… The post appeared first on iLounge.

Read more »

Initial ‘The Morning Show’ reviews were ‘a...
Executive producers of Apple TV+ original series "The Morning Show" on Tuesday said early feedback from reviewers was less of a commentary on the content as it was a knock against Apple itself.

Read more »

Want a 16-inch MacBook Pro? Sell your old model for the best...
Apple’s long-awaited 16-inch MacBook Pro is on sale now, and it’s (almost) everything we hoped it would be. If you’re lusting after one, Cult of Mac’s buyback program can help make it more affordable. We pay great prices for used MacBook, MacBook Air, and MacBook Pro units — and we make the whole process quick and […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Condé Nast CEO says the ‘jury is out’ on whether Apple ...
At Recode’s Code Media conference today, Condé Nast CEO Roger Lynch touched on what he is seeing in terms of the early response Apple News+. This follows a report from last week that suggested Apple News+ has struggled to add new subscribers since its debut in March. more… The post Condé Nast CEO says the ‘jury is out’ on whether Apple News+ will be successful appeared first on 9to5Mac.

Read more »

Now live: Watch Tim Cook chat with Marc Benioff at Salesforc...
The Salesforce Dreamforce conference is hosting a fireside chat interview with Apple CEO Tim Cook and Salesforce co-CEO Marc Benioff … more… The post Now live: Watch Tim Cook chat with Marc Benioff at Salesforce conference appeared first on 9to5Mac.

Read more »

[Update: Now live] City of Cupertino launching on-demand pub...
The City of Cupertino is launching a new on-demand public transportation option later this month that will cover the entire city and offer affordable rides that users can grab via an iOS or Android app. more… The post [Update: Now live] City of Cupertino launching on-demand public transport, available for all Apple employees appeared first on 9to5Mac.

Read more »

Chicago students with iPhones tell their stories of a city i...
The city of Chicago is full of narratives but one of its richest is often skewed by headlines of poverty and violence. The neighborhood of North Lawndale is a story of rebirth and some of its young residents are sharing that story one iPhone photo at a time. Apple recently partnered with the non-profit organization […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Massive Android flaw left Camera app vulnerable to hijackers
Security researchers revealed a huge vulnerability in Google’s Android operating system that could have allowed hackers to access users’ photos and camera without their knowledge. The camera app vulnerability was potentially on hundreds of millions of Android phones and tablets. Tech security firm Checkmarx highlighted the dangers of the flaw by creating a proof-of-concept weather […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Initial 16-inch MacBook Pro thermal and graphics tests highl...
While much of the attention directed at the 16-inch MacBook Pro has revolved around the return to the scissor switch Magic Keyboard and slightly larger screen, other upgrades include new graphics cards and an updated thermal system. Follow along for an initial look at how the 16-inch performs compared to the 15-inch MacBook Pro when it comes to gaming, video rendering, and a 30-minute stress test at 99 degrees Celcius. more… The post Initial 16-inch MacBook Pro thermal and graphics tests highlight performance gains [Video] appeared first on 9to5Mac.

Read more »

How to highlight text and add post-its in Safari
Highlighter for Safari lets you virtually highlight words on a web page. Those highlights stick around, coming back ever time you visit the page. You can even add sticky notes. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Ransomware Bites 400 Veterinary Hospitals
National Veterinary Associates (NVA), a California company that owns more than 700 animal care facilities around the globe, is still working to recover from a ransomware attack late last month that affected more than half of those properties, separating many veterinary practices from their patient records, payment systems and practice management software. NVA says it expects to have all facilities fully back up and running normally within the next week.

Read more »

Why Were the Russians So Set Against This Hacker Being Extra...
The Russian government has for the past four years been fighting to keep 29-year-old alleged cybercriminal Alexei Burkov from being extradited by Israel to the United States. When Israeli authorities turned down requests to send him back to Russia -- supposedly to face separate hacking charges there -- the Russians then imprisoned an Israeli woman for seven years on trumped-up drug charges in a bid to trade prisoners. That effort failed as well, and Burkov had his first appearance in a U.S. court last week. What follows are some clues that might explain why the Russians are so eager to reclaim this young man.

Read more »

Orcus RAT Author Charged in Malware Scheme
In July 2016, KrebsOnSecurity published a story identifying a Toronto man as the author of the Orcus RAT, a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. This week, Canadian authorities criminally charged him with orchestrating an international malware scheme.

Read more »

Patch Tuesday, November 2019 Edition
Microsoft today released updates to plug security holes in its software, including patches to fix at least 74 weaknesses in various flavors of Windows and in software that runs on top of it. The November updates include patches for a zero-day flaw in Internet Explorer that is currently being exploited in the wild, as well as a sneaky bug in certain versions of Office for Mac that bypasses security protections and was detailed publicly prior to today's patches.

Read more »

Retailer Orvis.com Leaked Hundreds of Internal Passwords on ...
Orvis, a Vermont-based retailer that specializes in high-end fly fishing equipment and other sporting goods, leaked hundreds of internal passwords on Pastebin.com for several weeks last month, exposing credentials the company used to manage everything from firewalls and routers to administrator accounts and database servers, KrebsOnSecurity has learned. Orvis says the exposure was inadvertent, and that many of the credentials were already expired.

Read more »

Vulnerability Summary for the Week of November 4, 2019
Original release date: November 11, 2019 | Last revised: November 12, 2019The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info apache -- struts Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. 2019-11-01 7.5 CVE-2011-3923MISCEXPLOIT-DBBIDMISCMISCXFMISC aruba_networks -- clearpass_policy_manager Aruba ClearPass Policy Manager before 6.5.7 and 6.6.x before 6.6.2 allows attackers to obtain database credentials. 2019-11-06 10 CVE-2016-4401CONFIRM clamav -- clamav There is a possible heap overflow in libclamav/fsg.c before 0.100.0. 2019-11-06 7.5 CVE-2007-0899MISC computing_for_good -- basic_laboratory_information_system Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.4 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may change the password of any administrator-level user. 2019-11-06 7.5 CVE-2019-5617MISC computing_for_good -- basic_laboratory_information_system   Computing For Good's Basic Laboratory Information System (also known as C4G BLIS) version 3.5 and earlier suffers from an instance of CWE-284, "Improper Access Control." As a result, an unauthenticated user may alter several facets of a user account, including promoting any user to an administrator. 2019-11-06 7.5 CVE-2019-5644MISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview 2019-11-04 7.5 CVE-2013-2259MISCMISCMISC cryptocat_project -- cryptocat Cryptocat before 2.0.22 has Remote Script Injection due to improperly sanitizing user input 2019-11-04 7.5 CVE-2013-4103MISCMISCMISCMISCMISC gri -- gri gri before 2.12.18 generates temporary files in an insecure way. 2019-11-08 7.5 CVE-2008-7291MISC isl_internet_sicherheitslösungen -- arp_guard A SQL injection vulnerability in a /login/forgot1 POST request in ARP-GUARD 4.0.0-5 allows unauthenticated remote attackers to execute arbitrary SQL commands via the user_id parameter. 2019-11-04 7.5 CVE-2019-18663MISC linux -- linux_kernel A memory leak in the sof_dfsentry_write() function in sound/soc/sof/debug.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-c0a333d842ef. 2019-11-07 7.8 CVE-2019-18812MISC linux -- linux_kernel A vulnerability exists in kernel/time/clocksource.c in the Linux kernel before 2.6.33 where on non-GENERIC_TIME systems (GENERIC_TIME=n), accessing /sys/devices/system/clocksource/clocksource0/current_clocksource results in an OOPS. 2019-11-07 7.8 CVE-2010-2243MISCCONFIRMMISCMLIST linux -- linux_kernel An issue was discovered in the Linux kernel through 5.3.9. There is a use-after-free when aa_label_parse() fails in aa_audit_rule_init() in security/apparmor/audit.c. 2019-11-07 7.5 CVE-2019-18814MISC linux -- linux_kernel A memory leak in the dwc3_pci_probe() function in drivers/usb/dwc3/dwc3-pci.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering platform_device_add_properties() failures, aka CID-9bbfceea12a8. 2019-11-07 7.8 CVE-2019-18813MISC linux -- linux_kernel An issue was discovered in the Linux kernel 4.4.x before 4.4.195. There is a NULL pointer dereference in rds_tcp_kill_sock() in net/rds/tcp.c that will cause denial of service, aka CID-91573ae4aed0. 2019-11-04 7.8 CVE-2019-18680MISCMISCMISCMISC linux -- linux_kernel An issue was discovered in net/ipv4/sysctl_net_ipv4.c in the Linux kernel before 5.0.11. There is a net/ipv4/tcp_input.c signed integer overflow in tcp_ack_update_rtt() when userspace writes a very large integer to /proc/sys/net/ipv4/tcp_min_rtt_wlen, leading to a denial of service or possibly unspecified other impact, aka CID-19fad20d15a6. 2019-11-07 7.5 CVE-2019-18805MISCMISC linux -- linux_kernel A memory leak in the komeda_wb_connector_add() function in drivers/gpu/drm/arm/display/komeda/komeda_wb_connector.c in the Linux kernel before 5.3.8 allows attackers to cause a denial of service (memory consumption) by triggering drm_writeback_connector_init() failures, aka CID-a0ecd6fdbf5d. 2019-11-07 7.8 CVE-2019-18810MISCMISC linux -- linux_kernel A memory leak in the af9005_identify_state() function in drivers/media/usb/dvb-usb/af9005.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption), aka CID-2289adbfa559. 2019-11-07 7.8 CVE-2019-18809MISC linux -- linux_kernel A memory leak in the sof_set_get_large_ctrl_data() function in sound/soc/sof/ipc.c in the Linux kernel through 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering sof_get_ctrl_copy_params() failures, aka CID-45c1380358b1. 2019-11-07 7.8 CVE-2019-18811MISC linux-vserver -- linux-vserver linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code. 2019-11-06 10 CVE-2006-4243MISC magento -- magento A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods. 2019-11-06 7.5 CVE-2019-8144MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection. 2019-11-06 9 CVE-2019-8159MISC magento -- magento An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities. 2019-11-05 7.5 CVE-2019-8121MISC magento -- magento An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component. 2019-11-06 7.5 CVE-2019-8136MISC magento -- magento An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. 2019-11-06 7.5 CVE-2019-8158MISC magento -- magento A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. 2019-11-06 7.5 CVE-2019-8135MISC minidlna -- minidlna MiniDLNA has heap-based buffer overflow 2019-11-01 7.5 CVE-2013-2739MISCMISC minidlna -- minidlna minidlna has SQL Injection that may allow retrieval of arbitrary files 2019-11-01 7.5 CVE-2013-2738MISCMISCMISCMISC nvu -- nvu Nvu 0.99+1.0pre uses an old copy of Mozilla XPCOM which can result in multiple security issues. 2019-11-05 7.5 CVE-2005-2354MISCMISCMISC php-gettext -- php-gettext The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. 2019-11-04 7.5 CVE-2015-8980SUSEMLISTMLISTBIDCONFIRMCONFIRMCONFIRM portainer -- portainer Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4). 2019-11-07 9 CVE-2019-16872MISC python_sofware_foundation_and_beanbag -- djblets_and_review_board An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. 2019-11-04 7.5 CVE-2013-4409MISCMISCMISCMISCMISCMISCMISCMISCMISCMISC qualcomm -- multiple_products Use after free issue in kernel while accessing freed mdlog session info and its attributes after closing the session in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 675, SD 730, SD 820, SD 820A, SD 835, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10528CONFIRM qualcomm -- multiple_products Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10533CONFIRM qualcomm -- multiple_products Out of bound access while processing a non-standard IE measurement request with length crossing past the size of frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 7.5 CVE-2019-10505CONFIRM qualcomm -- multiple_products While playing the clip which is nonstandard buffer overflow can occur while parsing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 7.5 CVE-2019-10522CONFIRM qualcomm -- multiple_products While processing vendor command which contains corrupted channel count, an integer overflow occurs and finally will lead to heap overflow. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8976, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM8150 2019-11-06 7.5 CVE-2019-2302CONFIRM qualcomm -- multiple_products Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20 2019-11-06 7.5 CVE-2019-10542CONFIRM qualcomm -- multiple_products Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909, MSM8909W, QCN7605, QCS405, QCS605, SDM845, SDX24, SXR1130 2019-11-06 7.5 CVE-2019-10565CONFIRM qualcomm -- multiple_products Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10541CONFIRM qualcomm -- multiple_products Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W, MSM8996AU, QCA6574AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20 2019-11-06 10 CVE-2019-10534CONFIRM qualcomm -- multiple_products Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439 2019-11-06 10 CVE-2019-10531CONFIRM qualcomm -- multiple_products Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 9.3 CVE-2019-10529CONFIRM qualcomm -- multiple_products Kernel can do a memory read from arbitrary address passed by user during execution of a syscall in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9205, MDM9650, QCA8081, QCS605, SD 427, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2249CONFIRM qualcomm -- multiple_products Improper validation of read and write index of tx and rx fifo`s before calculating pointer can lead to out-of-bound access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2283CONFIRM qualcomm -- multiple_products Improper validation of array index causes OOB write and then leads to memory corruption in MMCP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2258CONFIRM qualcomm -- multiple_products Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574, QCS605, Qualcomm 215, SD 425, SD 427, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 2019-11-06 7.2 CVE-2019-2246CONFIRM qualcomm -- multiple_products When ADSP is compromised, the audio port index that`s returned from ADSP might be out of the valid range and leads to out of boundary access in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 845 / SD 850, SD 855, SDX20, SDX24 2019-11-06 10 CVE-2019-2324CONFIRM qualcomm -- multiple_products Out of boundary access due to token received from ADSP and is used without validation as an index into the array in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2325CONFIRM qualcomm -- multiple_products Out of bound write issue is observed while giving information about properties that have been set so far for playing video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 2019-11-06 10 CVE-2019-2285CONFIRM qualcomm -- multiple_products Memory corruption while accessing the memory as payload size is not validated before access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2332CONFIRM qualcomm -- multiple_products Lack of check to ensure crypto engine data passed by user is initialized can result in bus error in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2323CONFIRM qualcomm -- multiple_products Possible Integer overflow because of subtracting two integers without checking if the result would overflow or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24 2019-11-06 10 CVE-2019-2331CONFIRM quest -- kace_systems_management_appliance_server_center Quest KACE Systems Management Appliance Server Center version 9.1.317 is vulnerable to SQL injection. The affected file is software_library.php and affected parameters are order[0][column] and order[0][dir]. 2019-11-06 7.5 CVE-2019-12918MISCMISC rbot -- rbot Rbot Reaction plugin allows command execution 2019-11-06 7.5 CVE-2010-2446MISCMISC red_hat -- openshift cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. 2019-11-01 7.5 CVE-2013-0165MISC s9y -- serendipity Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager. 2019-11-05 7.5 CVE-2011-1134CONFIRMDEBIANSECTRACKMISC salesagility -- suitecrm SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection. 2019-11-06 7.5 CVE-2019-18784MISCMISC shadow_and_sudo -- shadow_and_sudo There is a possible tty hijacking in shadow 4.x before 4.1.5 and sudo 1.x before 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next process. 2019-11-04 7.2 CVE-2005-4890MISCMISCMISCMISCMISCMISCMISCMISCMISCMISCMISC sonatype  -- nexus_repository_manager There is an OS Command Injection in Nexus Repository Manager 2019-11-07 not yet calculated CVE-2019-12331CONFIRMMISC python_packaging_authority -- python_package_installer The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. 2019-11-05 not yet calculated CVE-2013-5123MISCMISCMISCMISCMISCMISCMISCMISC rapid7 -- metasploit_pro Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface. 2019-11-06 not yet calculated CVE-2019-5642CONFIRM red_hat -- 389_directory_server A flaw was found in the 'deref' plugin of 389-ds-base where it could use the 'search' permission to display attribute values. In some configurations, this could allow an authenticated attacker to view private attributes, such as password hashes. 2019-11-08 not yet calculated CVE-2019-14824CONFIRM red_hat -- enterprise_linux_5 frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, ...) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user. 2019-11-07 not yet calculated CVE-2008-3278MISCMISCMISC red_hat -- jboss_operations_network In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON. 2019-11-08 not yet calculated CVE-2008-5083MISCMISC red_hat -- tuned tuned before 2.x allows local users to kill running processes due to insecure permissions with tuned's ktune service. 2019-11-08 not yet calculated CVE-2013-1820MISCMISCMISC red_hat -- virtualization_manager In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform. 2019-11-09 not yet calculated CVE-2009-3552MISCMISCBUGTRAQ samba -- samba A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks. 2019-11-06 not yet calculated CVE-2019-14833SUSECONFIRMMISC samba -- samba A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user. 2019-11-06 not yet calculated CVE-2019-10218SUSECONFIRMMISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow injection of AT+CIMI and AT+CGSN over Bluetooth, leaking sensitive information such as IMSI, IMEI, call status, call setup stage, internet service status, signal strength, current roaming status, battery level, and call held status. 2019-11-06 not yet calculated CVE-2019-16401MISC samsung -- multiple_products Samsung Galaxy S8 plus (Android version: 8.0.0, Build Number: R16NW.G955USQU5CRG3, Baseband Vendor: Qualcomm Snapdragon 835, Baseband: G955USQU5CRG3), Samsung Galaxy S3 (Android version: 4.3, Build Number: JSS15J.I9300XXUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: I9300XXUGNA8), and Samsung Galaxy Note 2 (Android version: 4.3, Build Number: JSS15J.I9300XUGND5, Baseband Vendor: Samsung Exynos 4412, Baseband: N7100DDUFND1) devices allow attackers to send AT commands over Bluetooth, resulting in several Denial of Service (DoS) attacks. 2019-11-06 not yet calculated CVE-2019-16400MISC shibboleth -- shibboleth_service_provider The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default. 2019-11-07 not yet calculated CVE-2010-2450MISCMISCCONFIRM simplesamlphp -- simplesamlphp Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message. 2019-11-07 not yet calculated CVE-2019-3465MISCMLISTBUGTRAQMISCDEBIAN simplesamlphp -- simplesamlphp simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. 2019-11-06 not yet calculated CVE-2011-4625MISCMISC strapi -- strapi strapi before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. 2019-11-07 not yet calculated CVE-2019-18818MISCMISCMISC syscp -- syscp syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot. 2019-11-07 not yet calculated CVE-2010-2476MISCMISCMLIST tahoe-lafs -- tahoe-lafs Tahoe-LAFS 1.9.0 fails to ensure integrity which allows remote attackers to corrupt mutable files or directories upon retrieval. 2019-11-07 not yet calculated CVE-2012-0051MISCMISCMISCMISCMISCCONFIRM termpkg -- termpkg termpkg 3.3 suffers from buffer overflow. 2019-11-06 not yet calculated CVE-2006-3100MISCMISC tmaxsoft -- jeus JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file. 2019-11-08 not yet calculated CVE-2019-17327MISC veritas -- multiple_products An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Flex Appliance 1.2 and earlier, InfoScale 7.3.1 and earlier, InfoScale between 7.4.0 and 7.4.1, Veritas Cluster Server (VCS) 6.2.1 and earlier on Linux/UNIX, Veritas Cluster Server (VCS) 6.1 and earlier on Windows, Storage Foundation HA (SFHA) 6.2.1 and earlier on Linux/UNIX, and Storage Foundation HA (SFHA) 6.1 and earlier on Windows. 2019-11-05 not yet calculated CVE-2019-18780MISCMISCMISCMISC viber -- viber Viber through 11.7.0.5 allows a remote attacker who can capture a victim's internet traffic to steal their Viber account, because not all Viber protocol traffic is encrypted. TCP data packet 9 on port 4244 from the victim's device contains cleartext information such as the device model and OS version, IMSI, and 16 bytes of udid in a binary format, which is located at approximately offset 0x40 of this packet. Then, the attacker installs Viber on his device, initiates the registration process for any phone number, but doesn't enter a pin from SMS. Instead, he closes Viber. Next, the attacker rewrites his udid with the victim's udid, modifying the viber_udid file, which is located in the Viber preferences folder. (The udid is stored in a hexadecimal format.) Finally, the attacker starts Viber again and enters the pin from SMS. 2019-11-06 not yet calculated CVE-2019-18800MISC wolfssl -- wolfssl In wolfSSL 4.1.0 through 4.2.0c, there are missing sanity checks of memory accesses in parsing ASN.1 certificate data while handshaking. Specifically, there is a one-byte heap-based buffer overflow inside the DecodedCert structure in GetName in wolfcrypt/src/asn.c because the domain name location index is mishandled. Because a pointer is overwritten, there is an invalid free. 2019-11-09 not yet calculated CVE-2019-18840MISC wordpress -- wordpress A CSV injection in the codepress-admin-columns (aka Admin Columns) plugin 3.4.6 for WordPress allows malicious users to gain remote control of other computers. By choosing formula code as his first or last name, an attacker can create a user with a name that contains malicious code. Other users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC. 2019-11-08 not yet calculated CVE-2019-17661MISC zte -- mf910s_router Security researcher Shen Ying from the Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. 2019-11-07 not yet calculated CVE-2019-3422CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by the input validation vulnerability. An attacker could exploit this vulnerability for unauthorized operations. 2019-11-08 not yet calculated CVE-2019-3426CONFIRM zte -- zxupn-9000e The 9000EV5.0R1B12 version, and all earlier versions of ZTE product ZXUPN-9000E are impacted by vulnerability of permission and access control. An attacker could exploit this vulnerability to directly reset or change passwords of other accounts. 2019-11-08 not yet calculated CVE-2019-3425CONFIRM Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

Study: Ransomware, Data Breaches at Hospitals tied to Uptick...
Hospitals that have been hit by a data breach or ransomware attack can expect to see an increase in the death rate among heart patients in the following months or years because of cybersecurity remediation efforts, a new study posits. Health industry experts say the findings should prompt a larger review of how security -- or the lack thereof -- may be impacting patient outcomes.

Read more »

Researchers use lasers to hack Siri, Alexa, Google assistant...
Researchers have used programmable low-powered lasers to remotely control voice-activated personal assistants like Apple's Siri, Amazon's Alexa, and Google Assistant from up to 360 feet away. These attacks exploit a vulnerability in microphones using micro-electro-mechanical systems (MEMS), which the researchers have discovered will respond to lasers the same way they will respond to sound. The […]

Read more »

Apple updates its privacy page with sleek new look
A company’s privacy page usually reads like it was written by lawyers—because it usually is. Information is rarely presented in a way that laypeople can understand, and as for making it both easy to consume and easy on the eyes? Forget it. Apple’s new privacy page thinks different. It presents the company’s privacy info in plain […]

Read more »

iPad vs. MacBook: is iPadOS a game changer?
It took Apple more than nine years to recognize that the iPhone and iPad were different enough to warrant separate operating systems: iOS 13 and iPadOS 13. Now, with the changes in the new iPadOS, an iPad could replace a laptop for many people. iPadOS may really be a game changer for mobile computing. But just how effectively can an iPad replace a MacBook?

Read more »

Red Hat Security Advisory 2019-3513-01
- The glibc packages provide the standard C libraries, POSIX thread libraries, standard math libraries, and the name service cache daemon used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Read more »

13″ 2.4GHz MacBook Pros available for up to $300 off MSRP,...
Apple has a full line of Certified Refurbished 2019 13″ 2.4GHz 4-Core Touch Bar MacBook Pros available starting at $1529 and up to $300 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 2.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1699 $300 off MSRP – 13″ 2.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1699 $300 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

New at T-Mobile: Switch to T-Mobile, and get a free Apple iP...
T-Mobile is offering a free 64GB iPhone 8 for new customers who switch to T-Mobile and open a new line of service. Eligible trade-in required, and discount applied over a 24 month period. The fine print: “If you cancel your line before receiving 24 bill credits, you may owe up to $449.99 (iPhone 8 64GB); if canceling your account, you can contact us first to instead make discounted monthly balance payments. Tax on pre-credit price due at sale. Limited time offer; subject to change. Qualifying new line of service, finance agreement, & trade-in (iPhone 6, 6 Plus, 6s, 6s Plus, 5, 5s, SE) required. If you have canceled voice lines in past 90 days, reactivate them first. $10 SIM card, and, in stores & on customer service calls, $20 assisted or upgrade support charge may be required. 1 offer per account. Up to $450 via monthly bill credits; must be active and in good standing to receive credits; allow 2 bill cycles. May not be combinable with some offers or discounts (e.g., Carrier Freedom).” This deal is live today at → Read More...

Read more »

Xfinity Mobile’s Black Friday Apple savings: $250 off any ...
Take $250 off the purchase of any iPhone at Xfinity Mobile with a new line activation, and transfer of phone number to Xfinity Mobile, through December 8, 2019. This includes Apple’s new iPhone 11 family of smartphones as well as previous-generation models. The fine print: “Offer ends 12/8/19. Requires purchase of new, qualifying iPhone, Samsung or Google Pixel mobile phone while supplies last, 24 month Xfinity Mobile Device Payment Plan Agreement (“Device Agreement”), activation of new Xfinity Mobile line and transfer of phone number from another carrier within 30 days of phone purchase date. Device credits applied monthly to your account over 22-23 months so long as Device Agreement is in effect. If line is canceled, voluntarily or involuntarily or device payments are accelerated, balance of credits associated with device payment are forfeited. May not be combined with other offers. Not valid with prior purchases, returns or exchanges.” This deal is live today at → Read More...

Read more »

2019 13″ 1.4GHz MacBook Pros available starting at only $1...
Apple has a full line of Certified Refurbished 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros available starting at $1099 and up to $230 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/128GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1269 $230 off MSRP – 13″ 1.4GHz/128GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1269 $230 off MSRP Their prices are the cheapest available for 2019 13″ MacBook Pros anywhere. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Save up to $350 on a 21″ or 27″ iMac with these refurbis...
Apple has Certified Refurbished 2019 21″ & 27″ iMacs available starting at $929 and up to $350 off the cost of new models. Apple’s one-year warranty is standard, shipping is free, and each iMac features a new outer shell. The following standard configurations are available: – 27″ 6-Core 3.7GHz iMac (MRR12LL/A): $1949 $350 off MSRP – 27″ 6-Core 3.6GHz iMac (MRR02LL/A): $1699 $300 off MSRP – 27″ 6-Core 3.0GHz iMac (MRQY2LL/A): $1529 $270 off MSRP – 21″ 6-Core 3.0GHz iMac (MRT42LL/A): $1269 $230 off MSRP – 21″ 4-Core 3.6GHz iMac (MNDY2LL/A): $1099 $200 off MSRP – 21″ 2-Core 2.3GHz iMac (MMQA2LL/A): $929 $170 off MSRP Multiple configurations of custom iMacs are also available. Their prices are the cheapest available for 2019 iMacs anywhere. For more information, see our iMac Price Tracker, → Read More...

Read more »

Early Holiday 2019 Sale: B&H again offers 10.2″ iPads ...
B&H Photo has 10.2″ iPads on sale again for $30 off Apple’s MSRP, starting at $299, as part of their early Holiday 2019 sale. Overnight shipping is free to many addresses in the US: – 10.2″ 32GB WiFi iPads: $299 $30 off MSRP – 10.2″ 128GB WiFi iPads: $399 $30 off MSRP – 10.2″ 32GB WiFi + Cellular iPads: $429 $30 off MSRP – 10.2″ 128GB WiFi + Cellular iPads: $529 $30 off MSRP Keep an eye on our 10.2″ Apple iPad Price Tracker for the latest iPad sales and deals from Apple and → Read More...

Read more »

Apple iMacs on sale today at B&H Photo for up to $150 of...
B&H Photo has new 2019 21″ and 27″ 5K iMacs on stock today and on sale for up to $150 off Apple’s MSRP. Overnight shipping is free to many locations in the US. These are the same iMacs sold by Apple in their retail and online stores: – 27″ 3.0GHz 5K iMac: $1649 $150 off MSRP – 27″ 3.1GHz 5K iMac: $1849 $150 off MSRP – 27″ 3.7GHz 5K iMac: $2149 $150 off MSRP – 21″ 2.3GHz iMac (MMQA2LL/A): $1049.50 $50 off MSRP – 21″ 3.6GHz 4-Core 4K iMac (MRT32LL/A): $1199 $100 off MSRP – 21″ 3.0GHz 6-Core 4K iMac (MRT42LL/A): $1379 $120 off MSRP See our iMac Price Tracker for the latest sales and prices from Apple and → Read More...

Read more »

2018 4 and 6-Core Mac minis on sale today for $80-$100 off A...
Apple resellers are offering new 2018 4-Core and 6-Core Mac minis for $80-$100 off MSRP for a limited time. B&H Photo has the new 2018 4-Core and 6-Core Mac minis on sale for up to $100 off Apple’s standard MSRP. Overnight shipping is free to many US addresses: – 3.6GHz Quad-Core mini: $719 $80 off MSRP – 3.0GHz 6-Core mini: $999 $100 off MSRP Amazon also has Mac minis on sale for $80-$100 off MSRP. Shipping is free: – 3.6GHz Quad-Core mini: $719 $80 off MSRP – 3.0GHz 6-Core mini: $999 $100 off MSRP Keep an eye on our Mac mini Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Early Holiday 2019 sale at B&H Photo: 12.9″ iPads for ...
B&H Photo has new 12.9″ iPad Pros on sale for up to $120 off Apple’s MSRP as part of their early Holiday 2019 sale. Overnight shipping is free to many addresses in the US: – 12.9″ 64GB WiFi iPad Pro: $929 $70 off – 12.9″ 256GB WiFi iPad Pro: $1049 $100 off – 12.9″ 512GB WiFi iPad Pro: $1249 $100 off – 12.9″ 1TB WiFi iPad Pro: $1449 $100 off – 12.9″ 64GB WiFi + Cellular iPad Pro: $1049 $100 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1199 $100 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1379 $120 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1579 $120 off Keep an eye on our 12.9″ iPad Pro Price Tracker for the latest → Read More...

Read more »

8-Core iMac Pro on sale today for $4499 at B&H, $500 off...
B&H Photo has the base 8-Core 3.2GHz 32GB/1TB iMac Pro on sale today for $4499 — $500 off Apple’s MSRP. Shipping is free. Their price is the lowest available for a new iMac Pro from any Apple reseller: – 8-Core 3.2GHz 32GB/1TB iMac Pro: $4499 $500 off MSRP For the latest up-to-date prices, see our iMac Pro Price Tracker, → Read More...

Read more »

Sunday Sale: Amazon drops AirPod prices to a new low of $139...
Amazon is offering discounts on new 2019 Apple AirPods ranging up to $35 off MSRP. Overnight they dropped their price for the AirPods with Charging Case to a new low of only $139. That’s the lowest price we’ve seen, so far, for 2019 AirPods. Shipping is free: – AirPods Pro: $234.98 $15 off MSRP – AirPods with Wireless Charging Case: $164.99 $35 off MSRP – AirPods with Charging Case: $139 $20 off MSRP – Wireless Charging Case: $69 $10 off MSRP See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Weekend Sale: Apple AirPods Pro for $234.98 at Abt Electroni...
Abt Electronics has Apple’s new AirPods Pro in stock and on sale today for $234.98 including free shipping and free returns. Their price is $15 off Apple’s MSRP for these AirPods and tie Amazon & Sams Club as the lowest price available. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »