‘The Mandalorian’ could be the best TV Western since ‘...
OK, this is just crazy talk. Justified was one of the best TV series ever and we're only two episodes in to The Mandalorian. Make no mistake - I loved Justified and I mildly enjoyed The Mandalorian but it will take quite a bit more for the latter to match up to the former.∞ Read this on The Loop

Read more »

Using the Delta Airlines App and Apple Business Chat in a Sn...
On a recent delay- and cancellation-plagued trip, Adam Engst found that the most effective resources for dealing with rebooking flights and getting questions answered were the Delta iPhone app and the company’s Business Chat-based support reps.

Read more »

MacBook Pro Teardown Confirms the New Keyboard Is Basically ...
iFixit's teardown of the new 16-inch MacBook Pro confirms that the keyboard uses the more reliable scissor-style switches that Apple first introduced in its Magic Keyboards in 2015. The Verge reports: The switches on the 16-inch MacBook Pro are so similar to the standalone keyboard, in fact, that iFixit's report says that keys are interchangeable between the two products. The change comes after a long, multiyear debate between Apple and customers over the butterfly switches, causing Apple to revamp the mechanism multiple times to block debris and add extra strength. Apple was also forced to acknowledge that the keyboards were problematic, and offered an extended warranty program for those laptops. Per iFixit, the new keys also have more travel when you press them (about 0.5 mm more), and the keycaps themselves are about 0.2 mm thicker compared to the much-maligned butterfly switches. The teardown also notes that the clips that attach the keycaps to the switches appear to be more reinforced to make it easier to remove or replace them down the line. Read more of this story at Slashdot.

Read more »

Cook, Trump to meet at Apple’s Texas plant on Wednesda...
Apple CEO Tim Cook will on Wednesday host President Donald Trump at a computer facility in Texas where the company's Mac Pro is assembled.

Read more »

Getting the 16-inch MacBook Pro? Here’s how to wipe your M...
If you’ve just picked up the 16-inch MacBook Pro or you’re going to soon and you’re going to sell/give away your existing Mac notebook, follow along for how to wipe your MacBook and reinstall a fresh copy of macOS. more… The post Getting the 16-inch MacBook Pro? Here’s how to wipe your MacBook before selling or giving it away appeared first on 9to5Mac.

Read more »

Forget the MacBook Air. Roll your own Apple ‘laptop’ for...
The 7th-gen 10.2-inch iPad, paired with a Brydge keyboard, is a fun, futuristic, functional computer with specs similar to a MacBook Air. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

This 1,300mAh Portable Charger Fits on Your Keyring: $34
We have a deal on a neat portable charger designed to fit on your keyring. It has a 1,300mAh capacity and an integrated, retractable Lightning port for when you need that quick, emergency charge. It’s $39.99 through our deal, but coupon code BFSAVE15 at checkout brings the price down to $34. I’m linking to the Lightning model, as described, but there are also USB-C and micro USB options in the deal listing, and that coupon code works on them, too.

Read more »

Ex head of iPhone processors founds chip-design company
You may never have heard of Gerard Williams III, but for years he played a large part in designing every iPhone processor. He left Apple early this year, and is now the CEO of Nuvia, a firm headed by three ex Apple execs that’s designing its own chips. But they aren’t taking on their old […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

This essential iPad shortcut lets you instantly preview any ...
iPadOS often opens a file instead of previewing it. Here’s how to get a proper quick-look preview, every time, anywhere. (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple bans vaping apps from the iOS App Store
Customers can continue using apps they've already downloaded.

Read more »

Here’s what the 16-inch MacBook Pro keyboard sounds li...
Apple has released the 16-inch MacBook Pro to the world, after almost a year of rumors. The most obvious changes are how the keyboard feels, and what the machine sounds like in use.

Read more »

Three former Apple execs create new chip company, will compe...
A trio of former Apple chip executives has started a new chip company that has the goal of improving large servers. The three founders have more than 20 years of combined experience at Apple with one having served as the company’s chief A-series architect. The newly founded chip maker will compete with the likes of Intel and AMD. more… The post Three former Apple execs create new chip company, will compete with Intel and AMD appeared first on 9to5Mac.

Read more »

Subscriber Numbers, iOS and Security Keys – TMO Daily Obse...
Charlotte Henry joins Kelly Guimont to discuss subscriber stats for Disney+ vs Apple services, bundles, and iOS using hardware security keys.

Read more »

Help friendly robots solve puzzles in Apple Arcade’s new R...
Children and their parents can enter Rosie’s Reality, a game where they’ll guide this miniature robot through a series of puzzles by building paths with blocks that resemble virtual Legos. This latest addition to the Apple Arcade service is the only new title out this week now that its total number of games has passed […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

16-inch MacBook Pro supports up to two 6K external displays
Apple launched the new 16-inch MacBook Pro with several improvements aimed at professional users such as programmers, photographers, designers, and video editors. These users should be pleased to know that the new laptop is now able to work with up to two external 6K monitors simultaneously. more… The post appeared first on 9to5Mac.

Read more »

Using HomeKit Secure Video in iOS 13.2 with Logitech Circle ...
HomeKit Secure Video from Apple is a real feature that you can actually use with iOS 13 thanks to Logitech Circle 2 cameras. Logitech promised an update for Logi Circle 2 Wired cameras earlier this summer right after Apple unveiled its new approach to home security camera software. A new app update and beta camera firmware released this week fulfilled that promise, making Logitech Circle 2 Wired cameras the only hardware to work with the new HomeKit Secure Video. Apple’s Home app has supported home security cameras for years, but HomeKit Secure Video raises the bar for privacy while introducing new recording features for certain iCloud subscribers. Here’s what you should know about HomeKit Secure Video now that the feature is in the wild. more… The post Using HomeKit Secure Video in iOS 13.2 with Logitech Circle 2 cameras appeared first on 9to5Mac.

Read more »

Apple News+ has struggled to add subscribers since first wee...
I'm always suspicious of "sources say..." stories but this rings true. Ignoring the stupidity of that last sentence (News+ works just fine on Macs too, you morons), News+ is not a "must have" or even a "this would be nice" product from Apple. It feels half-baked and, at this point, pretty much ignored.∞ Read this on The Loop

Read more »

Rugged silicone sport band for Apple Watch a bargain at just...
Elkson’s new silicone sport band for Apple Watch fixes one of the biggest complaints users have with Apple’s official option. It’s also attractive, comfortable, and insanely rugged. And the best bit? It’s a bargain at just $14.99. We won’t call Apple’s Sport band bad. If it works for you, then it’s actually pretty great. But […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

How to Use the Scan Tool in iOS 13
Apple introduced a document scanning feature in iOS 13 that allows users to scan multi-page documents and save them locally or in the cloud.

Read more »

iPhone 11 Pro camera holds its own against $20,000 Leica
YouTube is full of photographers comparing their professional kits with the latest iPhone camera. But a recent test and conclusion by Sawyer Hartman risked sounding blasphemes. Could a $1,300 iPhone 11 Pro outshoot $20,000 worth of some of the best gear produced by the iconic German brand, Leica? That may depend on who’s looking. Hartman, […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

The Morning Show showrunner discusses season 2 development
With the fifth episode of The Morning Show landing on Apple TV+ this morning, attention is already turning to season number two. Morning Show showrunner Kerry Ehrin revealed how the U.S. political landscape could impact some of the storytelling next season. While Trump and current political issues won’t be brought up, Ehrin says some political […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Keep all Apple accessories together with this wireless charg...
iLounge has a special deal on the BentoStack Charge, which allows you to stack up and organize all your Apple accessories in one convenient and cool wireless charging box. At… The post Keep all Apple accessories together with this wireless charging box by BentoStack appeared first on iLounge.

Read more »

ProLine Compact doorbell brings HomeKit Secure Video
A follow-up to the world’s first HomeKit-compatible video doorbell from Robin Telecom Development will support Apple’s new system that makes video security systems more private and secure. It’s quite possibly the first video doorbell to do so. Almost as importantly, the Robin ProLine Compact is smaller than its predecessor. Not your grandmother’s doorbell “With the […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

iFixit cracking open the new 16-inch MacBook Pro to see exac...
Before iFixit does its full teardown of the 16-inch MacBook Pro, today it is popping open the notebook to get a first look at the new scissor switch Magic Keyboard. more… The post iFixit cracking open the new 16-inch MacBook Pro to see exactly what’s different with the Magic Keyboard appeared first on 9to5Mac.

Read more »

ALT Linux: Worthy Linux Alternatives, With a Catch
ALT Linux offers a buffet of Linux distributions that meet a variety of specialized needs. Its inviting selections could be a good source of alternative Linux OS solutions if you take the time to sort out the menus. You might find navigating the poorly designed website a tedious chore. Still, persevering could get you a few tasty options to satisfy your computing appetite.

Read more »

Hulu’s Live TV plan jumping 22% for new and existing custo...
Hulu has announced today that its Live TV base plan will see a price hike going from $45/month to $55/month. While the company acknowledges that “price changes are never easy to stomach,” it believes the increased price “better reflects the substantial value of Hulu + Live TV.” more… The post Hulu’s Live TV plan jumping 22% for new and existing customers soon appeared first on 9to5Mac.

Read more »

∞ The Dalrymple Report: MacBook Pro and Disney+
Dave and I talk about the new MacBook Pro that Apple released this week, looking beyond the fixed keyboard. We also look at Disney+ and the extraordinary start the the streaming service. Brought to you by: LinkedIn: Go to LinkedIn.com/DALRYMPLE and get $50 off your first job post! Subscribe to this podcast

Read more »

GitHub Preserves its Code in the Arctic World Archive
GitHub plans to store all of its open source code in the Arctic World Archive to prepare for possible doomsday scenarios. The data is stored on reels of film coated with iron oxide powder. It can be read by a computer or — in the event of a global power outage — a human with a magnifying glass. Crucially, this film will last for 1,000 years. Among the first data deposit at the vault is the source code for Android and Linux operations systems, as well as a range of programming languages, web platforms, cryptocurrencies and AI tools. GitHub is planning on having all active public repositories stored by February 2020. This sounds like a neat project. It also sounds like the Arctic World Archive is “around the corner” from the Doomsday seed vault, another preservation project. Note: The photo I chose for the featured image is of that seed vault.

Read more »

Apple News+ is Apparently Struggling for Subscribers
Apple News+ has not got materially more than the 200,000 subscribers than it got after the service’s initial launch in March.

Read more »

I spent a day as a Times Square mascot
Funny story about an unfunny subject. The last time I was in Times Square, these fake mascots really put me off.∞ Read this on The Loop

Read more »

Increase your privacy with CyberGhost VPN
If you've followed Intego's blog and podcast for a while, you may recall that we've mentioned the privacy and security benefits of VPNs—virtual private networks—several times. As a quick recap, here are just a handful of the advantages that a good personal VPN can provide: hide your personal IP address from sites you visit, apps […]

Read more »

Breaches at NetworkSolutions, Register.com, and Web.com
Top domain name registrars NetworkSolutions.com, Register.com and Web.com are asking customers to reset their passwords after discovering an intrusion in August 2019 in which customer account information was accessed.

Read more »

Facebook sues NSO Group for WhatsApp spyware attack
  Social media giant Facebook, owner of the WhatsApp messaging platform, has filed a lawsuit against NSO Group, an Israeli company that develops software for intelligence agencies. Back in May 2019, NSO Group’s Pegasus spyware was found to have spread to about 1,400 mobile devices via a remotely exploitable vulnerability in the iOS and Android […]

Read more »

What are all those macOS Catalina security alerts?
If you’ve upgraded to macOS Catalina, you’ve probably noticed that you get lots of dialogs asking you to allow apps to access different parts of your Mac’s operating system, it’s hardware, to give you notifications, and perhaps to access your contacts, photos, and more. Some of these aren’t new, such as this Gatekeeper dialog that […]

Read more »

Takeaways from the $566M BriansClub breach
Reporting on the exposure of some 26 million stolen credit cards leaked from a top underground cybercrime store highlighted some persistent and hard truths. Most notably, that the world's largest financial institutions tend to have a much better idea of which merchants and which bank cards have been breached than do the thousands of smaller banks and credit unions across the United States. Also, a great deal of cybercrime seems to be perpetrated by a relatively small number of people.

Read more »

Cachet Financial Reeling from MyPayrollHR Fraud
When NY based cloud payroll provider MyPayrollHR unexpectedly shuttered its doors last month and disappeared with $26 million worth of customer payroll deposits, its payments processor Cachet Financial Services ended up funding the bank accounts of MyPayrollHR client company employees anyway, graciously eating a $26 million loss which it is now suing to recover.

Read more »

Ransomware Hits B2B Payments Firm Billtrust
Business-to-business payments provider Billtrust is still recovering from a ransomware attack that began last week.  The company said it is in the final stages of bringing all of its systems back online from backups.

Read more »

Avast, NordVPN Breaches Tied to Phantom User Accounts
Antivirus and security giant Avast and virtual private networking (VPN) software provider NordVPN each today disclosed months-long network intrusions that -- while otherwise unrelated -- shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password.

Read more »

Vulnerability Summary for the Week of October 14, 2019
Original release date: October 21, 2019 | Last revised: October 22, 2019  The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- download_manager   Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation. 2019-10-17 7.5 CVE-2019-8071CONFIRM autopi -- wi-fi/nb_and4g/lte_devices   AutoPi Wi-Fi/NB and 4G/LTE devices before 2019-10-15 allows an attacker to perform a brute-force attack or dictionary attack to gain access to the WiFi network, which provides root access to the device. The default WiFi password and WiFi SSID are derived from the same hash function output (input is only 8 characters), which allows an attacker to deduce the WiFi password from the WiFi SSID. 2019-10-14 10 CVE-2019-12941MISCMISCMISC belkin -- wemo_switch_28b_devices   An issue was discovered on Belkin Wemo Switch 28B WW_2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service (persistent rules-processing outage) via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption occurs. 2019-10-12 7.8 CVE-2019-17532MISC bmc -- patrol_agent   An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution. 2019-10-14 7.2 CVE-2019-17044CONFIRMMISCMISC centreon -- centreon   Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen). 2019-10-14 9 CVE-2019-17501MISC cloudcti -- hip_integrator_recognition_configuration_tool   CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service (Recognition Update Client Service) via an insecure communication channel (Named Pipe). The data (JSON) sent via this channel is used to import data from CRM software using plugins (.dll files). The plugin to import data from the EXQUISE software (DatasourceExquiseExporter.dll) can be persuaded to start arbitrary programs (including batch files) that are executed using the same privileges as Recognition Update Client Service (NT AUTHORITYSYSTEM), thus elevating privileges. This occurs because a higher-privileged process executes scripts from a directory writable by a lower-privileged user. 2019-10-14 7.2 CVE-2019-9745MISCMISC compal -- ch746lg_devices   The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the Target_IP parameter. 2019-10-11 9 CVE-2019-17499MISC d-link -- dir-859_a3-1.06_and_dir-850_a1.13_devices   On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices, /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable. 2019-10-11 10 CVE-2019-17508MISC d-link -- dir-868l_b1-2.03_and_dir-817lw_a1-1.04_routers   There are some web interfaces without authentication requirements on D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers. An attacker can get the router's username and password (and other information) via SERVICES=DEVICE.ACCOUNT&AUTHORIZED_GROUP=1%0a to getcfg.php. This could be used to control the router remotely. 2019-10-11 10 CVE-2019-17506MISC d-link -- dir-880l_and_dir-895_devices   Certain D-Link products are affected by: Buffer Overflow. This affects DIR-880L 1.08B04 and DIR-895 L/R 1.13b03. The impact is: execute arbitrary code (remote). The component is: htdocs/fileaccess.cgi. The attack vector is: A crafted HTTP request handled by fileacces.cgi could allow an attacker to mount a ROP attack: if the HTTP header field CONTENT_TYPE starts with ''boundary=' followed by more than 256 characters, a buffer overflow would be triggered, potentially causing code execution. 2019-10-14 7.5 CVE-2017-14948MISC d-link_dir-846_devices   D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php. 2019-10-11 10 CVE-2019-17510MISC d-link_dir-859_devices D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php. 2019-10-11 10 CVE-2019-17509MISC eset -- cyber_security ESET Cyber Security 6.7.900.0 for macOS allows a local attacker to execute unauthorized commands as root by abusing an undocumented feature in scheduled tasks. 2019-10-14 7.2 CVE-2019-16519CONFIRM fasterxml -- jackson-databind   A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. 2019-10-12 7.5 CVE-2019-17531MISCMISC ffmpeg -- ffmpeg   In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer. 2019-10-14 7.5 CVE-2019-17539MISCMISC ffmpeg -- ffmpeg   FFmpeg before 4.2 has a heap-based buffer overflow in vqa_decode_chunk because of an out-of-array access in vqa_decode_init in libavcodec/vqavideo.c. 2019-10-14 7.5 CVE-2019-17542MISCMISC gnupg -- boa   Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled. 2019-10-11 7.5 CVE-2018-21027CONFIRMCONFIRM google -- android   In GetMBheader of combined_decode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-136175447 2019-10-11 9.3 CVE-2019-2186CONFIRM google -- android   In VlcDequantH263IntraBlock_SH of vlc_dequant.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-136173699 2019-10-11 9.3 CVE-2019-2185CONFIRM google -- android   In PV_DecodePredictedIntraDC of dec_pred_intra_dc.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-134578122 2019-10-11 9.3 CVE-2019-2184CONFIRM hp -- touchpoint_analytics   A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. This vulnerability may allow a local attacker with administrative privileges to execute arbitrary code via an HP Touchpoint Analytics system service. 2019-10-11 7.2 CVE-2019-6333MISCCONFIRM ibm -- workload_scheduler_distributed   IBM Workload Scheduler Distributed 9.2, 9.3, 9.4, and 9.5 contains a vulnerability that could allow a local user to write files as root in the file system, which could allow the attacker to gain root privileges. IBM X-Force ID: 155997. 2019-10-16 7.2 CVE-2019-4031XFCONFIRM icrewrap -- webclient   IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files. 2019-10-11 7.8 CVE-2010-5335MISCMISC icrewrap -- webclient   IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files. 2019-10-11 7.8 CVE-2010-5334MISCMISC idreamsoft -- icms   An issue was discovered in idreamsoft iCMS v7.0.14. There is a spider_project.admincp.php SQL injection vulnerability in the 'upload spider project scheme' feature via a two-dimensional payload. 2019-10-14 7.5 CVE-2019-17552MISC intelbras -- iwr_1000n_devices   Intelbras IWR 1000N 1.6.4 devices allows disclosure of the administrator login name and password because v1/system/user is mishandled. 2019-10-15 10 CVE-2019-17600MISCMISC kaseya -- vsa_rmm   An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTINAdministrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.) 2019-10-11 7.2 CVE-2019-14510MISCMISCMISCMISCMISC metinfo -- metinfo   An issue was discovered in MetInfo v7.0.0 beta. There is SQL Injection via the admin/?n=tags&c=index&a=doSaveTags URI. 2019-10-14 7.5 CVE-2019-17553MISC netgear -- jnr1010_devices   NETGEAR JNR1010 devices before 1.0.0.32 have Incorrect Access Control because the ok value of the auth cookie is a special case. 2019-10-16 7.5 CVE-2016-11014MISCMISCMISCMISC nostromo_nhttpd -- nostromo_nhttpd    Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request. 2019-10-14 7.5 CVE-2019-16278MISCMISCMISC oracle -- fusion_middleware Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2901MISC oracle -- fusion_middleware Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2903MISC oracle -- fusion_middleware Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2902MISC oracle -- fusion_middleware   Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2971MISC oracle -- fusion_middleware   Vulnerability in the Oracle JDeveloper and ADF product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 11.1.1.9.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDeveloper and ADF. Successful attacks of this vulnerability can result in takeover of Oracle JDeveloper and ADF. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). 2019-10-16 7.5 CVE-2019-2904MISC oracle -- fusion_middleware   Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2972MISC oracle -- fusion_middleware   Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Filters). The supported version that is affected is 8.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. Note: Outside In Technology is a suite of software development kits (SDKs). The protocol and CVSS score depend on the software that uses the Outside In Technology code. The CVSS score assumes that the software passes data received over a network directly to Outside In Technology code, but if data is not received over a network the CVSS score may be lower. CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). 2019-10-16 7.5 CVE-2019-2970MISC qibosoft_7 -- qibosoft_7   qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply PHP code to be evaluated. Alternatively, the attacker can access admin/index.php?lfj=jfadmin&action=addjf via CSRF, as demonstrated by a payload in the content parameter. 2019-10-15 7.5 CVE-2019-17613MISC rambox -- rambox   There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element. 2019-10-16 8.5 CVE-2019-17625MISC reportlab -- reportlab   ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py, as demonstrated by a crafted XML document with '

Read more »

Apple’s new 16-inch MacBook Pro offers bigger display and ...
Apple today introduced the 16″ MacBook Pro with an improved keyboard, larger and brighter display, 100Wh battery, AMD Radeon Pro 5000M series graphics, and support for up to 64GB RAM and 8TB SSD storage. The improved keyboard, dubbed Magic Keyboard by Apple, improved the feel of keyboard presses with a refund scissor mechanism and should be a big improvement over recent Mac notebook keyboards. At 3072×1920 and 500nits, the 16″ MacBook Pro features the largest Retina notebook display ever. “Our pro customers tell us they want their next MacBook Pro to have a larger display, blazing-fast performance, the biggest battery possible, the best notebook keyboard ever, awesome speakers and massive amounts of storage, and the 16-inch MacBook Pro delivers all of that and more,” said Tom Boger, Apple’s senior director of Mac and iPad Product Marketing. “With its brilliant 16-inch Retina display, 8-core processors, next-gen pro graphics, even better thermal design, new Magic Keyboard, six-speaker sound system, 100Wh battery, up to 8TB of storage and 64GB of fast memory, the 16-inch MacBook Pro is the world’s best pro notebook.” The new 16″ MacBook Pro is available at Apple today starting at $2399. See our 16″ MacBook Pro Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Wednesday roundup of the best AirPods sales, save up to $35 ...
Amazon is offering discounts on new 2019 Apple AirPods ranging up to $35 off MSRP. Shipping is free: – AirPods Pro: $234.98 $15 off MSRP – AirPods with Wireless Charging Case: $164.99 $35 off MSRP – AirPods with Charging Case: $144 $15 off MSRP – Wireless Charging Case: $69 $10 off MSRP Abt Electronics has AirPods on sale for up to $30 off MSRP. Shipping is free: – AirPods Pro: $249 $0 off MSRP – AirPods with Wireless Charging Case: $163.95 $35 off MSRP – AirPods with Charging Case: $143 $16 off MSRP – Wireless Charging Case: $64.99 $15 off MSRP Walmart has AirPods on sale for up to $35 off MSRP. Choose free shipping or free local store pickup. Sale prices for online orders only, in-store prices may vary: – AirPods Pro: $249 $0 off MSRP – AirPods with Wireless Charging Case: $164.99 $35 off MSRP – AirPods with Charging Case: $144 $15 off MSRP – Wireless Charging Case: $69 $10 off MSRP Best Buy has AirPods on sale for up to $35 off MSRP. Choose free shipping or free local store pickup. Sale prices for online orders only, in-store prices may vary: – AirPods Pro: $249.99 $0 off MSRP – AirPods with Wireless Charging Case: $164.99 $35 off MSRP – AirPods with Charging Case: $144.99 $15 off MSRP – Wireless Charging Case: $69.99 $10 off MSRP Sams Club has AirPods on sale for up to $30 off MSRP. Choose free shipping or free local store pickup. Sale prices for online orders only, in-store prices may vary. Note that a $45 Sams Club membership is required: – AirPods Pro: $234.98 $15 off MSRP – AirPods with Wireless Charging Case: $169.98 $30 off MSRP – AirPods with Charging Case: $144.98 $15 off MSRP – Wireless Charging Case: $69 → Read More...

Read more »

Save up to $200 with these Certified Refurbished 13″ MacBo...
Apple has a full line of Certified Refurbished 2019 13″ MacBook Airs available starting at only $929 and up to $200 off the cost of new Airs. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.6GHz/128GB MacBook Air Space Gray: $929 $170 off MSRP – 13″ 1.6GHz/128GB MacBook Air Silver: $929 $170 off MSRP – 13″ 1.6GHz/128GB MacBook Air Gold: $929 $170 off MSRP – 13″ 1.6GHz/256GB MacBook Air Space Gray: $1099 $200 off MSRP – 13″ 1.6GHz/256GB MacBook Air Silver: $1099 $200 off MSRP – 13″ 1.6GHz/256GB MacBook Air Gold: $1099 $200 off MSRP Apple’s refurbished prices are the lowest available for 2019 13″ MacBook Airs anywhere. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Back on sale! Apple’s new AirPods Pro $234 at Amazon, $15 ...
Amazon has Apple’s new AirPods Pro on sale and in stock today for $234.99 shipped. Their price is about $15 (6%) off Apple’s MSRP and the cheapest price available for these new models from any Apple reseller. Shipping is free. See our AirPod Price Tracker for the latest prices and deals from Apple and → Read More...

Read more »

Back on sale! Amazon’s Early Holiday sale drops prices on ...
Amazon has new Apple 11″ and 12″ iPad Pros in stock today and on sale again for up to $250 off Apple’s MSRP. These are the same iPad Pros sold by Apple in its retail and online stores, and Amazon is matching their iPad Pro sale from this past weekend. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free: – 11″ 64GB WiFi iPad Pro: $649.99 $150 off – 11″ 256GB WiFi iPad Pro: $799.99 $150 off – 11″ 512GB WiFi iPad Pro: $999.99 $150 off – 11″ 1TB WiFi iPad Pro: $1099.97 $250 off – 11″ 64GB WiFi + Cellular iPad Pro: $799.99 $150 off – 11″ 256GB WiFi + Cellular iPad Pro: $949.99 $150 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $150 off – 11″ 1TB WiFi + Cellular iPad Pro: $1349.99 $150 off – 12.9″ 64GB WiFi iPad Pro: $849.99 $150 off – 12.9″ 256GB WiFi iPad Pro: $949.99 $200 off – 12.9″ 512GB WiFi iPad Pro: $1149.99 $200 off – 12.9″ 1TB WiFi iPad Pro: $1349.99 $200 off – 12.9″ 64GB WiFi + Cellular iPad Pro: $949.99 $200 off – 12.9″ 256GB WiFi + Cellular iPad Pro: $1099.99 $200 off – 12.9″ 512GB WiFi + Cellular iPad Pro: $1299.99 $200 off – 12.9″ 1TB WiFi + Cellular iPad Pro: $1499.99 $200 off Keep an eye on our 11″ iPad Pro Price Tracker and 12.9″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Switch to US Cellular and lease an iPhone Xr for $9.98 per m...
US Cellular is offering the base 64GB iPhone Xr for $9.98/month for new customers. Discounts are applied via monthly bill credit over 30 months and require one new line of service. Total price for the iPhone, after 30 months, is $299. That’s $300 off Apple’s $599 MSRP for the 64GB Xr. US Cellular’s deal is live on their → Read More...

Read more »

13″ 128GB MacBook Airs on sale for $100-$120 off Apple’s...
Focus Camera has new 2019 13″ 128GB MacBook Airs in stock and on sale today for up to $120 off Apple’s MSRP, with prices starting at $979. Shipping is free. Focus charges sales tax for NY & NJ residents only. These are the same MacBook Airs sold by Apple in their retail and online stores: – 13″ 128GB Space Gray MacBook Air: $999 $100 off MSRP – 13″ 128GB Silver MacBook Air: $979.99 $120 off MSRP For the latest prices and deals, see our 13″ MacBook Air → Read More...

Read more »

B&H offers $200 discount on 2019 13″ 2.4GHz 4-Core Ma...
B&H Photo has new 2019 13″ 2.4GHz 4-Core Touch Bar MacBook Pros on sale today for $200 off Apple’s MSRP. B&H is offering free overnight shipping to many addresses in the US. These are the same MacBook Pros sold by Apple in its retail and online stores: – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Space Gray: $1599 $200 off MSRP – 2019 13″ 2.4GHz/256GB 4-Core MacBook Pro Silver: $1599 $200 off MSRP – 2019 13″ 2.4GHz/512GB 4-Core MacBook Pro Space Gray: $1799 $200 off MSRP – 2019 13″ 2.4GHz/512GB 4-Core MacBook Pro Silver: $1799.99 $200 off MSRP Their prices are currently the lowest available for these models, new, from any Apple reseller. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Apple has 13″ 2.4GHz MacBook Pros available for $270-$300 ...
Apple has a full line of Certified Refurbished 2019 13″ 2.4GHz 4-Core Touch Bar MacBook Pros available starting at $1529 and up to $300 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 2.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1699 $300 off MSRP – 13″ 2.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1529 $270 off MSRP – 13″ 2.4GHz/512GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1699 $300 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Score a 37% discount on Apple Smart Keyboards for 10″ iPad...
Amazon has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $99.99 shipped. That’s a 37% discount over Apple’s regular MSRP of $159 and the cheapest price for a 10″ Smart Keyboard anywhere. Best Buy also has Apple Smart Keyboards for current-generation 10″ iPad Airs and previous-generation 10″ iPad Pros on sale today for $99.99 on their online store. Order online and choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price may vary. Keep an eye on our Apple Smart Keyboard Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Apple has refurbished 2019 13″ 1.4GHz MacBook Pros availab...
Apple has a full line of Certified Refurbished 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros available starting at $1099 and up to $230 off MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/128GB Space Gray 4-Core Touch Bar MacBook Pro (MUHN2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Space Gray 4-Core Touch Bar MacBook Pro (MUHP2LL/A): $1269 $230 off MSRP – 13″ 1.4GHz/128GB Silver 4-Core Touch Bar MacBook Pro (MUHQ2LL/A): $1099 $200 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core Touch Bar MacBook Pro (MUHR2LL/A): $1269 $230 off MSRP Their prices are the cheapest available for 2019 13″ MacBook Pros anywhere. See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

2019 13″ 1.4GHz 4-Core MacBook Pros on sale for $150-$200 ...
Amazon has new 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros on sale for $150-$200 off Apple’s MSRP. These are the same MacBook Pros sold by Apple in its retail and online stores: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1149 $150 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1299.99 $200 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1299.99 $200 off MSRP B&H Photo has new 2019 13″ 1.4GHz 4-Core Touch Bar MacBook Pros on sale for up to $200 off Apple’s MSRP as well. Overnight shipping is free to many addresses in the US: – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Space Gray: $1149 $150 off MSRP – 2019 13″ 1.4GHz/128GB 4-Core MacBook Pro Silver: $1149 $150 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Space Gray: $1299.99 $200 off MSRP – 2019 13″ 1.4GHz/256GB 4-Core MacBook Pro Silver: $1299.99 $200 off MSRP See our 13″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »