Apple warns against hydrogen peroxide as cleaning solution
Apple has recently updated its support document to mention that customers should not be using hydrogen peroxide to clean their Apple products. In the ... Read more The post appeared first on iLounge.

Read more »

The Apple AirPods Pro is only $189
If you already have an iPhone or iPad then an AirPods is a must-have. Today, you can get the official AirPods Pro for just ... Read more The post appeared first on iLounge.

Read more »

Fake iPhone parts smuggler caught and sentenced
An Orange County man has recently been charged for smuggling counterfeit iPhone and smartphone parts from China. He will spend two years in jail ... Read more The post appeared first on iLounge.

Read more »

Apple bags three daytime Emmy Awards
The prestigious Emmy Awards has just recently concluded, and Apple has taken home three Daytime Emmys in three separate categories. Apple has received the ... Read more The post appeared first on iLounge.

Read more »

Next iPhone might have always on display
This year’s iPhone may have significant improvements over its predecessor, including bigger batteries, better performance, less noticeable notches and an always-on screen. Mark Gurman ... Read more The post appeared first on iLounge.

Read more »

Set Up Your Work From Home Desk with Style and Function with the $40 Off Walker Edison Glass Desk
If you’re still searching for a sturdy and classy desk for your work from home setup, then look no further. Today, the Walker Edison ... Read more The post appeared first on iLounge.

Read more »

‘Ted Lasso’ stickers handed out ahead of Season Two
A few US Apple Stores are giving customers Ted Lasso stickers featuring the titular character as season two is getting ready for launch. ‘Ted ... Read more The post appeared first on iLounge.

Read more »

Fakespot App removed from App Store amid Amazon complaint
An app named Fakespot has been removed from the App Store after Amazon says it inaccurately identifies fake reviews and fraud sellers. The app ... Read more The post appeared first on iLounge.

Read more »

Pokemon GO Fest goes live
This year’s Pokemon GO Fest is happening as a global event, with trainers being able to take part in the celebration. The event starts ... Read more The post appeared first on iLounge.

Read more »

How to connect an Apple LED Cinema Display to a new MacBook
Apple rarely releases sales figures on particular models of products they offer, but I have to imagine they shipped at least hundreds of thousands of its two Apple LED Cinema Displays (24-inch, 2008 to 2010, and 27-inch, 2010 to 2013) based on the number of people who have reached out and want to connect them […]

Read more »

Jony Ive, Prince Charles partner on sustainable design competition
Former Apple design chief Jony Ive and Prince Charles on Friday announced the launch of a design competition that will give students from London's Royal College of Art a chance to explore and create solutions for a more sustainable future.Terra Carta Design Lab has invited 2,300 students, including alumni who graduated between 2011 and 2021, selected from the RCA's architecture, arts & humanities, communication, and design schools, reports Wallpaper. They will work together in multidisciplinary teams to "create small designs that can make a big impact for the world's transition to a sustainable future," a press release says.According to the lab's mission statement, participants will be able to investigate "local initiatives to restore biodiversity, reduce greenhouse gases, support developing countries, and catalyse a new economic and social model that realigns people with their environment." Read more...

Read more »

Apple adds communications chief Stella Low to leadership webpage
After announcing her hire in May, Apple on Friday updated its Leadership webpage to reflect the former Cisco executive's new role as VP of Communications.The updated webpage includes the customary Apple headshot, a rundown of Low's work history and a brief biography. In her new position, Low will report directly to CEO Tim Cook and is responsible for the company's worldwide communications strategy, public relations team and employee communications, Apple says.With 30 years in marketing and communications, Low previously worked for Cisco in a similar role and held positions at Dell and EMC. Read more...

Read more »

Sketchy rumor suggests iPhone 13 may support fast charging up to 25W
Even though Apple removed the power adapter from the iPhone box last year, many users still prefer to charge their devices using a USB adapter in order to get fast charging. Now according to a sketchy rumor coming from a Chinese website, the iPhone 13 lineup might support fast charging up to 25W. more… The post appeared first on 9to5Mac.

Read more »

Email from Ted Lasso invites Apple TV+ subscribers to watch new season
As part of an all-encompassing media blitz promoting the kickoff of "Ted Lasso" season two, Apple on Friday sent an email out to Apple TV+ subscribers that has the coach himself inviting viewers to tune in.From "Ted Lasso," the letter addresses users by their first name — Hey there (insert name) — and is penned using the titular character's signature down-home, folksy vernacular. One can almost hear actor Jason Sudeikis' Midwestern twang."My second season with AFC Richmond starts today, July 23rd, and I'd love it if you could watch our journey. More importantly, I want you to believe," the letter reads. A link to the series' Apple TV app page is included in the first line. Read more...

Read more »

9to5Rewards: Win an M1 MacBook Air + 20% off ALOGIC DX Docking Stations
There’s still time to enter to win Apple’s latest M1 MacBook Air courtesy of our friends at ALOGIC. For a limited time, you can also get 20% off the new ALOGIC USB-C Universal DX Docking Stations available in 65W and 100w models. more… The post appeared first on 9to5Mac.

Read more »

Teen AirDrops images of airsoft gun to passengers on United flight, plane evacuated
In what appears to be an ill-conceived prank, a teenager on a United Airlines flight out of San Francisco used Apple's AirDrop to send "inappropriate pictures" to fellow passengers, causing personnel to evacuate the plane.As recounted by Christopher J. Beale, who claims to have been on board the flight Thursday, an unnamed teen sent images of an airsoft gun to nearby iPhones via AirDrop, reports NBC's Bay Area affiliate.Bound for Orlando, United Airlines Flight 2167 was preparing to leave the gate when passengers reported the incident, said airport spokesperson Doug Yakel. Everyone aboard was forced to disembark and go through a second screening process "out of an abundance of caution," Yakel said. Read more...

Read more »

Apple stock expectations are once again high after recent boffo quarters
Analysts are mostly counting on Apple to deliver yet another quarter of double-digit earnings growth when the Cupertino Colossus reports… The post appeared first on MacDailyNews.

Read more »

The Speck Presidio Perfect Clear iPhone Case: Should You Be Protecting Your iPhone Lens?
Protect Your iPhone and its camera with the Speck Presidio Perfect Clear iPhone Case. This and more from Mac Geek Gab 879.

Read more »

iPhone: How to enable and disable iCloud Private Relay in iOS 15
One of the new security features arriving with iOS 15 brings a new level of privacy to web browsing beyond what VPNs offer. But while the feature boasts total encryption there is a potential downside with keeping it enabled. Here’s how to turn on/off iCloud Private Relay on iPhone and iPad in iOS 15. more… The post appeared first on 9to5Mac.

Read more »

Photos in iOS 15 can identify people by their upper bodies
Apple in a document published on Friday detailed how it has used machine learning advancements to introduce significantly improved people recognition in iOS 15, including in situations when a face isn't clearly visible.Credit: AppleThe company lists "improved recognition for individuals" as a new feature in the iOS 15 version of the Photos app, though the web page is sparse on details. However, a new blog post on Apple's machine learning site reveals that the Photos app is able to identify people in a variety of scenarios, including if their faces aren't clear to the camera. Read more...

Read more »

Tim Cook meets with Spanish Prime Minister Pedro Sanchez at Apple Park
Apple CEO Tim Cook recently met with Spanish Prime Minister Pedro Sanchez at Apple Park to discuss Spain's "digital transformation" and other topics.Credit: Pedro SanchezSanchez posted to Twitter on Friday that he had a "productive meeting" with Cook at Apple's headquarters in San Francisco. The prime minister of Spain also shared a photo of himself and Cook in an Apple Park hallway. Read more...

Read more »

Today in Apple history: Martin Scorsese ad makes Siri look like a superstar
July 23, 2012: Looking for the perfect spokesman for its new virtual assistant Siri, Apple turns to Martin Scorsese, the legendary filmmaker behind some of Hollywood’s most violent gangster movies. The new television commercial shows the director using Siri voice commands to juggle his busy schedule. One in a string of celebrity-studded Siri ads, it […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Tested: CASETiFY MagSafe Wallet delivers first-party form and function without the Apple tax
Apple’s MagSafe wallet entered last year as one of the more exciting iPhone 12 accessories, but was of course paired with a premium price tag to match. The folks at CASETiFY are now looking to deliver much of the same form factor but with a faux leather build that doesn’t skimp out on the quality. Now we’re taking a hands-on look at the new accessory to see if the trade-offs are worth the more affordable price tag. Head below for all of the details on the CASETiFY MagSafe Wallet in our latest Tested with 9to5Toys review. more… The post appeared first on 9to5Mac.

Read more »

9to5Mac Happy Hour 339: MagSafe battery pack hands-on, zero-click iPhone exploits, TV+ rumors
This week on 9to5Mac’s Happy Hour Zac and Benjamin discuss the practicalities and inconveniences of of the MagSafe Battery Pack, the fears surrounding the Pegasus zero-click malware affecting iPhones around the world, and some new possible new services initiatives include TV+ live sports and Apple Pay Later financing. Sponsored by She’s Birdie: Right now, She’s Birdie is offering our listeners 15% off your first purchase when you tgo to ShesBirdie.com/HAPPYHOUR. Sponsored by BetterHelp: As a listener, you’ll get 10% off your first month by visiting our sponsor at BetterHelp.com/MacHappyHour. Sponsored by TextExpander: Visit textexpander.com/podcast and select 9to5Mac Happy Hour to save 20% off your first kyear! more… The post appeared first on 9to5Mac.

Read more »

Apple reportedly working on successor to Pro Display XDR
Apple is testing a new display with a dedicated A13 chip and also Neural Engine which is is likely to be the successor to Pro Display XDR … The post appeared first on MacDailyNews.

Read more »

Scheduling Do Not Disturb for macOS
A Quick Tip from Mac Geek Gab 880: Scheduling Do Not Disturb can help re-enable it on macOS so you don't forget.

Read more »

Sanitize and charge devices with Accell’s wireless gadget
The new Accell Power UV Sanitizer with Wireless Charging promises to kill 99% of common germs and bacteria on your devices with UV light. And of course you can also use it to power them up. It’s hardly the first one to the sanitizing and charging party, but it sounds like a useful gadget nontheless. […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Tim Cook meets with prime minister of Spain at Apple Park
Apple CEO Tim Cook met with Pedro Sánchez, the prime minister of Spain, at Apple Park in Cupertino this week. The two discussed the “digital transformation” among other topics during the meeting, according to Sánchez. more… The post appeared first on 9to5Mac.

Read more »

Apple stops 'woozy face' emoji from appearing when 'stammer' is typed
Apple has issued an update that stops the "woozy face" emoji from appearing when users type in the word "stammer" into messaging apps on iOS, including iMessage.The Woozy face appearing when "stammer" is typed into Messages.Earlier in July, Stamma, the British Stammering Association, called out Apple for the gaffe, in which the "woozy face" would appear as a suggested emoji if users typed the word "stammer" into a first- or third-party messaging app on iOS. Read more...

Read more »

Facebook’s cloud gaming service finally launches on iPhone
Add Facebook to the list of companies offering a gaming service for iPhone. There’s a lengthy list of titles available on day one, including strategy, role playing, trivia and other types of games. But don’t look for these in the App Store — Apple’s stringent rules on gaming services caused Facebook Gaming to be introduced […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Spike in “Chain Gang” Destructive Attacks on ATMs
Last summer, financial institutions throughout Texas started reporting a sudden increase in attacks involving well-orchestrated teams that would show up at night, use stolen trucks and heavy chains to rip Automated Teller Machines (ATMs) out of their foundations, and make off with the cash boxes inside. Now it appears the crime -- known variously as "ATM smash-and-grab" and "chain gang" attacks -- is rapidly increasing in other states.

Read more »

Kaseya Left Customer Portal Vulnerable to 2015 Flaw in its Own Software
Last week cybercriminals deployed ransomware to 1,500 organizations that provide IT security and technical support to many other companies. The attackers exploited a vulnerability in software from Kaseya, a Miami-based company whose products help system administrators manage large networks remotely. Now it appears Kaseya's customer service portal was left vulnerable until last week to a data-leaking security flaw that was first identified in the same software six years ago.

Read more »

The Danger of Internet-Connected Devices – Intego Mac Podcast Episode 195
We take another look at Windows 11 system requirements, we discuss another strange wi-fi network name that can break iPhones, and we look closely at the issue of Western Digital network storage devices that have had data deleted by hackers. The post appeared first on The Mac Security Blog.

Read more »

Microsoft Issues Emergency Patch for Windows Flaw
Microsoft on Tuesday issued an emergency software update to quash a security bug that's been dubbed "PrintNightmare," a critical vulnerability in all supported versions of Windows that is actively being exploited. The fix comes a week ahead of Microsoft's normal monthly Patch Tuesday release, and follows the publishing of exploit code showing would-be attackers how to leverage the flaw to break into Windows computers.

Read more »

What to Do if You Have Western Digital My Book Live or My Book Live Duo Devices
If you have a Western Digital My Book Live or My Book Duo Live, your data is at risk. Here's what you need to do to protect it. The post appeared first on The Mac Security Blog.

Read more »

Shortcuts Are Coming to macOS – What Does This Mean, and How Secure Are They?
Shortcuts, an automation technology, will be added to macOS Monterey. Learn what this means, and learn about potential security risks with shortcuts. The post appeared first on The Mac Security Blog.

Read more »

Vulnerability Summary for the Week of June 28, 2021
Original release date: July 5, 2021  High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- after_effects Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction. 2021-06-28 9.3 CVE-2021-28570 MISC adobe -- after_effects After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2021-06-28 9.3 CVE-2021-28586 MISC adobe -- robohelp_server Adobe RoboHelp Server version 2019.0.9 (and earlier) is affected by a Path Traversal vulnerability when parsing a crafted HTTP POST request. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. 2021-06-28 9 CVE-2021-28588 MISC chamilo -- chamilo main/inc/ajax/model.ajax.php in Chamilo through 1.11.14 allows SQL Injection via the searchField, filters, or filters2 parameter. 2021-06-28 7.5 CVE-2021-34187 MISC MISC MISC MISC cnesty -- helpcom A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficient validation of the parameter. This issue affects: Cnesty Helpcom 10.0 versions prior to. 2021-06-29 7.5 CVE-2020-7871 MISC eclipse -- birt In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance. 2021-06-25 7.5 CVE-2021-34427 CONFIRM fatek -- winproladder FATEK Automation WinProladder Versions 3.30 and prior do not properly restrict operations within the bounds of a memory buffer, which may allow an attacker to execute arbitrary code. 2021-06-29 7.5 CVE-2021-32992 MISC fatek -- winproladder FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. 2021-06-29 7.5 CVE-2021-32988 MISC fatek -- winproladder FATEK Automation WinProladder Versions 3.30 and prior are vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. 2021-06-29 7.5 CVE-2021-32990 MISC fidelissecurity -- deception Vulnerability in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with user level access to the CLI to inject root level commands into the component and neighboring Fidelis components. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability. 2021-06-25 9 CVE-2021-35047 CONFIRM fidelissecurity -- deception Vulnerability in Fidelis Network and Deception CommandPost enables unauthenticated SQL injection through the web interface. The vulnerability could lead to exposure of authentication tokens in some versions of Fidelis software. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability. 2021-06-25 7.5 CVE-2021-35048 CONFIRM helpu -- helpu A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA function used for login. 2021-06-29 10 CVE-2020-7868 MISC huawei -- anyoffice There is a deserialization vulnerability in Huawei AnyOffice V200R006C10. An attacker can construct a specific request to exploit this vulnerability. Successfully exploiting this vulnerability, the attacker can execute remote malicious code injection and to control the device. 2021-06-29 9.3 CVE-2021-22439 MISC inkdrop -- inkdrop Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop. 2021-06-28 9.3 CVE-2021-20745 MISC MISC MISC mastersoft -- zook An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using "Tight file CMD" without authority. 2021-06-29 9 CVE-2020-7869 MISC mcafee -- mvision_edr A command injection vulnerability in MVISION EDR (MVEDR) prior to 3.4.0 allows an authenticated MVEDR administrator to trigger the EDR client to execute arbitrary commands through PowerShell using the EDR functionality 'execute reaction'. 2021-06-29 9 CVE-2021-31838 CONFIRM miniaudio_project -- miniaudio Miniaudio 0.10.35 has a Double free vulnerability that could cause a buffer overflow in ma_default_vfs_close__stdio in miniaudio.h. 2021-06-25 7.5 CVE-2021-34184 CONFIRM misp -- misp app/View/Elements/genericElements/IndexTable/Fields/generic_field.ctp in MISP 2.4.144 does not sanitize certain data related to generic-template:index. 2021-06-25 7.5 CVE-2021-35502 MISC narou_project -- narou Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel. 2021-06-28 7.5 CVE-2021-35514 MISC MISC naviwebs -- navigate_cms SQL Injection vulnerability in NavigateCMS 2.9 via the URL encoded GET input category in navigate.php. 2021-06-28 7.5 CVE-2020-23711 MISC online_pet_shop_web_application_project -- online_pet_shop_web_application Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload 2021-06-28 7.5 CVE-2021-35456 MISC MISC pandorafms -- pandora_fms PandoraFMS used. 2021-07-02 not yet calculated CVE-2021-36147 MISC project_acrn -- acrn-hypervisor   An issue was discovered in ACRN before 2.5. dmar_free_irte in hypervisor/arch/x86/vtd.c allows an irte_alloc_bitmap buffer overflow. 2021-07-02 not yet calculated CVE-2021-36148 MISC project_acrn -- acrn-hypervisor   The Device Model in ACRN through 2.5 has a devicemodel/core/mem.c use-after-free for a freed rb_entry. 2021-07-02 not yet calculated CVE-2021-36145 MISC project_acrn -- acrn-hypervisor   The polling timer handler in ACRN before 2.5 has a use-after-free for a freed virtio device, related to devicemodel/hw/pci/virtio/*.c. 2021-07-02 not yet calculated CVE-2021-36144 MISC qnap - qts_and_quts_hero A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217. 2021-07-01 not yet calculated CVE-2021-28804 CONFIRM qnap -- nas_devices   A stored XSS vulnerability has been reported to affect QNAP NAS running QuLog Center. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QuLog Center versions prior to 1.2.0. 2021-07-01 not yet calculated CVE-2020-36196 CONFIRM qnap -- nas_devices   An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3. 2021-07-01 not yet calculated CVE-2020-36194 CONFIRM qnap -- q'center This issue affects: QNAP Systems Inc. Q'center versions prior to 1.11.1004. 2021-07-01 not yet calculated CVE-2021-28803 CONFIRM qnap -- qts_and_quts_hero A command injection vulnerabilities have been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.1.1540 build 20210107. QNAP Systems Inc. QuTS hero versions prior to h4.5.1.1582 build 20210217. 2021-07-01 not yet calculated CVE-2021-28802 CONFIRM rarlab -- unrar   UnRAR 5.6.1.7 through 5.7.4 and 6.0.3 has an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext. 2021-07-01 not yet calculated CVE-2018-25018 MISC MISC MISC rarlab -- unrar   UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from Unpack::Unpack5 and CmdExtract::ExtractCurrentFile). 2021-07-01 not yet calculated CVE-2017-20006 MISC MISC MISC ratpack -- ratpack Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented. As of Ratpack 1.9.0, the default value is a securely randomly generated value, generated at application startup time. As a workaround, supply an alternative signing key, as per the documentation's recommendation. 2021-06-29 not yet calculated CVE-2021-29480 MISC CONFIRM ratpack -- ratpack Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production. 2021-06-29 not yet calculated CVE-2021-29479 MISC CONFIRM ratpack -- ratpack Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0, a securely randomly generated signing key is used. As a workaround, one may supply an encryption key, as per the documentation recommendation. 2021-06-29 not yet calculated CVE-2021-29481 MISC CONFIRM ratpack -- ratpack Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session mechanism, it is not vulnerable. Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used. Two possible workarounds exist. The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. Alternatively or additionally, the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list. 2021-06-29 not yet calculated CVE-2021-29485 MISC CONFIRM rawspeed -- rawspeed   RawSpeed (aka librawspeed) 3.1 has a heap-based buffer overflow in TableLookUp::setTable. 2021-07-01 not yet calculated CVE-2018-25017 MISC MISC MISC record-like-deep-assign -- record-like-deep-assign All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality. 2021-07-02 not yet calculated CVE-2021-23402 CONFIRM CONFIRM samtools -- htslib   HTSlib 1.10 through 1.10.2 allows out-of-bounds write access in vcf_parse_format (called from vcf_parse and vcf_read). 2021-07-01 not yet calculated CVE-2020-36403 MISC MISC MISC selinux_project -- selinux The CIL compiler in SELinux 3.2 has a use-after-free in cil_reset_classpermission (called from cil_reset_classperms_set and cil_reset_classperms_list). 2021-07-01 not yet calculated CVE-2021-36086 MISC MISC MISC selinux_project -- selinux The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __verify_map_perm_classperms and hashtab_map). 2021-07-01 not yet calculated CVE-2021-36085 MISC MISC MISC selinux_project -- selinux The CIL compiler in SELinux 3.2 has a use-after-free in __cil_verify_classperms (called from __cil_verify_classpermission and __cil_pre_verify_helper). 2021-07-01 not yet calculated CVE-2021-36084 MISC MISC MISC selinux_project -- selinux   The CIL compiler in SELinux 3.2 has a heap-based buffer over-read in ebitmap_match_any (called indirectly from cil_check_neverallow). NOTE: bad0a746e9f4cf260dedba5828d9645d50176aac is cited in the OSV "fixed" field but does not have a code change. 2021-07-01 not yet calculated CVE-2021-36087 MISC MISC MISC seromq -- libzmq   ZeroMQ libzmq 4.3.3 has a heap-based buffer overflow in zmq::tcp_read, a different vulnerability than CVE-2021-20235. 2021-07-01 not yet calculated CVE-2020-36400 MISC MISC MISC sita -- azurcms A SQL injection vulnerability in azurWebEngine in Sita AzurCMS through 1.2.3.12 allows an authenticated attacker to execute arbitrary SQL commands via the id parameter to mesdocs.ajax.php in azurWebEngine/eShop. By default, the query is executed as DBA. 2021-07-02 not yet calculated CVE-2021-27950 MISC MISC MISC MISC sloan -- smartfaucets   There exists an unauthenticated BLE Interface in Sloan SmartFaucets including Optima EAF, Optima ETF/EBF, BASYS EFX, and Flushometers including SOLIS. The vulnerability allows for unauthenticated kinetic effects and information disclosure on the faucets. It is possible to use the Bluetooth Low Energy (BLE) connectivity to read and write to many BLE characteristics on the device. Some of these control the flow of water, the sensitivity of the sensors, and information about maintenance. 2021-06-30 not yet calculated CVE-2021-20107 MISC sourcecodester -- phone_shop_sales_managements_system   Sourcecodester Phone Shop Sales Managements System 1.0 is vulnerable to Insecure Direct Object Reference (IDOR). Any attacker will be able to see the invoices of different users by changing the id parameter. 2021-07-01 not yet calculated CVE-2021-35337 MISC stellar -- js-stellar-sdk   js-stellar-sdk is a Javascript library for communicating with a Stellar Horizon server. The `Utils.readChallengeTx` function used in SEP-10 Stellar Web Authentication states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. In js-stellar-sdk before version 8.2.3, the function does not verify that the server has signed the transaction. Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction. Applications calling `Utils.readChallengeTx` should update to version 8.2.3, the first version with a patch for this vulnerability, to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction. 2021-07-02 not yet calculated CVE-2021-32738 CONFIRM MISC stormshield -- stormshield An issue was discovered in Stormshield SNS through 4.2.1. A brute-force attack can occur. 2021-07-01 not yet calculated CVE-2021-28127 MISC MISC sulu -- sulu   Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating. 2021-07-02 not yet calculated CVE-2021-32737 CONFIRM MISC suse -- linux_enterprise_server A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions. 2021-06-30 not yet calculated CVE-2021-25321 CONFIRM suse -- linux_enterprise_server   A Use of Password Hash Instead of Password for Authentication vulnerability in cryptctl of SUSE Linux Enterprise Server for SAP 12-SP5, SUSE Manager Server 4.0 allows attackers with access to the hashed password to use it without having to crack it. This issue affects: SUSE Linux Enterprise Server for SAP 12-SP5 cryptctl versions prior to 2.4. SUSE Manager Server 4.0 cryptctl versions prior to 2.4. 2021-06-30 not yet calculated CVE-2019-18906 CONFIRM symantec -- advanced_secure_gateway   The Symantec Advanced Secure Gateway (ASG) and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance. 2021-06-30 not yet calculated CVE-2021-30648 MISC synacor -- zimbra_collaboration_suite   An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9.0.0 Patch 16. The value of the X-Host header overwrites the value of the Host header in proxied requests. The value of X-Host header is not checked against the whitelist of hosts Zimbra is allowed to proxy to (the zimbraProxyAllowedDomains setting). 2021-07-02 not yet calculated CVE-2021-35209 MISC MISC MISC MISC synacor -- zimbra_collaboration_suite   An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. 2021-07-02 not yet calculated CVE-2021-35208 MISC MISC MISC MISC synacor -- zimbra_collaboration_suite   An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url. 2021-07-02 not yet calculated CVE-2021-35207 MISC MISC MISC MISC synacor -- zimbra_collaboration_suite   An open redirect vulnerability exists in the /preauth Servlet in Zimbra Collaboration Suite through 9.0. To exploit the vulnerability, an attacker would need to have obtained a valid zimbra auth token or a valid preauth token. Once the token is obtained, an attacker could redirect a user to any URL via isredirect=1&redirectURL= in conjunction with the token data (e.g., a valid authtoken= value). 2021-07-02 not yet calculated CVE-2021-34807 MISC MISC MISC MISC teachers_record_management_system -- teachers_record_managemet_system Multiple SQL Injection vulnerabilities in Teachers Record Management System 1.0 allow remote authenticated users to execute arbitrary SQL commands via the 'editid' GET parameter in edit-subjects-detail.php, edit-teacher-detail.php, or the 'searchdata' POST parameter in search.php. 2021-07-01 not yet calculated CVE-2021-28423 MISC MISC MISC MISC teachers_record_management_system -- teachers_record_managemet_system A stored cross-site scripting (XSS) vulnerability in Teachers Record Management System 1.0 allows remote authenticated users to inject arbitrary web script or HTML via the 'email' POST parameter in adminprofile.php. 2021-07-01 not yet calculated CVE-2021-28424 MISC MISC MISC MISC tensorflow -- tensorflow   ** DISPUTED ** TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extract=True. NOTE: the vendor's position is that tf.keras.utils.get_file is not intended for untrusted archives. 2021-06-30 not yet calculated CVE-2021-35958 MISC MISC MISC MISC MISC tesseract_ocr -- tesseract   Tesseract OCR 5.0.0-alpha-20201231 has a one_ell_conflict use-after-free during a strpbrk call. 2021-07-01 not yet calculated CVE-2021-36081 MISC MISC MISC think-js -- think-helper   think-helper defines a set of helper functions for ThinkJS. In versions of think-helper prior to 1.1.3, the software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The vulnerability is patched in version 1.1.3. 2021-06-30 not yet calculated CVE-2021-32736 CONFIRM tibco -- multiple products The Windows Installation component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contains a vulnerability that theoretically allows a low privileged attacker with local access on some versions of the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from a lack of access restrictions on certain files and/or folders in the installation. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0. 2021-06-29 not yet calculated CVE-2021-23275 CONFIRM CONFIRM tibco -- multiple products The TIBCO Spotfire Server and TIBCO Enterprise Runtime for R components of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Enterprise Runtime for R - Server Edition, TIBCO Spotfire Analytics Platform for AWS Marketplace, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Server, TIBCO Spotfire Statistics Services, TIBCO Spotfire Statistics Services, and TIBCO Spotfire Statistics Services contain a vulnerability that theoretically allows a low privileged attacker with local access on the Windows operating system to insert malicious software. The affected component can be abused to execute the malicious software inserted by the attacker with the elevated privileges of the component. This vulnerability results from the affected component searching for run-time artifacts outside of the installation hierarchy. Affected releases are TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition: versions 1.2.4 and below, TIBCO Enterprise Runtime for R - Server Edition: versions 1.3.0 and 1.3.1, TIBCO Enterprise Runtime for R - Server Edition: versions 1.4.0, 1.5.0, and 1.6.0, TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.3.0 and below, TIBCO Spotfire Server: versions 10.3.12 and below, TIBCO Spotfire Server: versions 10.4.0, 10.5.0, 10.6.0, 10.6.1, 10.7.0, 10.8.0, 10.8.1, 10.9.0, 10.10.0, 10.10.1, 10.10.2, 10.10.3, and 10.10.4, TIBCO Spotfire Server: versions 11.0.0, 11.1.0, 11.2.0, and 11.3.0, TIBCO Spotfire Statistics Services: versions 10.3.0 and below, TIBCO Spotfire Statistics Services: versions 10.10.0, 10.10.1, and 10.10.2, and TIBCO Spotfire Statistics Services: versions 11.1.0, 11.2.0, and 11.3.0. 2021-06-29 not yet calculated CVE-2021-28830 CONFIRM CONFIRM tieline -- ip_audio_gateway   Tieline IP Audio Gateway 2.6.4.8 and below is affected by Incorrect Access Control. A vulnerability in the Tieline Web Administrative Interface could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. 2021-07-01 not yet calculated CVE-2021-35336 MISC torproject -- tor   An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-006. The v3 onion service descriptor parsing allows out-of-bounds memory access, and a client crash, via a crafted onion service descriptor 2021-06-29 not yet calculated CVE-2021-34550 MISC CONFIRM torproject -- tor   An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-005. Hashing is mishandled for certain retrieval of circuit data. Consequently. an attacker can trigger the use of an attacker-chosen circuit ID to cause algorithm inefficiency. 2021-06-29 not yet calculated CVE-2021-34549 MISC CONFIRM torproject -- tor   An issue was discovered in Tor before 0.4.6.5, aka TROVE-2021-003. An attacker can forge RELAY_END or RELAY_RESOLVED to bypass the intended access control for ending a stream. 2021-06-29 not yet calculated CVE-2021-34548 MISC CONFIRM ts-nodash -- ts-nodash All versions of package ts-nodash are vulnerable to Prototype Pollution via the Merge() function due to lack of validation input. 2021-07-02 not yet calculated CVE-2021-23403 MISC MISC unetworking -- uwebsockets   uWebSockets 18.11.0 and 18.12.0 has a stack-based buffer overflow in uWS::TopicTree::trimTree (called from uWS::TopicTree::unsubscribeAll). 2021-07-01 not yet calculated CVE-2020-36406 MISC MISC MISC veeam -- veeam   Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft .NET remoting. 2021-06-30 not yet calculated CVE-2021-35971 MISC MISC western_digital -- multiple_products   Western Digital WD My Book Live (2.x and later) and WD My Book Live Duo (all versions) have an administrator API that can perform a system factory restore without authentication, as exploited in the wild in June 2021, a different vulnerability than CVE-2018-18472. 2021-06-29 not yet calculated CVE-2021-35941 MISC MISC xen -- xen Guest triggered use-after-free in Linux xen-netback A malicious or buggy network PV frontend can force Linux netback to disable the interface and terminate the receive kernel thread associated with queue 0 in response to the frontend sending a malformed packet. Such kernel thread termination will lead to a use-after-free in Linux netback when the backend is destroyed, as the kernel thread associated with queue 0 will have already exited and thus the call to kthread_stop will be performed against a stale pointer. 2021-06-29 not yet calculated CVE-2021-28691 MISC xen -- xen x86: TSX Async Abort protections not restored after S3 This issue relates to the TSX Async Abort speculative security vulnerability. Please see https://xenbits.xen.org/xsa/advisory-305.html for details. Mitigating TAA by disabling TSX (the default and preferred option) requires selecting a non-default setting in MSR_TSX_CTRL. This setting isn't restored after S3 suspend. 2021-06-29 not yet calculated CVE-2021-28690 MISC xen -- xen xen/arm: Boot modules are not scrubbed The bootloader will load boot modules (e.g. kernel, initramfs...) in a temporary area before they are copied by Xen to each domain memory. To ensure sensitive data is not leaked from the modules, Xen must "scrub" them before handing the page over to the allocator. Unfortunately, it was discovered that modules will not be scrubbed on Arm. 2021-06-30 not yet calculated CVE-2021-28693 MISC xen -- xen inappropriate x86 IOMMU timeout detection / handling IOMMUs process commands issued to them in parallel with the operation of the CPU(s) issuing such commands. In the current implementation in Xen, asynchronous notification of the completion of such commands is not used. Instead, the issuing CPU spin-waits for the completion of the most recently issued command(s). Some of these waiting loops try to apply a timeout to fail overly-slow commands. The course of action upon a perceived timeout actually being detected is inappropriate: - on Intel hardware guests which did not originally cause the timeout may be marked as crashed, - on AMD hardware higher layer callers would not be notified of the issue, making them continue as if the IOMMU operation succeeded. 2021-06-30 not yet calculated CVE-2021-28692 MISC xml2dict -- xml2dict XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. 2021-06-30 not yet calculated CVE-2021-25951 MISC xwiki -- xwiki   XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulnerability exists in versions prior to 12.10.5, and in versions 13.0 through 13.1. It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki. The problem has been patched in XWiki 12.10.5 and 13.2RC1. As a workaround, it is possible to apply the patch manually by modifying the `register_macros.vm` template. 2021-07-01 not yet calculated CVE-2021-32730 CONFIRM MISC MISC xwiki -- xwiki   XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13.1RC1 and 13.1, the reset password form reveals the email address of users just by giving their username. The problem has been patched on XWiki 13.2RC1. As a workaround, it is possible to manually modify the `resetpasswordinline.vm` to perform the changes made to mitigate the vulnerability. 2021-07-01 not yet calculated CVE-2021-32731 MISC CONFIRM MISC xwiki -- xwiki   XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions prior to 12.6.88, 12.10.4, and 13.0. The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights. An attacher with script rights who is able to reset the authentication failure record might perform a brute force attack, since they would be able to virtually deactivate the mechanism introduced to mitigate those attacks. The problem has been patched in version 12.6.8, 12.10.4 and 13.0. There are no workarounds aside from upgrading. 2021-07-01 not yet calculated CVE-2021-32729 CONFIRM MISC zoho -- manageengine_adselfservice_plus   Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sync database application. 2021-07-02 not yet calculated CVE-2021-31874 MISC zoho -- manageengine_applications_manager   Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. 2021-07-01 not yet calculated CVE-2021-31813 MISC zyxel -- firmware   An authentication bypasss vulnerability in the web-based management interface of Zyxel USG/Zywall series firmware versions 4.35 through 4.64 and USG Flex, ATP, and VPN series firmware versions 4.35 through 5.01, which could allow a remote attacker to execute arbitrary commands on an affected device. 2021-07-02 not yet calculated CVE-2021-35029 MISC Back to top This product is provided subject to this Notification and this Privacy & Use policy.

Read more »

The Complete Guide to Taking Screenshots and Screen Recordings on Mac, iPhone, iPad, and Apple Watch
It's useful to know how to take screenshots on all your Apple devices: Mac, iPhone, iPad, and Apple Watch. The post appeared first on The Mac Security Blog.

Read more »

Another 0-Day Looms for Many Western Digital Users
Countless Western Digital customers saw their MyBook Live network storage drives remotely wiped in the past month thanks to a bug in a product line the company stopped supporting in 2015, as well as a previously unknown zero-day flaw. But there is a similarly serious zero-day flaw present in a much broader range of newer Western Digital MyCloud network storage devices that will remain unfixed for many customers who can't or won't upgrade to the latest operating system.

Read more »

Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax
Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by the end of this month. Intuit says the change is tied to an "exciting" and "free" new service that will let millions of small business employees get easy access to employment and income verification services when they wish to apply for a loan or line of credit.

Read more »

iCloud Calendar Spam, In-App Purchases, and Windows 11 – Intego Mac Podcast Episode 194
Owners of WD MyCloud Drives have found all their data remotely wiped by hackers. iCloud Calendar spam is problem again, and we explain why, and how to fix it. We also discuss managing in-app purchases and app subscriptions, and we even discuss the forthcoming Windows 11. The post appeared first on The Mac Security Blog.

Read more »

Sunday Sale: Apple AirPods Pro drops to record low price of only $189, $60 off MSRP!
Amazon has Apple’s AirPods Pro on sale today for only $189.99 shipped. That’s $60 off MSRP and the cheapest price we’ve seen for a set of AirPods Pro from any Apple reseller. For the latest prices and sales, see our Apple AirPods Price Tracker, → Read More...

Read more »

Week’s Best Mac Deals: M1-powered Mac minis on sale for $100-$140 off Apple’s MSRP
Looking for the cheapest Mac with an Apple M1 processor? Apple’s Mac mini starts at $699, and resellers are offering models on sale this week for as low as $589 and up to $140 off MSRP: Mac mini M1/8GB RAM/256GB SSD – M1 Mac mini (8GB RAM/256GB SSD): $589 $110 off MSRP Apple Certified Refurbished – M1 Mac mini (8GB RAM/256GB SSD): $599.99 $100 off MSRP at Amazon Mac mini M1/8GB RAM/512GB SSD – M1 Mac mini (8GB RAM/512GB SSD): $759 $140 off MSRP Apple Certified Refurbished – M1 Mac mini (8GB RAM/512GB SSD): $799 $100 off MSRP at Adorama – M1 Mac mini (8GB RAM/512GB SSD): $829 $70 off MSRP at Amazon For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Take $10 off Apple’s HomePod mini today
B&H Photo has Apple HomePod minis on sale today for $89.99 shipped. This rare sale price is $10 off Apple’s MSRP. Space Gray and White colors are available. For the latest prices & sales, see our HomePod Price Tracker, → Read More...

Read more »

Boost Mobile offers sale prices on no-contract iPhones: $170 off iPhone 12 mini, $150 off SE and XR models
Boost Mobile is offering Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249. 128GB models are offered at a $50 discount: $399. Boost is also offering the 64GB iPhone 12 mini for $529.99, $170 off MSRP, and the 64GB iPhone XR for $349.99, $150 off MSRP. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is one of the cheapest no-contract 2020 iPhones we’ve seen available anywhere. These deals are live today at Boost Mobile. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

Amazon’s $200 Apple 13″ M1 MacBook Pro discounts are back
Amazon has Apple’s 13″ MacBook Pros with M1 Apple Silicon CPUs back on sale for $200 off MSRP, starting at $1099. Shipping is free: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1299.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1099.99 $200 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1299.99 $200 off MSRP Amazon’s prices are currently the lowest available for these models from any Apple reseller. Be sure to make your purchase from Amazon rather than a third-party seller. These MacBook Pros are the same models as those Apple sells in their retail and online stores. For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Here are Apple’s latest Education discounts and deals on Macs & iPads with M1 processors
Need a new Apple Mac or iPad Pro for school? Whether you’re a student, teacher, or staff member, Apple will sell you a new M1-powered 13″ MacBook Pro, 13″ MacBook Air, Mac mini, or 24″ iMac for up to $100 off MSRP when you use your .edu email address when ordering at Apple Education. Apple will take $100 off 12″ M1 iPad Pros, and $50-$100 off 11″ M1 iPad Pros. All teachers, students, and staff of any educational institution with a .edu email address qualify for the discount, including parents of students. Education discounts are available on most build-to-order options, such as extra RAM and more storage. As part of their Back to School promotion for 2021, Apple will include one free pair AirPods (with charging case) with the purchase of a MacBook Air, MacBook Pro, iMac, Mac mini, or Mac Pro. Apple will also include a free pair of Apple AirPods (with charging case) with the purchase of any new iPad Air or iPad Pro (iPad mini and 8th-gen iPad excluded). You can optionally choose Apple AirPods with the Wireless Charging Case for only $40 (regularly $159) or Apple AirPods Pro for only $90 (regularly $249). Lastly, Apple will take 20% off AppleCare+ plans with your purchase. Promotion runs through September 27, 2021.: – 13″ M1 MacBook Air/8-Core CPU, 7-Core GPU/256GB: $899 $100 off – 13″ M1 MacBook Air/8-Core CPU, 8-Core GPU/512GB: $1149 $100 off – 13″ M1 MacBook Pro/256GB: $1199 $100 off – 13″ M1 MacBook Pro/512GB: $1399 $100 off – M1 Mac mini/256GB: $679 $20 off – M1 Mac mini/512GB: $879 $20 off – 24″ M1 iMac/8-Core CPU, 7-Core GPU/256GB: $1249 $50 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/256GB: $1399 $100 off – 24″ M1 iMac/8-Core CPU, 8-Core GPU/512GB: $1599 $100 off – 12.9″ M1 iPad Pro 128GB WiFi: $999 $100 off – 12.9″ M1 iPad Pro 256GB WiFi: $1099 $100 off – 12.9″ M1 → Read More...

Read more »

New 12″ 128GB M1 iPad Pro on sale for $100 off Apple’s MSRP
Amazon has Apple’s new 12″ 128GB WiFi iPad Pro powered by an M1 processor in stock and on sale today for $999 shipped. Their price is $100 off MSRP and currently the lowest price available for a new 12″ M1 iPad Pro. For the latest prices & sales, see our 12″ iPad Pro Price Tracker, → Read More...

Read more »

This is where to find the lowest price on Apple’s new 13″ M1 MacBook Airs, models on sale starting at only $899
Amazon has new 13″ Apple M1 MacBook Airs on sale today for $100-$150, starting at $899: 8-Core M1 Silicon CPU, 7-Core GPU: – 13″ M1 MacBook Air/256GB Space Gray: $899.99 $100 off MSRP – 13″ M1 MacBook Air/256GB Silver: $899.99 $100 off MSRP – 13″ M1 MacBook Air/256GB Gold: $899.99 $100 off MSRP 8-Core M1 Silicon CPU, 8-Core GPU: – 13″ M1 MacBook Air/512GB Space Gray: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Silver: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Gold: $1099.99 $150 off MSRP Their prices are the lowest available for these models from any Apple reseller. Be sure to purchase from Amazon directly to receive the discount, not a third-party seller. These are the same MacBook Airs sold by Apple in their retail and online store. For the latest prices & sales, keep an eye on our 13″ MacBook Air Price Tracker, → Read More...

Read more »

This is where to find the lowest price on Apple’s new 13″ M1 MacBook Airs, models on sale starting at only $899
Amazon has new 13″ Apple M1 MacBook Airs on sale today for $100-$150, starting at $899: 8-Core M1 Silicon CPU, 7-Core GPU: – 13″ M1 MacBook Air/256GB Space Gray: $899.99 $100 off MSRP – 13″ M1 MacBook Air/256GB Silver: $899.99 $100 off MSRP – 13″ M1 MacBook Air/256GB Gold: $899.99 $100 off MSRP 8-Core M1 Silicon CPU, 8-Core GPU: – 13″ M1 MacBook Air/512GB Space Gray: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Silver: $1099.99 $150 off MSRP – 13″ M1 MacBook Air/512GB Gold: $1099.99 $150 off MSRP Their prices are the lowest available for these models from any Apple reseller. Be sure to purchase from Amazon directly to receive the discount, not a third-party seller. These are the same MacBook Airs sold by Apple in their retail and online store. For the latest prices & sales, keep an eye on our 13″ MacBook Air Price Tracker, → Read More...

Read more »

16″ 6-Core MacBook Pro on sale for $2099, $300 off Apple’s MSRP
Amazon has dropped their price on the 16″ 6-Core Space Gray MacBook Pro to $2099.99 including free shipping. Amazon’s price is $300 off Apple’s MSRP, and it’s the lowest price we’ve even seen for a new 6-Core 16″ MacBook Pro. Be sure to purchase from Amazon, rather than a third-party seller, and note the Amazon’s price can change at any time. Keep an eye on our 16″ MacBook Pro Price Tracker for the latest prices & sales from Apple and its resellers, → Read More...

Read more »

Apple Pro Display XDR and Pro Stand on sale for up to $400 off MSRP
Expercom has Apple’s Pro Display XDR models on sale for $350-$400 off Apple’s MSRP, starting at $4649. They’re also offering a $100 discount on the Pro Stand: – Pro Display XDR Standard Glass: $4649 $350 off MSRP – Pro Display XDR Nano-Texture Glass: $5599 $400 off MSRP – Pro Stand: $899 $100 off MSRP Delivery is expected in 7-14 days. Expercom’s prices are the lowest available for Pro Display XDR models from any Apple reseller. See our Mac Pro Price Tracker as well as our Pro Display XDR Price Tracker for the latest prices and sales from Apple and → Read More...

Read more »

Weekend Sale: Apple AirPods Max for $477, $72 off MSRP
Amazon has all colors of Apple’s AirPods Max on sale this weekend for $477.78 shipped. Their price is $72 off Apple’s MSRP, and it’s the lowest price we’ve seen so far for AirPods Max. For the latest prices & sales, see our Apple AirPods Price Tracker, → Read More...

Read more »