Tweetbot updated with native support for M1 Macs, new Big Su...
The popular Twitter client Tweetbot is now optimized for Apple Silicon and the first M1 Macs. Plus, there’s a new Tweetbot icon to fit in with the rest of your Big Sur dock. more… The post Tweetbot updated with native support for M1 Macs, new Big Sur icon appeared first on 9to5Mac.

Read more »

Apple is now using TikTok, with influencer videos for iPhone...
Apple is now using TikTok, more than six months after creating an official account for the company on the short-form video platform. It has apparently commissioned promotional videos from existing TikTok influencers … more… The post Apple is now using TikTok, with influencer videos for iPhone 12 mini appeared first on 9to5Mac.

Read more »

Apple releases new HomePod mini 'The magic of mini'...
In this whimsical and sometimes bizarre ad spot, Apple shows off its HomePod mini with hip-hop artist Tierra Whack having some fun in her own little world.Tierra Whack in "The magic of mini" ad spotThe ad spot reflects some of Apple's more high-end production videos for the holidays. Some featuring families coming together or Frankenstein's monster looking for happiness. Read more...

Read more »

India import hurdles slow import of Apple’s China-sourced ...
India’s tight control of quality clearances for electronic goods from China slowed the import of Apple’s new iPhone model last month and… The post India import hurdles slow import of Apple’s China-sourced iPhones, sources say appeared first on MacDailyNews.

Read more »

For Black Friday, get huge discounts on these career-enhanci...
Black Friday is going largely virtual this year, with people snatching up deals from their couches instead of descending on their local department stores. You might miss out on the in-store excitement (and the ridiculous Black Friday brawls), but it’s not all bad. One huge benefit of shopping from home is that you can get […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Xbox lead Phil Spencer talks xCloud in Safari, App Store fee...
Phil Spencer is the lead of Xbox at Microsoft, and in a wide-ranging interview, he discusses bringing xCloud to mobile Safari and how Apple's App Store and the Xbox game store differs.xCloud will launch on iOS and iPadOS Safari in the futureApple has made things difficult for businesses to bring streaming services to the Xbox with a range of rules preventing the apps from existing on iOS. If a company wants a streaming service to exist, they must submit each game to the App Store as a separate entity rather than having a single app launcher. Read more...

Read more »

France launches digital tax aimed at Apple and big tech comp...
French authorities have reportedly begun demanding tax payments amounting to many millions of dollars from US technology firms, as part of its digital tax plans.As Europe continues to plan an EU-wide digital tax for large technology corporations, despite the US leaving the negotiations, France has launched its own independent demands.According to the Financial Times, French authorities have issued demands to companies, including Amazon and Facebook, for payment of taxes it says are due for 2020. It is not known if Apple has received such a demand, but the tax has previously been called "GAFA," after its biggest targets of Apple, Google, Amazon, and Facebook. Read more...

Read more »

Apple highlights HomePod in its annual holiday ad: ‘the ma...
Apple has shared its annual holiday advertisement today, this year touting the “the magic of mini.” The ad features the rapper Tierra Whack and includes a focus primarily on Apple’s new $99 HomePod mini and the $299 full-sized HomePod. more… The post Apple highlights HomePod in its annual holiday ad: ‘the magic of mini’ appeared first on 9to5Mac.

Read more »

Relive Your Squandered Youth with this Retro TV Game Console
Remember those days spent playing 8-bit games on a console hooked up to a fuzzy color TV? Admit it; you’d like to have those days back. The Retro TV Game Console ($35.95 before promo code) plays over 620 classic-style 8-bit games and connects to your HDTV through HDMI or an AV cable. With Promo Code BFSAVE20, you can get the price down to $28.76!

Read more »

PSA: Don’t enable an Apple ID recovery key yet – or mayb...
We explained way back in 2014 why you might want to have an Apple ID recovery key. In those days, it was an extra precaution you could take against getting locked out of your account. Apple abandoned recovery keys when it switched to a smarter two-factor authentication process, before reintroducing them in a new form in iOS 14. However, they now work in a different way. You definitely won’t want to enable one now, and you may not want to do so ever … more… The post PSA: Don’t enable an Apple ID recovery key yet – or maybe ever appeared first on 9to5Mac.

Read more »

Apple wants the $85 million verdict against it overturned in...
Apple has urged the Federal Circuit to overturn an $85 million verdict against it for infringing WiLAN's patented wireless technology, saying that the licensing firm has been "stretching its patents" and otherwise "overreaching" at every stage in the case, reports Law360 (a subscription is required to read the entire article).

Read more »

We’re All Cyborgs and Didn’t Even Realize It
It’s certainly interesting to think about. Do smartphones count as “external brains?”Does wearing an Apple Watch make us a cyborg? Alex Hern examines the issue, although I disagree on one part: It’s definitely not an Apple-specific phenomenon. Without us even noticing, Apple has turned us into organisms living symbiotically with technology: part human, part machine. We now outsource our contact books, calendars and to-do lists to devices. We no longer need to remember basic facts about the world; we can call them up on demand. Read the article, then watch this TEDTalk from cyborg anthropologist Amber Case.

Read more »

My thoughts on the M1 Mac release schedule in 2021
In a note to clients — as noted by MacRumors — analyst Ming-Chi Kuo says Apple will release new redesigned Mac laptops in the second half of 2021. He didn’t specify which models they would be.

Read more »

Google Docs, Sheets, Slides for iOS now edit Microsoft Offic...
Google has rolled out new updates for Docs, Sheets, and Slides on iOS that add support for Microsoft Office files. A bunch of different Office formats are supported without the need for file conversion. Google’s productivity apps for iPhone and iPad previously allowed some editing functionality for Office documents using Quickoffice integration. But it was […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Today in Apple history: A phone call sows the seeds of OS X
November 25, 1996: A midlevel manager at NeXT contacts Apple about the possibility of Cupertino licensing NeXT’s OpenStep operating system. Garrett L. Rice’s communication with Ellen Hancock, Apple’s chief technology officer, is the first formal step in a long process. It ultimately leads to Apple buying NeXT, the creation of OS X, and Steve Jobs […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

Apple ID adds recovery key option, but it’s not yet ready ...
In a little-noticed change that arrived with iOS 14 and iPadOS 14, Apple re-enabled the option to have a recovery key associated with an Apple ID. The Apple ecosystem-spanning account system offers two-factor authentication, which requires both a password and a device or phone number associated with the account to login. The recovery key layers on top of that.A warning, first! Apple has updated necessary pieces of iOS, iPadOS, and macOS to let you set a recovery key. But weeks after iOS 14 and iPadOS 14 were released, the Apple ID support sites, Apple Support app, and Find My app remain out of date with the use of this newly revived recovery key, even though various support documents have been updated to explain correctly some of the details of how it’s intended to work.To read this article in full, please click here

Read more »

France sends ‘Apple tax’ demands; sparks new trade war f...
France has begun asking US tech giants for what has been labelled an ‘Apple tax’ – a specific tax on tech giants which the country considers tax avoiders. It has been hoped the country would agree to wait for a global agreement on the tax treatment of large tech companies, but France has now decided to proceed unilaterally. The move promoted a threat of retaliation from Washington, leading to fears that it could provoke a trade war between the two countries … more… The post France sends ‘Apple tax’ demands; sparks new trade war fears appeared first on 9to5Mac.

Read more »

All the Devices That Support Apple TV
Apple TV is available on an increasing number of third-party devices. This includes the televisions from the main makers as well as the latest Playstation and Xbox consoles. Devices That Support Apple TV These televisions, consoles, and other third-party items allow users to access a variety of Apple TV services. This, of course, includes the company's own streaming service. Samsung Samsung QLED 8K Q9, Q8 Series (2019, 2020) Samsung QLED 4K Q9, Q8, Q7, Qx Series (2018, 2019, 2020) Samsung UHD 8, 7, 6 Series (2018, 2019, 2020) Samsung FHD/HD 5,4 Series (2018, 2019, 2020)1 Samsung Serif Series (2019, 2020) Samsung The Frame Series (2018, 2019, 2020)1 Samsung The Sero Series (2019, 2020)1 Roku Roku 4K TV A000X, C000X, 6000X, 7000X Roku TV 8000X, D000X Roku Smart Soundbar 9101X, 9102X Roku onn™ Smart Soundbar 9100X Roku Express 3900X, 3930X Roku Express+ 3910X, 3931X Roku HD 3932X Roku Streaming Stick 3600X, 3800X Roku Streaming Stick+ 3810X, 3811X Roku Premiere 3920X, 4620X Roku Premiere+ 3921X, 4630X Roku Ultra 4640X, 4660X, 4661X, 4670X, 4800X Roku Ultra LT 4662X Roku 2 4210X, 4205X Roku 3 4200X, 4230X Amazon Fire TV Fire TV Stick 4K (2018) Fire TV Stick – Gen 2 (2016) Fire TV Stick – Basic Edition (2017) Fire TV Cube (Gen 2) Fire TV Cube (Gen 1) Fire TV – Gen 3 (2017) Nebula Soundbar – Fire TV Edition Fire TV Edition – Toshiba 4K (2018, 2020) Fire TV Edition – Insignia 4K (2018, 2020) Fire TV Edition – Toshiba HD (2018) Fire TV Edition – Insignia HD (2018) Fire TV Edition – Onida HD (2019) [How to Watch Apple TV+ on Amazon Fire TV Devices] LG LG OLED – RX, ZX, WX, GX, CX, BX series (2020) LG OLED – R9, Z9, W9, E9, C9, B9 series (2019) LG OLED – B8, C8, G8, E8 Series (2018) LG NanoCell – Nano 99, 97, 95, 90, 85, 80 series (2020) LG NanoCell – SM99, SM95, SM90, SM86, SM81 series (2019) LG UHD TV – UN85, UN73, UN71, UN70, UN69 series (2020) LG UHD TV – UM80, UM75, UM73, UM71, UM69 series (2019) LG SuperUHD TV – SK9, SK8 series (2018) LG UHD TV – UK62 and above, UK7 series (2018) VIZIO VIZIO OLED (2020) VIZIO P‑Series Quantum X (2019, 2020) VIZIO P‑Series Quantum (2018, 2019, 2020) VIZIO P‑Series (2016, 2017, 2018) VIZIO M‑Series Quantum (2019, 2020) VIZIO M‑Series (2016, 2017, 2018) VIZIO E‑Series (2016, 2017, and 2018 UHD models) VIZIO V‑Series (2019, 2020) VIZIO D‑Series (2018, 2019) Sony Sony XH90 Series (2020) Sony X90H Series (2020) Sony XH92 Series (2020) Games-Consoles PlayStation 4 PlayStation 5 Xbox One Xbox One S Xbox Series X Xbox Series S

Read more »

Microsoft argues Xbox games commission is different from App...
Microsoft’s exec VP of gaming has argued that the Xbox games commission – the slice it takes of games sold through its own platform – isn’t comparable to Apple’s App Store commission. Prior to Apple’s partial U-turn in halving the commission it charges most developers, the iPhone maker had pointed to games consoles as evidence that 30% was a standard industry commission. But Microsoft’s Phil Spencer rejects the comparison, for two reasons … more… The post Microsoft argues Xbox games commission is different from Apple’s App Store commission appeared first on 9to5Mac.

Read more »

How to fix the M1 Mac’s most disappointing feature: iOS ap...
If there’s a single disappointment in the release of Apple’s first wave of M1 Macs, it’s the lackluster launch of iOS apps running inside of macOS. What should be an amazing unification of Apple’s platforms and a massive expansion of the Mac software base is, instead… kind of a non-event.Running iOS apps on the Mac can be a little weird, it’s true. But it can sometimes be good. Unfortunately, a lot of interesting iOS apps just aren’t available at all, because their developers have removed them from the Mac side of the iOS App Store.It’s not a great situation. It needs to get better. Here are some ways that might happen.What developers can do Though iOS app developers with the Apple silicon Developer Transition Kit could build their iOS apps for Mac and run them to get an idea how they’d perform on macOS, I understand that many developers didn’t do this, and others didn’t feel comfortable letting their iOS apps out into the wild without first giving them a try on a real M1 Mac. A lot of them opted to just stay on the safe side and opt their apps out.To read this article in full, please click here

Read more »

Apple patent involves ‘AR/VR controller with event camera�...
Apple has been granted its (by my count) billionth patent for the rumored “Apple Glasses,” an augmented reality/virtual reality/mixed reality head-mounted display (HMD). This patent involves an “AR/VR controller with event camera.”

Read more »

Notable apps and updates, Nov. 23-25
On a regular basis, Apple World Today posts a list of notable new apps or app updates that have been released. They may not necessarily be new, but they're popular and deserve mention. Here are this week’s picks.

Read more »

iOS and macOS tips and tricks to assist friends and family d...
It’s Thanksgiving in the United States, and many of us are getting ready to spend time with family, watch some American football, relax, and get ready to hunt for Black Friday deals ahead of the Christmas shopping season. Even if you aren’t seeing all of your family this year, you might be spending some time with just a few people, so Thanksgiving “tech” tune-ups might be in order. more… The post iOS and macOS tips and tricks to assist friends and family during Thanksgiving appeared first on 9to5Mac.

Read more »

Facebook Hit With Fine by South Korean Privacy Watchdog For ...
South Korea's recently launched privacy watched has announced a $6.1 million for Facebook, Reuters reported. It said the social media giant shared millions of users' data without their permission. The country’s Personal Information Protection Commission, launched in August this year, said in a statement it fined Facebook after a probe found that the personal information of least 3.3 million of the 18 million Facebook users in Korea were provided to operators other than Facebook without their knowledge, from May 2012 to June 2018. When someone uses another operator’s service through Facebook’s log-in, the personal information of the user’s Facebook friends were provided to other operators without their consent, the commission said. The commission said it will refer Facebook Ireland Ltd, the recipient of the fine, to the country’s prosecution for a criminal investigation.

Read more »

Some M1 Mac mini owners suffer Bluetooth connectivity proble...
Life hasn’t been as sweet as it should be for some M1 Mac mini owners. A number of users are being plagued by Bluetooth connectivity issues, which can cause wireless peripherals to frequently disconnect. The number of complaints is growing online, and it seems the only real fix is to use a third-party Bluetooth adapter.This […] (via Cult of Mac - Tech and culture through an Apple lens)

Read more »

10 must-have apps for your new Apple Watch
The Apple Watch is great right out of the box, but you’ll want to add a few apps to really make it sing. Apple’s wearable is a true marvel, and the Series 6 is the best yet, but you’ll never know just how useful it can be if you don’t expand your horizons a bit.When we think about the Apple Watch apps we just can’t live without, these are at the top of the list. Some are free, some are not, but every single one is worth your while.Updated 11/25/2020: Changed our list of recommended apps substantially, thanks to new features in watchOS 7 and a host of new app releases and updates.To read this article in full, please click here

Read more »

Russian YouTuber shows how M1 Mac mini can drive six display...
A Russian YouTuber by the name of Ruslan Tulupov just configured his brand new M1 Mac mini to run six displays and an M1 MacBook Air to drive five displays. Which is both bonkers and amazing. In its documentation, Apple says that the M1 MacBook Air and 13-inch MacBook only support up to 1 external […]

Read more »

Comcast to implement 1.2 terabyte data cap for 12 states and...
1.2 terabytes of data seems like a lot. Until it isn’t. Comcast on Wednesday announced that it would implement a 1.2 terabyte data cap to 12 states as well as the District of Columbia in 2021. The provision would affect nearly 28 million residential Internet customers throughout Connecticut, Delaware, Massachusetts, Maryland, Maine, New Hampshire, New […]

Read more »

Ring Mailbox Sensor Review: With this gadget, the postman ne...
Ring’s new sensor gives you a heads-up when the mail arrives, but its limited range won’t work for everyone.

Read more »

Apple HomePod Mini review: Apple’s $99 smart speaker needs...
If the HomePod Mini were $50 rather than $99, we’d really have something.

Read more »

How to Enter and Exit Full Screen Mode and Use Split Screen ...
Use the macOS Full Screen and Split Screen features to increase your productivity. The post How to Enter and Exit Full Screen Mode and Use Split Screen in macOS appeared first on The Mac Security Blog.

Read more »

How to manage iTunes Store and App Store Subscriptions
You may have lots of subscriptions with Apple; here's how to manage them. The post appeared first on The Mac Security Blog.

Read more »

How to Use Activity Monitor to Troubleshoot Problems on a Ma...
Activity Monitor is a useful tool you can use when troubleshooting problems with your Mac. Here's how to use it. The post How to Use Activity Monitor to Troubleshoot Problems on a Mac appeared first on The Mac Security Blog.

Read more »

How to Prepare Your Mac to Upgrade to macOS Big Sur: the Ult...
Apple has released macOS Big Sur. Here's how to prepare to upgrade to the latest Mac operating system. The post How to Prepare Your Mac to Upgrade to macOS Big Sur: the Ultimate Guide appeared first on The Mac Security Blog.

Read more »

Understanding User Accounts in macOS
User accounts are essentially in macOS. Learn how to create and manage user accounts on your Mac, and how to set time limits for your kids. The post appeared first on The Mac Security Blog.

Read more »

How to Configure and Use Control Center in macOS Big Sur
Control Center, new in macOS Big Sur, gives you quick access to system settings. The post appeared first on The Mac Security Blog.

Read more »

Apple Launches New Macs, and Big Sur Arrives – Intego Mac ...
Apple announced three new Macs with its own processors, the first of a transition of the complete line of Macs to Apple silicon that should be complete in about two years. At the same time, macOS Big Sur is released. We discuss the new Macs, Apple's M1 "system on a chip", and a two-year old Apple bug that still hasn't been fixed. The post Apple Launches New Macs, and Big Sur Arrives – Intego Mac Podcast Episode 161 appeared first on The Mac Security Blog.

Read more »

Apple Announces First Macs with Apple Silicon
Apple has released the first Macs with their own custom chip, the M1, which promises huge gains in performance and battery life. The post appeared first on The Mac Security Blog.

Read more »

Patch Tuesday, November 2020 Edition
Adobe and Microsoft each issued a bevy of updates today to plug critical security holes in their software. Microsoft's release includes fixes for 112 separate flaws, including one zero-day vulnerability that is already being exploited to attack Windows users. Microsoft also is taking flak for changing its security advisories and limiting the amount of information disclosed about each bug.

Read more »

Ransomware Group Turns to Facebook Ads
It's bad enough that many ransomware gangs now have blogs where they publish data stolen from companies that refuse to make an extortion payment. Now, one crime group has started using hacked Facebook accounts to run ads publicly pressuring their ransomware victims into paying up.

Read more »

Vulnerability Summary for the Week of November 2, 2020
Original release date: November 9, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary code as SYSTEM. Exploitation of this issue requires an attacker to socially engineer a victim, or the attacker must already have some access to the environment. 2020-11-05 9.3 CVE-2020-24433 MISC google -- chrome Heap buffer overflow in UI in Google Chrome on Windows prior to 86.0.4240.183 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 7.5 CVE-2020-16011 SUSE SUSE MISC MISC qnap -- music_station If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. 2020-11-02 7.5 CVE-2018-19950 CONFIRM qualcomm -- agatti_firmware u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 10 CVE-2020-3654 CONFIRM MISC qualcomm -- agatti_firmware u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral system enter into dead lock state.(This CVE is equivalent to InvalidConnectionRequest(CVE-2019-19193) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, AR9344, Bitra, IPQ5018, Kamorta, MDM9607, MDM9640, MDM9650, MSM8996AU, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA9377, QCA9886, QCM6125, QCN7605, QCS404, QCS405, QCS605, QCS610, QRB5165, Rennell, SA415M, SA515M, Saipan, SC7180, SC8180X, SDA845, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 7.8 CVE-2020-3704 CONFIRM MISC qualcomm -- agatti_firmware u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, Bitra, Kamorta, Nicobar, QCA6390, QCS404, QCS605, QCS610, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC7180, SC8180X, SDA845, SDM670, SDM710, SDM845, SDM850, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 7.2 CVE-2020-3690 CONFIRM MISC qualcomm -- agatti_firmware u'Possible buffer overflow while updating output buffer for IMEI and Gateway Address due to lack of check of input validation for parameters received from server' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in Agatti, Kamorta, Nicobar, QCM6125, QCS610, Rennell, SA415M, Saipan, SC7180, SC8180X, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-11-02 10 CVE-2020-3692 CONFIRM MISC qualcomm -- agatti_firmware u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Bitra, Kamorta, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, Nicobar, QCA6390, QCA6574AU, QCM2150, QCS605, QM215, Rennell, SA6155P, SA8155P, Saipan, SDA660, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 10 CVE-2020-3673 CONFIRM MISC qualcomm -- apq8009_firmware u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered client through webserver due to lack of array bound check.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8953, MSM8996AU, QCA6574AU, QCS405, QCS610, QRB5165, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM630, SDM632, SDM636, SDM660, SDM845, SDX20, SDX24, SDX55, SM8250 2020-11-02 10 CVE-2020-3657 CONFIRM MISC qualcomm -- apq8009_firmware u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 2020-11-02 8.3 CVE-2020-11155 CONFIRM MISC qualcomm -- apq8009_firmware u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 2020-11-02 8.3 CVE-2020-11154 CONFIRM MISC qualcomm -- apq8053_firmware u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow issue (CVE-2019-16336,CVE-2019-17519) and Silent Length Overflow issue(CVE-2019-17518) mentioned in sweyntooth paper)' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8076, AR9344, Bitra, Kamorta, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, Nicobar, QCA6174A, QCA9377, QCM2150, QCM6125, QCS404, QCS405, QCS605, QCS610, QM215, Rennell, SC8180X, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130 2020-11-02 7.5 CVE-2020-3703 CONFIRM MISC qualcomm -- apq8053_firmware u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in APQ8053, QCA6390, QCA9379, QCN7605, SC8180X, SDX55 2020-11-02 10 CVE-2020-11153 CONFIRM MISC qualcomm -- ipq4019_firmware u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ6018, IPQ8064, IPQ8074, QCA9531, QCA9980 2020-11-02 7.5 CVE-2020-11172 CONFIRM MISC whatsapp -- whatsapp A use-after-free in a logging library in WhatsApp for iOS prior to v2.20.111 and WhatsApp Business for iOS prior to v2.20.111 could have resulted in memory corruption, crashes and potentially code execution. This could have happened only if several events occurred together in sequence, including receiving an animated sticker while placing a WhatsApp video call on hold. 2020-11-03 7.5 CVE-2020-1909 CONFIRM wordpress -- wordpress WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php. 2020-11-02 7.5 CVE-2020-28032 MISC MLIST MISC MISC DEBIAN wordpress -- wordpress WordPress before 5.5.2 allows attackers to gain privileges via XML-RPC. 2020-11-02 7.5 CVE-2020-28035 MLIST MISC DEBIAN wordpress -- wordpress wp-includes/class-wp-xmlrpc-server.php in WordPress before 5.5.2 allows attackers to gain privileges by using XML-RPC to comment on a post. 2020-11-02 7.5 CVE-2020-28036 MISC MLIST MISC MISC DEBIAN wordpress -- wordpress is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation). 2020-11-02 7.5 CVE-2020-28037 MISC MLIST MISC MISC DEBIAN Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a signature verification bypass that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 6.8 CVE-2020-24429 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability that could result in a memory address leak. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 4.3 CVE-2020-24438 MISC adobe -- acrobat Acrobat Reader versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an input validation vulnerability when decoding a crafted codec that could result in the disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 4.3 CVE-2020-24427 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 5.1 CVE-2020-24428 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 5.8 CVE-2020-24431 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 4.3 CVE-2020-24434 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 4.3 CVE-2020-24426 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2020-11-05 6.8 CVE-2020-24437 MISC MISC adobe -- acrobat Acrobat Pro DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by an out-of-bounds write vulnerability that could result in writing past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. This vulnerability requires user interaction to exploit in that the victim must open a malicious document. 2020-11-05 6.8 CVE-2020-24436 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a crafted .pdf file in Acrobat Reader. 2020-11-05 6.8 CVE-2020-24435 MISC MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) and Adobe Acrobat Pro DC 2017.011.30175 (and earlier) are affected by an improper input validation vulnerability that could result in arbitrary JavaScript execution in the context of the current user. To exploit this issue, an attacker must acquire and then modify a certified PDF document that is trusted by the victim. The attacker then needs to convince the victim to open the document. 2020-11-05 6.8 CVE-2020-24432 MISC adobe -- acrobat Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a use-after-free vulnerability when handling malicious JavaScript. This vulnerability could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file. 2020-11-05 6.8 CVE-2020-24430 MISC basercms -- basercms baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1. 2020-10-30 6.5 CVE-2020-15277 MISC MISC CONFIRM google -- chrome Use after free in Mojo in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15997 MISC MISC google -- chrome Insufficient policy enforcement in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15992 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in printing in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15993 MISC MISC google -- chrome Out of bounds write in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15995 MISC MISC google -- chrome Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16006 SUSE SUSE MISC MISC google -- chrome Use after free in passwords in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15996 MISC MISC google -- chrome Insufficient policy enforcement in ANGLE in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16005 SUSE SUSE MISC MISC google -- chrome Use after free in USB in Google Chrome prior to 86.0.4240.99 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15998 MISC MISC google -- chrome Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16000 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in media in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16001 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in PDFium in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. 2020-11-03 6.8 CVE-2020-16002 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16004 SUSE SUSE MISC MISC google -- chrome Use after free in autofill in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15990 SUSE MISC MISC FEDORA FEDORA google -- chrome Insufficient data validation in dialogs in Google Chrome on OS X prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15977 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in password manager in Google Chrome prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15991 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in printing in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16003 SUSE MISC MISC FEDORA FEDORA google -- chrome Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 86.0.4240.75 allowed a remote attacker who convinced the user to open files to execute arbitrary code via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15988 SUSE MISC MISC FEDORA FEDORA google -- chrome Inappropriate implementation in cache in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15982 SUSE MISC MISC FEDORA FEDORA google -- chrome Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15999 SUSE MISC MISC FEDORA google -- chrome Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16010 MISC MISC google -- chrome Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15979 SUSE MISC MISC FEDORA FEDORA google -- chrome Inappropriate implementation in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to spoof security UI via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15985 SUSE MISC MISC FEDORA FEDORA google -- chrome Insufficient policy enforcement in Omnibox in Google Chrome on iOS prior to 86.0.4240.75 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted URL. 2020-11-03 4.3 CVE-2020-15984 SUSE MISC MISC FEDORA FEDORA google -- chrome Integer overflow in Blink in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to bypass site isolation via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15974 SUSE MISC MISC FEDORA FEDORA google -- chrome Integer overflow in media in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15986 SUSE MISC MISC FEDORA FEDORA google -- chrome Out of bounds read in audio in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. 2020-11-03 4.3 CVE-2020-15981 SUSE MISC MISC FEDORA FEDORA google -- chrome Inappropriate implementation in networking in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page. 2020-11-03 4.3 CVE-2020-6557 SUSE MISC MISC FEDORA FEDORA google -- chrome Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-16009 SUSE SUSE MISC MISC google -- chrome Insufficient data validation in webUI in Google Chrome on ChromeOS prior to 86.0.4240.75 allowed a local attacker to bypass content security policy via a crafted HTML page. 2020-11-03 4.4 CVE-2020-15983 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in V8 in Google Chrome prior to 86.0.4240.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15994 MISC MISC google -- chrome Integer overflow in SwiftShader in Google Chrome prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15975 SUSE MISC MISC FEDORA FEDORA google -- chrome Use after free in WebXR in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15976 SUSE MISC MISC FEDORA FEDORA google -- chrome Insufficient data validation in navigation in Google Chrome on Android prior to 86.0.4240.75 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. 2020-11-03 6.8 CVE-2020-15978 SUSE MISC MISC FEDORA FEDORA ibm -- i2_ibase IBM i2 iBase 8.9.13 could allow an attacker to upload arbitrary executable files which, when executed by an unsuspecting victim could result in code execution. IBM X-Force ID: 184579. 2020-10-30 6.8 CVE-2020-4588 XF CONFIRM ibm -- i2_ibase IBM i2 iBase 8.9.13 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184574. 2020-10-30 5 CVE-2020-4584 XF CONFIRM icewarp -- mail_server IceWarp 11.4.5.0 allows XSS via the language parameter. 2020-11-02 4.3 CVE-2020-27982 MISC jenkins -- active_directory A cross-site request forgery (CSRF) vulnerability in Jenkins Active Directory Plugin 2.19 and earlier allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials. 2020-11-04 4.3 CVE-2020-2303 MLIST CONFIRM jenkins -- active_directory A missing permission check in Jenkins Active Directory Plugin 2.19 and earlier allows attackers with Overall/Read permission to access the domain health check diagnostic page. 2020-11-04 4 CVE-2020-2302 CONFIRM jenkins -- aws_global_configuration A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration. 2020-11-04 4 CVE-2020-2311 CONFIRM jenkins -- azure_key_vault A missing permission check in Jenkins Azure Key Vault Plugin 2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. 2020-11-04 4 CVE-2020-2313 CONFIRM jenkins -- kubernetes A missing permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to list global pod template names. 2020-11-04 4 CVE-2020-2308 CONFIRM jenkins -- kubernetes A missing/An incorrect permission check in Jenkins Kubernetes Plugin 1.27.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. 2020-11-04 4 CVE-2020-2309 CONFIRM jenkins -- mercurial A missing permission check in Jenkins Mercurial Plugin 2.11 and earlier allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations. 2020-11-04 4 CVE-2020-2306 CONFIRM marmind -- marmind A Stored Cross-Site Scripting (XSS) vulnerability in the “Marmind” web application with version 4.1.141.0 allows an attacker to inject code that will later be executed by legitimate users when they open the assets containing the JavaScript code. This would allow an attacker to perform unauthorized actions in the application on behalf of legitimate users or spread malware via the application. By using the “Assets Upload” function, an attacker can abuse the upload function to upload a malicious PDF file containing a stored XSS. 2020-11-05 4.3 CVE-2020-26505 MISC MISC oleacorner -- olea_gift_on_order The Module Olea Gift On Order module through 5.0.8 for PrestaShop enables an unauthenticated user to read arbitrary files on the server via getfile.php?file=/.. directory traversal. 2020-11-02 5 CVE-2020-9368 MISC MISC pimcore -- pimcore The package pimcore/pimcore from 6.7.2 and before 6.8.3 are vulnerable to SQL Injection in data classification functionality in ClassificationstoreController. This can be exploited by sending a specifically-crafted input in the relationIds parameter as demonstrated by the following request: http://vulnerable.pimcore.example/admin/classificationstore/relations?relationIds=[{"keyId"%3a"''","groupId"%3a"'asd'))+or+1%3d1+union+(select+1,2,3,4,5,6,name,8,password,'',11,12,'',14+from+users)+--+"}] 2020-10-30 6.5 CVE-2020-7759 CONFIRM CONFIRM qnap -- music_station If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. 2020-11-02 4.3 CVE-2018-19951 CONFIRM qnap -- music_station If exploited, this SQL injection vulnerability could allow remote attackers to obtain application information. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11. 2020-11-02 5 CVE-2018-19952 CONFIRM qnap -- photo_station The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. 2020-11-02 4.3 CVE-2018-19956 CONFIRM qnap -- photo_station The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. 2020-11-02 4.3 CVE-2018-19955 CONFIRM qnap -- photo_station The cross-site scripting vulnerability has been reported to affect earlier versions of Photo Station. If exploited, the vulnerability could allow remote attackers to inject malicious code. This issue affects: QNAP Systems Inc. Photo Station versions prior to 5.7.11; versions prior to 6.0.10. 2020-11-02 4.3 CVE-2018-19954 CONFIRM qualcomm -- agatti_firmware u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8953, MSM8996AU, QCA6390, QCA9531, QCM2150, QCS404, QCS405, QCS605, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 4.6 CVE-2020-11174 CONFIRM MISC qualcomm -- agatti_firmware u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Bitra, Kamorta, QCA6390, QCS404, QCS610, Rennell, SA515M, SC7180, SC8180X, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-11-02 4.6 CVE-2020-3638 CONFIRM MISC qualcomm -- agatti_firmware u'A buffer overflow could occur if the API is improperly used due to UIE init does not contain a buffer size a param' in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Agatti, Kamorta, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SXR1130 2020-11-02 4.6 CVE-2020-3678 CONFIRM MISC qualcomm -- agatti_firmware u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element(IEI) NAS message container' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8053, APQ8096AU, APQ8098, Kamorta, MDM9150, MDM9205, MDM9206, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909W, MSM8917, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCM6125, QCS605, QCS610, QM215, Rennell, SA415M, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130 2020-11-02 6.4 CVE-2020-3670 CONFIRM MISC qualcomm -- agatti_firmware u'QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, APQ8098, Bitra, IPQ6018, Kamorta, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8998, Nicobar, QCA6390, QCS404, QCS405, QCS605, QCS610, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC7180, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 4.6 CVE-2020-3684 CONFIRM MISC qualcomm -- agatti_firmware u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8009, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9150, MDM9607, MDM9650, MSM8905, MSM8917, MSM8953, Nicobar, QCA6390, QCA9531, QCM2150, QCS404, QCS405, QCS605, QCS610, QM215, QRB5165, Rennell, SA415M, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDM429, SDM429W, SDM439, SDM450, SDM632, SDM660, SDM670, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130 2020-11-02 4.6 CVE-2020-11125 CONFIRM MISC qualcomm -- agatti_firmware u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in Agatti, APQ8053, Bitra, IPQ4019, IPQ5018, IPQ6018, IPQ8064, IPQ8074, Kamorta, MDM9607, MSM8953, Nicobar, QCA6390, QCS404, QCS405, QCS610, Rennell, SA515M, SA6155P, SA8155P, Saipan, SC8180X, SDA845, SDM429, SDM429W, SDM632, SDM660, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130 2020-11-02 4.4 CVE-2020-11173 CONFIRM MISC qualcomm -- apq8009_firmware u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checking security permission for particular process' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, IPQ4019, IPQ6018, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MSM8905, MSM8909W, MSM8996AU, QCA4531, QCA6574AU, QCA9531, QCM2150, QCS605, SDM429W, SDX20, SDX24 2020-11-02 4.6 CVE-2020-3696 CONFIRM MISC qualcomm -- apq8009_firmware u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8098, Bitra, MSM8909W, MSM8996AU, Nicobar, QCM2150, QCS605, Saipan, SDM429W, SDX20, SM6150, SM8150, SM8250, SXR2130 2020-11-02 4.6 CVE-2020-3693 CONFIRM MISC qualcomm -- apq8009_firmware u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, SA415M, SA515M, SC8180X, SDX55, SM8250 2020-11-02 4.8 CVE-2020-11141 CONFIRM MISC qualcomm -- apq8009_firmware u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, QCA6390, QCN7605, QCN7606, SA415M, SA515M, SA6155P, SA8155P, SC8180X, SDX55 2020-11-02 6.4 CVE-2020-11169 CONFIRM MISC qualcomm -- apq8053_firmware u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8053, APQ8076, MDM9640, MDM9650, MSM8905, MSM8917, MSM8937, MSM8940, MSM8953, QCA6174A, QCA9886, QCM2150, QM215, SDM429, SDM439, SDM450, SDM632 2020-11-02 5 CVE-2020-11157 CONFIRM qualcomm -- bitra_firmware u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in Bitra, Nicobar, Saipan, SM6150, SM8150, SM8250, SXR2130 2020-11-02 4.6 CVE-2020-3694 CONFIRM MISC qualcomm -- qca6390_firmware u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in QCA6390, QCN7605, QCS404, SA415M, SA515M, SC8180X, SDX55, SM8250 2020-11-02 4.8 CVE-2020-11156 CONFIRM MISC trendmicro -- antivirus Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component, that if exploited, could allow an attacker to case a kernel panic or crash.nnrnAn attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. 2020-10-30 6.9 CVE-2020-27014 N/A N/A wordpress -- wordpress WordPress before 5.5.2 allows CSRF attacks that change a theme's background image. 2020-11-02 4.3 CVE-2020-28040 MISC MLIST MISC DEBIAN wordpress -- wordpress WordPress before 5.5.2 allows stored XSS via post slugs. 2020-11-02 4.3 CVE-2020-28038 MISC MLIST MISC DEBIAN wordpress -- wordpress WordPress before 5.5.2 allows XSS associated with global variables. 2020-11-02 4.3 CVE-2020-28034 MLIST MISC DEBIAN wordpress -- wordpress WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. 2020-11-02 5 CVE-2020-28033 MLIST MISC DEBIAN wordpress -- wordpress is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected. 2020-11-02 6.4 CVE-2020-28039 MISC MLIST MISC MISC DEBIAN zte -- zxa10_eodn_firmware A ZTE product is impacted by an information leak vulnerability. An attacker could use this vulnerability to obtain the authentication password of the handheld terminal and access the device illegally for operation. This affects: ZXA10 eODN V2.3P2T1 2020-11-05 4 CVE-2020-6877 MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info basercms -- basercms baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. The issue affects the following components: Edit feed settings, Edit widget area, Sub site new registration, New category registration. Arbitrary JavaScript may be executed by entering specific characters in the account that can access the file upload function category list, subsite setting list, widget area edit, and feed list on the management screen. The issue was introduced in version 4.0.0. It is fixed in version 4.4.1. 2020-10-30 3.5 CVE-2020-15273 MISC CONFIRM MISC basercms -- basercms baserCMS before version 4.4.1 is vulnerable to Cross-Site Scripting. Arbitrary JavaScript may be executed by entering a crafted nickname in blog comments. The issue affects the blog comment component. It is fixed in version 4.4.1. 2020-10-30 3.5 CVE-2020-15276 MISC MISC CONFIRM evms -- redcap A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a message and send it to anyone on the platform including admins. The XSS payload would execute on the other account without interaction from the user on several pages. 2020-11-02 3.5 CVE-2020-27359 MISC MISC MISC nedi -- nedi NeDi 1.9C allows inc/rt-popup.php d XSS. 2020-11-02 3.5 CVE-2020-23868 MISC nedi -- nedi NeDi 1.9C allows pwsec.php oid XSS. 2020-11-02 3.5 CVE-2020-23989 MISC trendmicro -- antivirus Trend Micro Antivirus for Mac 2020 (Consumer) contains an Error Message Information Disclosure vulnerability that if exploited, could allow kernel pointers and debug messages to leak to userland. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability. 2020-10-30 2.1 CVE-2020-27015 N/A N/A Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info adobe -- acrobat_reader_dc   Acrobat Reader DC for macOS versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a security feature bypass. While the practical security impact is minimal, a defense-in-depth fix has been implemented to further harden the Adobe Reader update process. 2020-11-05 not yet calculated CVE-2020-24439 MISC alerta -- alerta   In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients. 2020-11-06 not yet calculated CVE-2020-26214 MISC MISC MISC CONFIRM MISC MISC apache -- shiro   Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass. 2020-11-05 not yet calculated CVE-2020-17510 MLIST MISC aruba -- airwave_software   A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. 2020-11-04 not yet calculated CVE-2020-7129 MISC aruba -- airwave_software   A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. 2020-11-04 not yet calculated CVE-2020-7128 MISC asterisk -- asterisk_open_source   A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certified Asterisk before 16.8-cert5. Upon receiving a new SIP Invite, Asterisk did not return the created dialog locked or referenced. This caused a gap between the creation of the dialog object, and its next use by the thread that created it. Depending on some off-nominal circumstances and timing, it was possible for another thread to free said dialog in this gap. Asterisk could then crash when the dialog object, or any of its dependent objects, were dereferenced or accessed next by the initial-creation thread. Note, however, that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS, but not UDP) for SIP transport. Also, the remote client must be authenticated, or Asterisk must be configured for anonymous calling. 2020-11-06 not yet calculated CVE-2020-28327 MISC asterisk -- asterisk_open_source   An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur. 2020-11-06 not yet calculated CVE-2020-28242 MISC audimexee -- audimexee   AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter "unique_error_numbers" is not set, remote attackers can inject arbitrary web script or HTML via 'action, cargo, panel' parameters that can lead to data leakage. 2020-11-05 not yet calculated CVE-2020-28047 MISC audimexee -- audimexee   SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the object_path parameter. 2020-11-05 not yet calculated CVE-2020-28115 MISC auth0 -- ad-idap-connector   ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection, which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions

Read more »

Apple announces Black Friday/Cyber Monday 4-Day shopping eve...
Apple has announced their deals for the four day Black Friday/Cyber Monday 2020 event. Receive a free $200 Apple Store gift card with the purchase of select Macs and $50-$100 with various iPads. Get a $50 Apple Store Gift Card with iPhone SE, 11, and XR models as well as Apple Watch Series 3 and HomePod. A $25 gift card is available with the purchase of AirPods and 4K Apple TV. Apple’s shopping event takes place from Friday, November 27th through Monday, December 30th. The following card amounts will be available during those dates only; all include free shipping and are in stock right now: Macs: – MacBook Pros: $150 Gift Card – iMacs: $150 Gift Card iPhones: – iPhone SE, 11, XR: $50 Gift Card iPads: – 11″ & 12″ iPad Pros: $100 gift card – iPad mini 5: $50 gift card AirPods: – AirPods (non-Pro): $25 Gift Card Apple Watch: – Apple Watch Series 3: $25 Gift Card HomePod: – HomePods: $50-$100 Gift Card Apple TV: – 4K Apple TVs: $25 Gift Card Beats Products: – Beats Studio3 Wireless: $50 Gift Card – Beats Solo3 Wireless, Powerbeats3 Wireless, or Powerbeats Pro: $50 Gift Card Not in the US? Click for the Canada or the

Read more »

Apple announces Black Friday/Cyber Monday 4-Day shopping eve...
Apple has announced their deals for the four day Black Friday/Cyber Monday 2020 event. Receive a free $200 Apple Store gift card with the purchase of select Macs and $50-$100 with various iPads. Get a $50 Apple Store Gift Card with iPhone SE, 11, and XR models as well as Apple Watch Series 3 and HomePod. A $25 gift card is available with the purchase of AirPods and 4K Apple TV. Apple’s shopping event takes place from Friday, November 27th through Monday, December 30th. The following card amounts will be available during those dates only; all include free shipping and are in stock right now: Macs: – MacBook Pros: $150 Gift Card – iMacs: $150 Gift Card iPhones: – iPhone SE, 11, XR: $50 Gift Card iPads: – 11″ & 12″ iPad Pros: $100 gift card – iPad mini 5: $50 gift card AirPods: – AirPods (non-Pro): $25 Gift Card Apple Watch: – Apple Watch Series 3: $25 Gift Card HomePod: – HomePods: $50-$100 Gift Card Apple TV: – 4K Apple TVs: $25 Gift Card Beats Products: – Beats Studio3 Wireless: $50 Gift Card – Beats Solo3 Wireless, Powerbeats3 Wireless, or Powerbeats Pro: $50 Gift Card Not in the US? Click for the Canada or the

Read more »

Black Friday 2020 Sale: 13″ 2.0GHz Intel MacBook Pros for ...
Amazon has 2020 13″ MacBook Pros with 10th generation Intel CPUs on sale for $250-$200 off Apple’s MSRP as part of their Black Friday week 2020 sale. Shipping is free. Be sure to purchase the MacBook Pro from Amazon, rather than a third-party seller, and note that Amazon may sell out (or change their price) at any time. These are the same MacBook Pros sold by Apple in their retail and online stores: – 2020 13″ 2.0GHz/512GB MacBook Pro Space Gray: $1549.99 $250 off MSRP – 2020 13″ 2.0GHz/512GB MacBook Pro Silver: $1549.99 $250 off MSRP Note that the 512GB models listed above include an extra $100 instant discount applied in your Amazon shopping cart during checkout. – 2020 13″ 2.0GHz/1TB MacBook Pro Space Gray: $1799 $200 off MSRP – 2020 13″ 2.0GHz/1TB MacBook Pro Silver: $1799 $200 off MSRP Amazon’s prices are the lowest available for these models from any Apple reseller. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Black Friday 2020 Sale: 12.9″ Apple iPad Pros for up to $1...
Amazon has new 2020 Apple 12.9″ iPad Pros on sale today for up to $150 off MSRP, with prices starting at $899, as part of their Black Friday 2020 week sale. Shipping is free. These are the same iPad Pros sold by Apple in their retail and online stores: – 12″ 128GB WiFi iPad Pro: $899.99 $100 off – 12″ 256GB WiFi iPad Pro: $999 $100 off – 12″ 512GB WiFi iPad Pro: $1149.99 $150 off – 12″ 1TB WiFi iPad Pro: $1349.99 $150 off – 12″ 128GB WiFi + Cell iPad Pro: $1129 $20 off – 12″ 256GB WiFi + Cell iPad Pro: $1149.99 $100 off – 12″ 512GB WiFi + Cell iPad Pro: $1299.99 $150 off – 12″ 1TB WiFi + Cell iPad Pro: $1499.99 $150 off Note that some sale prices may be restricted to either Space Gray or Silver colors. Be sure to make you purchase from Amazon, rather than a third-party seller. Keep an eye on our 12″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Black Friday 2020 Sale! Amazon offers new 11″ iPad Pros fo...
Amazon has 2020 11″ iPad Pros on sale for up to $150 off Apple’s MSRP as part of their Black Friday week 2020 sale. These are the same iPad Pros sold by Apple in its retail and online stores. Be sure to select Amazon as the seller, rather than a third-party, and note that Amazon may sell out at any time. Shipping is free. Note that some sale prices may be restricted to either Space Gray or Silver colors: – 11″ 128GB WiFi iPad Pro: $729.99 $70 off – 11″ 256GB WiFi iPad Pro: $799.99 $100 off – 11″ 512GB WiFi iPad Pro: $999.99 $100 off – 11″ 1TB WiFi iPad Pro: $1149.99 $150 off – 11″ 128GB WiFi + Cellular iPad Pro: $879.99 $70 off – 11″ 256GB WiFi + Cellular iPad Pro: $989.93 $60 off – 11″ 512GB WiFi + Cellular iPad Pro: $1149.99 $100 off – 11″ 1TB WiFi + Cellular iPad Pro: $1299.99 $150 off These sale prices are valid as of Sunday morning, November 22nd, and we are unsure how long Amazon intends to offer Black Friday prices on 11″ models. Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Apple restocks refurbished 2020 13″ 1.4GHz Intel-based Mac...
Apple has restocked clearance, Certified Refurbished, 2020 13″ 1.4GHz 4-Core Intel-based MacBook Pros starting at $1059 and up to $270 off original MSRP. Apple’s one-year warranty is included, shipping is free, and each MacBook has a new outer shell: – 13″ 1.4GHz/256GB Space Gray 4-Core MacBook Pro (MXK32LL/A): $1059 $240 off MSRP – 13″ 1.4GHz/512GB Space Gray 4-Core MacBook Pro (MUHP2LL/A): $1229 $270 off MSRP – 13″ 1.4GHz/256GB Silver 4-Core MacBook Pro (MXK52LL/A): $1059 $240 off MSRP – 13″ 1.4GHz/512GB Silver 4-Core MacBook Pro (MXK72LL/A): $1229 $270 off MSRP Apple refurbished prices are the cheapest available for 2020 13″ Intel-based MacBook Pros anywhere. Note that stock status may vary–check Apple’ site for availability. For the latest sales & prices, see our 13″ MacBook Pro → Read More...

Read more »

Black Friday 2020 sales event at Sams Club: Apple Watch Seri...
Sams Club has Apple Watch Series 6 models on sale for up to $110 off Apple’s MSRP as part of their Black Friday 2020 sales event. Prices are good until November 24th. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): – 40mm Apple Watch Series 6 GPS + Cellular: $389.98 $110 off MSRP – 44mm Apple Watch Series 6 GPS + Cellular: $419.98 $110 off MSRP – 40mm Apple Watch Series 6 GPS: $329.98 $70 off MSRP – 40mm Apple Watch Series 6 GPS: $359.98 $70 off MSRP Sams’ prices are currently the lowest for Series 6 Watches anywhere. For the latest prices and sales, keep an eye on our Apple Watch Price Tracker, → Read More...

Read more »

Black Friday 2020 sales event at Sams Club: Apple Watch Seri...
Sams Club has Apple Watch Series 6 models on sale for up to $110 off Apple’s MSRP as part of their Black Friday 2020 sales event. Prices are good until November 24th. $45 Sams Club Membership required. Note that sale prices are for online orders only, in-store prices may vary. Choose free shipping or free local store pickup (if available): – 40mm Apple Watch Series 6 GPS + Cellular: $389.98 $110 off MSRP – 44mm Apple Watch Series 6 GPS + Cellular: $419.98 $110 off MSRP – 40mm Apple Watch Series 6 GPS: $329.98 $70 off MSRP – 40mm Apple Watch Series 6 GPS: $359.98 $70 off MSRP Sams’ prices are currently the lowest for Series 6 Watches anywhere. For the latest prices and sales, keep an eye on our Apple Watch Price Tracker, → Read More...

Read more »

Week’s Best Deals: Apple’s M1 13″ MacBook Airs for $51...
Stock of Apple’s hot new 13″ MacBook Airs with M1 Apple Silicon CPUs are trickling into resellers. Here’s where to get the best deal on one of these Airs today. Note that not every configuration is in stock, but all are available for order: (1): Apple reseller DataVision has Apple’s new 2020 13″ MacBook Airs with Apple Silicon M1 processors available for order including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 13″ 2020 MacBook Airs M1 CPU/256GB SSD: $999 – 13″ 2020 MacBook Airs M1 CPU/512GB SSD: $1249 Space Gray, Silver, and Gold colors are available. DataVision will include a free 45 day no-hassle return period in addition to Apple’s standard one-year warranty. (2): Apple reseller Expercom is the first Apple Authorized Reseller to offer sale prices on the new M1 MacBook Airs with Apple Silicon. Expercom expects stock within 1-2 weeks and is accepting preorders today: – 13″ MacBook Air M1 CPU/256GB SSD: $947.96 $51 off MSRP – 13″ MacBook Air M1 CPU/256GB SSD: $1185.71 $64 off MSRP See our 13″ MacBook Air Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

Week’s Best Deals: Apple’s M1 13″ MacBook Airs for $51...
Stock of Apple’s hot new 13″ MacBook Airs with M1 Apple Silicon CPUs are trickling into resellers. Here’s where to get the best deal on one of these Airs today. Note that not every configuration is in stock, but all are available for order: (1): Apple reseller DataVision has Apple’s new 2020 13″ MacBook Airs with Apple Silicon M1 processors available for order including sales tax for NY, NJ, MA, PA, MD, TN, MS, and CA residents only. If you don’t reside in one of those states, you could realize significant savings on your purchase through DataVision, depending on your state’s current sales tax rate. Shipping is free: – 13″ 2020 MacBook Airs M1 CPU/256GB SSD: $999 – 13″ 2020 MacBook Airs M1 CPU/512GB SSD: $1249 Space Gray, Silver, and Gold colors are available. DataVision will include a free 45 day no-hassle return period in addition to Apple’s standard one-year warranty. (2): Apple reseller Expercom is the first Apple Authorized Reseller to offer sale prices on the new M1 MacBook Airs with Apple Silicon. Expercom expects stock within 1-2 weeks and is accepting preorders today: – 13″ MacBook Air M1 CPU/256GB SSD: $947.96 $51 off MSRP – 13″ MacBook Air M1 CPU/256GB SSD: $1185.71 $64 off MSRP See our 13″ MacBook Air Price Tracker for the latest prices & sales from Apple and → Read More...

Read more »

B&H offers Apple’s new M1 Mac minis for up to $40 off ...
B&H Photo has Apple’s new 2020 Mac minis with M1 Silicon on sale for up to $40 off MSRP, starting at only $669. Expedited shipping is free to many addresses in the US: – 2020 Mac mini M1 CPU/256GB SSD: $669 $30 off MSRP – 2020 Mac mini M1 CPU/512GB SSD: $859 $40 off MSRP For the latest prices and sale, see our Mac mini Price Tracker, → Read More...

Read more »

B&H offers early Black Friday $50 discount on Apple’s ...
Apple’s new 2020 13″ MacBook Pros with M1 Apple Silicon CPUs are now on sale at B&H Photo for $50 off MSRP, starting at $1249, as part of their early Black Friday/Cyber Monday 2020 sales event. Free expedited shipping is available for most addresses in the US: – 2020 13″ MacBook Pro Space Gray M1 CPU/256GB SSD: $1249.99 $50 off MSRP – 2020 13″ MacBook Pro Space Gray M1 CPU/512GB SSD: $1449.99 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/256GB SSD: $1249.99 $50 off MSRP – 2020 13″ MacBook Pro Silver M1 CPU/512GB SSD: $1449.99 $50 off MSRP B&H’s $50 discount ties the discount offered by Amazon for these models For the latest prices and sales, see our 13″ MacBook Pro Price Tracker, → Read More...

Read more »