Apple Releases iOS 14.4, iPadOS 14.4 With Camera Warning
Apple has released new software updates on Tuesday. iOS 14.4 and iPadOS 14.4 bring bug fixes, a camera warning, new emojis, Bluetooth device labeling, and more. It can be downloaded by going to Settings > General > Software Update. iOS 14.4 Release Notes Smaller QR codes can be recognized by Camera Option to classify Bluetooth device type in Settings for correct identification of headphones for audio notifications Notifications for when the camera on your ‌iPhone‌ is unable to be verified as a new, genuine Apple camera in ‌iPhone 12‌, iPhone 12 mini, ‌iPhone 12 Pro‌ and iPhone 12 Pro Max This release also fixes the following issues: Image artifacts could appear in HDR photos taken with ‌iPhone 12 Pro‌ Fitness widget may not display updated Activity data Typing may be delayed and word suggestions may not appear in the keyboard The keyboard may not come up in the correct language in Messages Audio stories from the News app in CarPlay may not resume after being paused for spoken directions or Siri Enabling Switch Control in Accessibility may prevent phone calls from being answered from the Lock Screen

Read more »

HomePod mini updated with new Handoff experience in OS versi...
Apple has released a new HomePod and HomePod mini software update with a version number of 14.4 and a new Handoff experience for HomePod mini.HomePod OS version 14.4 enables new Handoff experience with haptic feedbackThe HomePod and HomePod mini run a specialized version of tvOS and receive updates sporadically when compared to Apple's other operating systems. Updates generally include bug fixes and improvements for features attached to the larger ecosystem. Read more...

Read more »

iPadOS 14 FAQ: iPadOS 14.4 now available
In September of 2020, Apple launched a brand new version of iPadOS that brings a bunch of new changes to its iconic tablet. Here’s everything that you’re getting, how to get it, and whether your iPad will be able to run it.Update 01/26/21: Apple released iPadOS 14.4.The latest: iPadOS 14.4 is available Apple has released iPadOS 14.4, an update to the iPad operating system that includes some minor improvements and bug fixes. Here are the release notes: iOS 14.4 includes the following improvements for your iPhone: Smaller QR codes can be recognized by Camera Option to classify Bluetooth device type in Settings for correct identification of headphones for audio notifications Notifications for when the camera on your iPhone is unable to be verified as a new, genuine Apple camera in iPhone 12, iPhone 12 mini, iPhone 12 Pro and iPhone 12 Pro Max This release also fixes the following issues:To read this article in full, please click here

Read more »

Apple releases HomePod Software Version 14.4 with new Handof...
Alongside iOS 14.4, Apple today has also released HomePod Software 14.4 with new features for HomePod mini users. The update brings a revamped Handoff experience, new personalized listening suggestions, and more. more… The post Apple releases HomePod Software Version 14.4 with new Handoff experience, more appeared first on 9to5Mac.

Read more »

Plex Arcade launches to let users curate and play ROM games ...
Plex has built a following over the years as one of the best options to curate your media collection and make it available to stream across your Apple and other devices. Now the company is diving into gaming with a notable partnership with Atari to bring some of the most classic games to iPhone, iPad, Apple TV, and more as well as giving users the ability to store and play their own ROM games. more… The post Plex Arcade launches to let users curate and play ROM games and Atari classics on iPhone, Apple TV appeared first on 9to5Mac.

Read more »

Apple releases iOS 14.4 and iPadOS 14.4
Apple today released iOS 14.4 which includes the following improvements for your iPhone. Smaller QR codes can be recognized by Camera… The post appeared first on MacDailyNews.

Read more »

Apple Leadership Shuffle – TMO Daily Observations 2021-01-...
Bryan Chaffin and Charlotte Henry join host Kelly Guimont to discuss new changes in Apple Leadership and speculate on the new regime.

Read more »

Apple releases tvOS 14.4 with bug fixes
Apple on Tuesday released tvOS 14.4 to the public with bug fixes but no known user-facing feature updates.Apple released tvOS 14.4 to the public todayThe company didn't include any release notes on the update's new features. Apple TV software updates are typically minor, focusing on stability, minor user-experience changes, and other under-the-hood tweaks. Read more...

Read more »

Apple releases watchOS 7.3 with Unity watch face, wider ECG ...
Apple has just released watchOS 7.3 to the public with a new Unity watch face and expanded ECG support.The watchOS update includes the usual slate of bug fixes and user experience improvements in addition to a new watch face. Apple announced the Unity watch face and watch band inspired by the Pan-African flag. The band goes on sale February 1 to mark the start of Black History Month.Apple released "Time to Walk" on Monday and watchOS 7.3 brings added support and fixes for the new feature. Users will be able to start a workout and listen to a famous person describe their accomplishments as they walk. Read more...

Read more »

iOS 14.4 and iPadOS 14.4 released with new Find My Items sup...
Apple on Tuesday released iOS 14.4 and iPadOS 14.4 with better HomePod mini Handoff, third-party Find My device support, and various bug fixes.iOS 14.4 and iPadOS 14.4 now availableiOS 14.4 and iPadOS 14.4 had an extended beta period over the holiday with only three developer betas. These updates are focused more on bug fixes than user-facing features. Read more...

Read more »

Apple Execs Discussed Not 'Leaving Money on the Table&#...
In Apple and Epic's ongoing court battle over App Store fees, one of the key sticking points has been Apple's insistence on maintaining a 30 percent cut as a cornerstone of the storefront. But newly revealed Apple executive emails from the case show that the App Store rules that Apple flouts as essential to the fairness of the app economy were carefully negotiated into existence over time in a way that ensured Apple wasn't "leaving money on the table." From a report: The emails date back to a 2011 discussion, which included Apple software and services leader Eddy Cue, around how Apple would handle subscription video applications on the Apple TV -- an important conversation, given the rise in popularity of streaming services. And while the discussion doesn't offer much insight on Apple's existing 30 percent fee for the App Store, it does reveal how malleable those rules were when it came to maximizing profit. The company examined a variety of options, including a 40 percent one-time cut, a 30 percent one-time cut, a 30 percent ongoing fee, or more individualized deals with services like the NBA and MLB. Read more of this story at Slashdot.

Read more »

Cut Fiber Cable Causes Verizon Outage on East Coast
A cut fiber cable has been giving Verizon Fios customers issues on the East Coast. On Twitter, which many still were able to access, people reported they were seeing issues with their Verizon Fios Internet service. Verizon’s customer support team said on Twitter Tuesday that a fiber had been cut in Brooklyn, which could possibly account for some of the issues. The support account on Twitter quickly became inundated with customers asking why their internet was slow and bumpy.

Read more »

Apple TV+ renews ‘Tehran’ spy drama series for Season 2
Apple TV+ has renewed Israeli espionage thriller drama "Tehran" for a second season, the service's first non-English language original… The post appeared first on MacDailyNews.

Read more »

Apple’s long-time hardware lead steps down to work on myst...
It's unusual for the leader of department to shift focus to just one product.

Read more »

Review: Grovemade's premium headphone stand is simple a...
Grovemade's wonderfully elegant wood and leather headphone stand is the best way to display your headphones of choice — be it a set of Sony headphones or your AirPods Max.Simple by designIf there is a way to describe the Grovemade headphone stand — other than beautiful — it would be simple. It is simple in the design, it is simple in function, and it is simple in its materials. Read more...

Read more »

Apparent Verizon Fios outage takes services offline for user...
An apparent widespread Verizon Fios outage is affecting users up and down the east coast of the United States this afternoon. This outage is preventing Fios users from accessing popular services such as Slack, Zoom, and Google Meet, and there is no timetable for when the issues might be resolved. more… The post Apparent Verizon Fios outage takes services offline for users in the northeastern United States appeared first on 9to5Mac.

Read more »

Apple launches limited-edition Apple Watch Series 6 to honor...
Apple on Tuesday launched a new limited-edition Apple Watch Series 6, Sport Band, and watch face, as well as “a variety of new and updated collections and exclusive content that highlight and amplify Black creators, artists, developers, and businesses” to celebrate Black History Month in February.The Apple Watch Series 6 looks the same as the Space Gray aluminum model with one change: on the back, there is a laser-etched bold “Black Unity” around the heart-rate sensor where the model description is. Apple has decreased the kerning on the rest of the words to fit the phrase, which appears in the top right of the circle.To read this article in full, please click here

Read more »

Second-generation AirPods Pro may land in early 2021
Apple could bring out a second-generation version of the AirPods Pro by the end of spring, a report claims, after Apple placed orders for flash memory from one supplier that may be used in the personal audio accessories.Winbond Electronics is said by industry sources of DigiTimes to be benefiting from a "strong pull-in of short lead-time orders, which is filling up its production capacity. These orders are said to be for NOR flash memory, and are claimed to be for use in Apple's AirPods line.The report doesn't state what model exactly will be using the memory, but it hints that it might be for a new model. Report sources claim the company is anticipated to be one of the NOR flash suppliers for the next-generation AirPods Pro release, which is allegedly slated for launch "later in the first half" of 2021. Read more...

Read more »

Apple teams up with fragment design for special edition mono...
Apple has collaborated with revered artist and designer Hiroshi Fujiwara and his company fragment design on new pair of special edition Powerbeats Pro. This version comes with a minimal, monochromatic design on the black Powerbeats Pro. more… The post Apple teams up with fragment design for special edition monochromatic Powerbeats Pro appeared first on 9to5Mac.

Read more »

Anker’s Gold Box highlights today’s best deals, plus App...
Today’s best deals include a new Anker Gold Box at Amazon, plus Apple Watch Series 6 hits one of the best prices yet, and Arlo Q goes on sale. Hit the jump for all that and more in the latest 9to5Toys Lunch Break. more… The post Anker’s Gold Box highlights today’s best deals, plus Apple Watch Series 6 goes on sale, more appeared first on 9to5Mac.

Read more »

Apple TV+ Israeli spy series 'Tehran' renewed for ...
Apple TV+ has officially renewed the espionage thriller "Tehran," following an announcement that producers began work on the second season in early December.In December, production executive Julien Leroux reported that "Tehran" cast and crew began working on the second season before getting the official green light from Apple itself.Deadline reports that Apple has officially called for a second season of "Tehran." The renewal comes four months after the premiere on Apple TV+. Read more...

Read more »

Check out this beautiful collection of Mac OS X Tiger-inspir...
England based designer Hector Simpson has created a beautiful set of new wallpapers for macOS, iOS, and iPadOS inspired by the classic blue wave designs that were a staple in early versions of Mac OS X. The set is called “Aquex” – clearly an homage to aqua. Simpson has designed a wide array of options that use color schemes from more recent versions of macOS as well. The best part, though, is that there are dynamic wallpapers that change throughout the day. more… The post Check out this beautiful collection of Mac OS X Tiger-inspired modern wallpapers appeared first on 9to5Mac.

Read more »

Tim Cook will speak at EU data protection conference about A...
Apple CEO Tim Cook will be making an appearance at the CPDP data protection conference on Thursday, to speak about advertising and Apple's work to protect the privacy of its users.Cook will be taking to the virtual conference stage on Thursday, introducing a session titled "A path to empowering user choice and boosting user trust in advertising." The speech, midway through the three-day conference, is part of Apple's role as a "Premier sponsor" of the conference.While the actual content of the speech isn't disclosed at this time, it will most likely revolve around Apple's general policies regarding data protection and user privacy. Given the title of the session itself, as reported by Macerkopf, it will almost certainly touch upon Apple's new anti-tracking features in iOS 14. Read more...

Read more »

∞ 1984 Macintosh promotional video, starring Bill Gates
[VIDEO] This week marks the anniversary of the original Macintosh rollout. Last week I posted a pair of videos showing the rollout and a marketing video Apple sent around to Apple retailers. Next up is this more widely shared promotional video (embedded in main Loop post) with a starring role by a very young Bill Gates. Enjoy.

Read more »

Today's best deals: 16″ MacBook Pro returns to $2...
Apple resellers have reissued a $300 price drop on multiple 16-inch MacBook Pros, delivering MacBook Pro deals we haven't seen since Black Friday. Tax preparation software from H&R Block is also half off at Amazon, with both Mac and Windows versions eligible for the discount.Today's top dealsKicking off the roundup of deals is a $300 price drop on Apple's standard 16-inch MacBook Pro in Silver and the upgraded retail Core i9 model with 1TB of storage and AMD Radeon Pro 5500M 4GB graphics. Read more...

Read more »

Hands-on with Apple Fitness+ “Time to Walk”
[VIDEO] This is a great walkthrough of the "Time to Walk" setup. Clears up so much. Really well done, worth the watch. Video embedded in main Loop post.∞ Read this on The Loop

Read more »

Developer shows off a custom DIY Apple 5K Display with an iM...
If you want an Apple-branded external display, your sole option nowadays is the $5999 Pro Display XDR. To make matters worse, Apple also deprecated Target Display Mode, which allowed people to use their iMac as an external display for another computer. Nonetheless, these roadblocks didn’t stop one developer from creating a one-of-a-kind 5K iMac Display. more… The post Developer shows off a custom DIY Apple 5K Display with an iMac design appeared first on 9to5Mac.

Read more »

∞ Microsoft’s new ad dissing MacBook Pro in favor of Mic...
[VIDEO] Watch the ad, embedded in the main Loop post, then read on. I find this comparison ridiculous. And disingenuous. That price quoted in the ad gives you a weak-sauce Intel Core i3 processor, along with 128GB of storage and 4GB of RAM. It also includes a pencil and keyboard case. Drop the pencil and keyboard case and the price is $750. Just to make the comparison a bit more equal. If you are going to compare that Surface Pro configuration against an M1 MacBook Pro or, better yet, against the M1 MacBook Air, you really do need to look at the bigger picture. Battery life on the MacBook Air is about twice as long. GeekBench on the Surface Pro 7 (Intel i3, 2 cores): 774 (single core) and 1851 (multi-core) GeekBench on the entry level MacBook Air: 1744 (single core) and 7685 (multi-core) Want to bump your Surface Pro up to an Intel i7? Still much slower than the MacBook Air, but now the price floor (without pencil and case) is $1299. MacBook Air price starts at $999. True, the Surface Pro gives you a built in touch-screen and Windows, if that's your thing, but you pay a price for that. With all that in mind, take another look through that ad.

Read more »

Apple Celebrates Black History Month 2021 With New Apple Wat...
Apple is celebrating Black History Month 2021 with a variety of content as well as a limited edition Apple Watch called Black Unity Collection. It includes an Apple Watch Series 6, a Black Unity Sport Band, and a Unity watch face. Black History Month 2021 Throughout February Apple will feature special content in its services. App Store: Users can visit the App Store Black History Month Hub, which will spotlight Black-owned businesses, developers, entertainment and gaming apps, and social justice apps. Apple Music will launch a monthlong experience across Apple Music, Apple Music radio, and Apple Music TV that highlights musicians spanning jazz, blues, soul, gospel, R&B, pop, and hip hop. Apple Maps: Customers can enjoy curated Apple Maps Guides created in collaboration with EatOkra, a Black-owned business directory app based in Brooklyn, New York. Apple TV app: This month’s theme for “Essential Stories” on the Apple TV app will spotlight the multidimensionality of the Black family and its representation onscreen. Apple News: Apple News readers can explore curated topic groups that will highlight the best journalism around race in America. Apple Books: A broad new collection on Apple Books will highlight great books and audiobooks by Black authors across a variety of genres, including literary fiction, history, memoirs, and books for young readers. Apple Podcasts: On Apple Podcasts, listeners can enjoy an expansive set of shows from powerful Black voices including Michelle Obama, Joe Budden, Phoebe Robinson, and Baratunde Thurston. Apple Fitness+: Apple Fitness+ subscribers can enjoy a collection of themed workouts, featuring all Black artists across Cycling, Dance, High Intensity Interval Training, Strength, Yoga, and Treadmill. These Black History Month activities complement the company’s ongoing commitment to honoring and celebrating Black voices. Earlier this month, Apple announced a set of major new projects as part of its $100 million Racial Equity and Justice Initiative (REJI).

Read more »

Apple CEO Tim Cook to speak at CPDP 2021 EU data protection ...
Tim Cook will speak at the EU data protection conference CPDP on January 28, 2021. This year’s overarching theme “Enforcing Rights… The post Apple CEO Tim Cook to speak at CPDP 2021 EU data protection conference on Thursday appeared first on MacDailyNews.

Read more »

Ubiquiti: Change Your Password, Enable 2FA
Ubiquiti, a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud provider may have exposed customer account information and credentials used to remotely manage Ubiquiti gear.

Read more »

Vulnerability Summary for the Week of January 4, 2021
Original release date: January 11, 2021 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1234n -- minicms Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter. 2021-01-05 7.5 CVE-2020-36052 MISC asciitable.js_project -- asciitable.js The package asciitable.js before 1.0.3 are vulnerable to Prototype Pollution via the main function. 2021-01-04 7.5 CVE-2020-7771 MISC MISC asus -- dsl-n17u_firmware The ASUS DSL-N17U modem with firmware 1.1.0.2 allows attackers to access the admin interface by changing the admin password without authentication via a POST request to Advanced_System_Content.asp with the uiViewTools_username=admin&uiViewTools_Password= and uiViewTools_PasswordConfirm= substrings. 2021-01-04 10 CVE-2020-35219 MISC MISC chatter-social -- creeper Creeper is an experimental dynamic, interpreted language. The binary release of Creeper Interpreter 1.1.3 contains potential malware. The compromised binary release was available for a few hours between December 26, 2020 at 3:22 PM EST to December 26, 2020 at 11:00 PM EST. If you used the source code, you are **NOT** affected. This only affects the binary releases. The binary of unknown quality has been removed from the release. If you have downloaded the binary, please delete it and run a reputable antivirus scanner to ensure that your computer is clean. 2021-01-04 7.5 CVE-2020-26292 CONFIRM clickhouse-driver_project -- clickhouse-driver clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow. 2021-01-06 7.5 CVE-2020-26759 MISC MISC cse_bookstore_project -- cse_bookstore CSE Bookstore version 1.0 is vulnerable to time-based blind, boolean-based blind and OR error-based SQL injection in pubid parameter in bookPerPub.php and in cart.php. A successful exploitation of this vulnerability will lead to an attacker dumping the entire database on which the web application is running. 2021-01-04 7.5 CVE-2020-36112 MISC dell -- emc_isilon_onefs Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges. 2021-01-05 7.2 CVE-2020-26181 MISC djv_project -- djv This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine. 2021-01-04 10 CVE-2020-28464 MISC MISC MISC drivergenius -- drivergenius_firmware MyDrivers64.sys in DriverGenius 9.61.3708.3054 allows attackers to cause a system crash via the ioctl command 0x9c402000 to \.MyDrivers0_0_1. 2021-01-03 7.1 CVE-2020-28841 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. 2021-01-06 7.5 CVE-2020-36185 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsadapter.DriverAdapterCPDS. 2021-01-06 7.5 CVE-2020-36181 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36182 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. 2021-01-07 7.5 CVE-2020-36183 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. 2021-01-06 7.5 CVE-2020-36184 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36179 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. 2021-01-06 7.5 CVE-2020-36186 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. 2021-01-06 7.5 CVE-2020-36187 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. 2021-01-06 7.5 CVE-2020-36188 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. 2021-01-06 7.5 CVE-2020-36189 MISC MISC fasterxml -- jackson-databind FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS. 2021-01-07 7.5 CVE-2020-36180 MISC MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), Q(10.0), and R(11.0) (Exynos chipsets) software. The Mali GPU driver allows out-of-bounds access and a device reset. The Samsung ID is SVE-2020-19174 (January 2021). 2021-01-05 7.1 CVE-2021-22495 MISC ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By sending specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges. IBM X-Force ID: 172452. 2021-01-05 9 CVE-2019-4728 XF CONFIRM ipeak -- ipeakcms ipeak Infosystems ibexwebCMS (aka IPeakCMS) 3.5 is vulnerable to an unauthenticated Boolean-based SQL injection via the id parameter on the /cms/print.php page. 2021-01-05 7.5 CVE-2021-3018 MISC MISC MISC MISC MISC ispconfig -- ispconfig ISPConfig before 3.2.2 allows SQL injection. 2021-01-05 7.5 CVE-2021-3021 MISC MISC linux -- linux_kernel mwifiex_cmd_802_11_ad_hoc_start in drivers/net/wireless/marvell/mwifiex/join.c in the Linux kernel through 5.10.4 might allow remote attackers to execute arbitrary code via a long SSID value, aka CID-5c455c5ab332. 2021-01-05 8.3 CVE-2020-36158 MISC MISC MISC MISC proofpoint -- inside_threat_management rcdsvc in the Proofpoint Insider Threat Management Windows Agent (formerly ObserveIT Windows Agent) before 7.9 allows remote authenticated users to execute arbitrary code as SYSTEM because of improper deserialization over named pipes. 2021-01-06 9 CVE-2020-8884 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10658 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10656 MISC CONFIRM proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 7.5 CVE-2020-10655 MISC CONFIRM redlion -- crimson A NULL pointer deference vulnerability has been identified in the protocol converter. An attacker could send a specially crafted packet that could reboot the device running Crimson 3.1 (Build versions prior to 3119.001). 2021-01-06 7.8 CVE-2020-27279 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20004 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20001 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20002 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 7.5 CVE-2016-20005 MISC thecodingmachine -- gotenberg A directory traversal vulnerability in file upload function of Gotenberg through 6.2.1 allows an attacker to upload and overwrite any writable files outside the intended folder. This can lead to DoS, a change to program behavior, or code execution. 2021-01-07 7.5 CVE-2020-13450 MISC MISC thecodingmachine -- gotenberg An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros. 2021-01-07 7.5 CVE-2020-13451 MISC MISC thecodingmachine -- gotenberg In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can lead to denial of service or code execution. 2021-01-07 7.5 CVE-2020-13452 MISC MISC thedaylightstudio -- fuel_cms FUEL CMS 1.4.11 allows SQL Injection via parameter 'name' in /fuel/permissions/create/. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 2021-01-05 7.5 CVE-2020-26045 MISC MISC MISC uclouvain -- openjpeg A flaw was found in OpenJPEG in versions prior to 2.4.0. This flaw allows an attacker to provide specially crafted input to the conversion or encoding functionality, causing an out-of-bounds read. The highest threat from this vulnerability is system availability. 2021-01-05 7.1 CVE-2020-27843 MISC uclouvain -- openjpeg A flaw was found in openjpeg's src/lib/openjp2/t2.c in versions prior to 2.4.0. This flaw allows an attacker to provide crafted input to openjpeg during conversion and encoding, causing an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. 2021-01-05 8.3 CVE-2020-27844 MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wp_capabilities user meta that defines a user's role. During the registration process, submitted registration details were passed to the update_profile function, and any metadata was accepted, e.g., wp_capabilities[administrator] for Administrator access. 2021-01-04 7.5 CVE-2020-36155 MISC MISC MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a WordPress capability (or any custom Ultimate Member role) and effectively be granted those privileges. 2021-01-04 7.5 CVE-2020-36157 MISC MISC MISC win911 -- mobile-911_server An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen, an attacker can overwrite the service executable and execute arbitrary code with System privileges or replace other files within the installation folder that could lead to local privilege escalation. 2021-01-05 7.2 CVE-2020-13541 MISC Back to top   Medium Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 1234n -- minicms Directory traversal vulnerability in page_edit.php in MiniCMS V1.10 allows remote attackers to read arbitrary files via the state parameter. 2021-01-05 5 CVE-2020-36051 MISC advancedcustomfields -- advanced_custom_fields The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns, potentially leading to XSS. 2021-01-06 4.3 CVE-2020-36172 MISC apache -- flink Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master. 2021-01-05 5 CVE-2020-17518 MLIST MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST MLIST apache -- flink A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master. 2021-01-05 5 CVE-2020-17519 MISC MLIST MLIST MLIST MLIST MLIST MISC MLIST MLIST MLIST broadcom -- ca_service_catalog CA Service Catalog 17.2 and 17.3 contain a vulnerability in the default configuration of the Setup Utility that may allow a remote attacker to cause a denial of service condition. 2021-01-05 5 CVE-2020-29478 CONFIRM dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29502 MISC dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29501 MISC dell -- emc_powerstore_firmware Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. 2021-01-05 4.6 CVE-2020-29500 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain an open redirect vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites. 2021-01-04 5.8 CVE-2020-29498 MISC dell -- wyse_thinos Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to access the writable file and manipulate the configuration of any target specific station. 2021-01-04 6.4 CVE-2020-29492 MISC dell -- wyse_thinos Dell Wyse ThinOS 8.6 and prior versions contain an insecure default configuration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to gain access to the sensitive information on the local network, leading to the potential compromise of impacted thin clients. 2021-01-04 5 CVE-2020-29491 MISC digisol -- dg-hr3400_firmware Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter. 2021-01-06 4.3 CVE-2020-35262 MISC MISC MISC dovecot -- dovecot An issue was discovered in Dovecot before 2.3.13. By using IMAP IDLE, an authenticated attacker can trigger unhibernation via attacker-controlled parameters, leading to access to other users' email messages (and path disclosure). 2021-01-04 6.5 CVE-2020-24386 MISC FULLDISC CONFIRM MISC CONFIRM MISC GENTOO DEBIAN dovecot -- dovecot Dovecot before 2.3.13 has Improper Input Validation in lda, lmtp, and imap, leading to an application crash via a crafted email message with certain choices for ten thousand MIME parts. 2021-01-04 5 CVE-2020-25275 MISC FULLDISC CONFIRM CONFIRM MISC GENTOO DEBIAN expresstech -- quiz_and_survey_master An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. This occurred via qsm_remove_file_fd_question, which allowed unauthenticated deletions (even though it was only intended for a person to delete their own quiz-answer files). 2021-01-01 6.4 CVE-2020-35951 MISC MISC ffmpeg -- ffmpeg decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds write because of errors in calculations of when to perform memset zero operations. 2021-01-04 5 CVE-2020-35965 MISC MISC MISC ffmpeg -- ffmpeg track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bounds write because of incorrect extradata packing. 2021-01-03 4.3 CVE-2020-35964 MISC MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20313 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. 2021-01-07 6.8 CVE-2018-20312 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20315 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20314 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read, a different issue than CVE-2018-20310 because of a different opcode. 2021-01-07 6.8 CVE-2018-20316 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20311 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20309 MISC foxitsoftware -- phantompdf Foxit Reader before 9.5, and PhantomPDF before 8.3.10 and 9.x before 9.5, has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read. 2021-01-07 6.8 CVE-2018-20310 MISC gigamon -- gigavue-os GigaVUE-OS (GVOS) 5.4 - 5.9 stores a Redis database password in plaintext. 2021-01-05 4 CVE-2020-23249 MISC gjson_project -- gjson GJSON out-of-bounds read that could lead to an impact to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35493 MISC FEDORA gnu -- binutils There's a flaw in binutils /bfd/pef.c. An attacker who is able to submit a crafted input file to be processed by the objdump program could cause a null pointer dereference. The greatest threat from this flaw is to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35495 MISC FEDORA gnu -- binutils There's a flaw in bfd_pef_parse_function_stubs of bfd/pef.c in binutils which could allow an attacker who is able to submit a crafted file to be processed by objdump to cause a NULL pointer dereference. The greatest threat of this flaw is to application availability. This flaw affects binutils versions prior to 2.34. 2021-01-04 4.3 CVE-2020-35507 MISC gnu -- glibc The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read. 2021-01-04 5 CVE-2019-25013 MISC MISC golang -- go In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) 2021-01-02 5 CVE-2020-28851 MISC golang -- go In x/text in Go 1.15.4, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.) 2021-01-02 5 CVE-2020-28852 MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The quram library allows attackers to execute arbitrary code or cause a denial of service (memory corruption) during dng decoding. The Samsung ID is SVE-2020-18811 (January 2021). 2021-01-05 6.8 CVE-2021-22493 MISC google -- android An issue was discovered in the fingerprint scanner on Samsung Note20 mobile devices with Q(10.0) software. When a screen protector is used, the required image compensation is not present. Consequently, inversion can occur during fingerprint enrollment, and a high False Recognition Rate (FRR) can occur. The Samsung ID is SVE-2020-19216 (January 2021). 2021-01-05 4.3 CVE-2021-22494 MISC google -- android An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) (Broadcom Bluetooth chipsets) software. The Bluetooth UART driver has a buffer overflow. The Samsung ID is SVE-2020-18731 (January 2021). 2021-01-05 5.8 CVE-2021-22492 MISC hp -- integrated_lights-out_4 A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4) firmware. The vulnerability could be remotely exploited to disclose the serial number and other information. 2021-01-05 5 CVE-2020-7202 MISC htmlsanitizer_project -- htmlsanitizer HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372, there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `` tag so there is no risk if you have not explicitly allowed the `` tag. The problem has been fixed in version 5.0.372. 2021-01-04 4.3 CVE-2020-26293 MISC MISC CONFIRM MISC ibm -- api_connect IBM API Connect 5.0.0.0 through 5.0.8.10 could potentially leak sensitive information or allow for data corruption due to plain text transmission of sensitive information across the network. IBM X-Force ID: 190990. 2021-01-05 6.4 CVE-2020-4899 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191391. 2021-01-04 6.8 CVE-2020-4917 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could allow a local privileged attacker to upload arbitrary files. By intercepting the request and modifying the file extention, the attacker could execute arbitrary code on the server. IBM X-Force ID: 191705. 2021-01-04 4.6 CVE-2020-4928 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 Self Service Console could allow a privilege escalation by capturing the user request URL when logged in as a privileged user. IBM X-Force ID: 191287. 2021-01-04 6.5 CVE-2020-4912 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 has insufficient logout controls which could allow an authenticated privileged user to impersonate another user on the system. IBM X-Force ID: 191395. 2021-01-04 5.5 CVE-2020-4919 XF CONFIRM ibm -- curam_social_program_management IBM Curam Social Program Management 7.0.9 and 7.0.11 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 191942. 2021-01-04 6.8 CVE-2020-4942 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 transmits sensitive information in HTTP GET request parameters. This may lead to information disclosure via man in the middle methods. IBM X-Force ID: 190984. 2021-01-07 4.3 CVE-2020-4893 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 190989. 2021-01-07 5 CVE-2020-4898 XF CONFIRM ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow an authenticated user to create a privileged account due to improper access controls. IBM X-Force ID: 188896. 2021-01-05 6.5 CVE-2020-4762 XF CONFIRM ibm -- sterling_b2b_integrator IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2, 6.0.0.0 through 6.0.3.2, and 6.1.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 188895. 2021-01-05 5 CVE-2020-4761 XF CONFIRM invisioncommunity -- ips_community_suite Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment. 2021-01-05 4.3 CVE-2021-3026 MISC kamadak-exif_project -- kamadak-exif kamadak-exif is an exif parsing library written in pure Rust. In kamadak-exif version 0.5.2, there is an infinite loop in parsing crafted PNG files. Specifically, reader::read_from_container can cause an infinite loop when a crafted PNG file is given. This is fixed in version 0.5.3. No workaround is available. Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected. 2021-01-06 4.3 CVE-2021-21235 MISC MISC CONFIRM lanproxy_project -- lanproxy ffay lanproxy 0.1 allows Directory Traversal to read /../conf/config.properties to obtain credentials for a connection to the intranet. 2021-01-05 5 CVE-2021-3019 MISC MISC limit_login_attempts_project -- limit_login_attempts The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts. 2021-01-06 5 CVE-2012-10001 MISC loopring -- loopring The sellTokenForLRC function in the vault protocol in the smart contract implementation for Loopring (LRC), an Ethereum token, lacks access control for fee swapping and thus allows price manipulation. 2021-01-03 5 CVE-2020-35962 MISC MISC mcafee -- network_security_management Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request. 2021-01-05 4.3 CVE-2020-7336 CONFIRM mikrotik -- routeros In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter. 2021-01-04 4.3 CVE-2021-3014 MISC MISC mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows remote attackers to obtain sensitive information (e.g., a CPF number) via a modified titulo (aka invoice number) value to the central/recibo.php URI. 2021-01-03 4 CVE-2021-3005 MISC MISC mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the central/executar_central.php?acao=altsenha_princ URI. 2021-01-04 6.8 CVE-2021-21495 MISC MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. 2021-01-06 5 CVE-2020-36175 MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. 2021-01-06 5 CVE-2020-36173 MISC ninjaforms -- ninja_forms The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. 2021-01-06 4.3 CVE-2020-36174 MISC nxlog -- nxlog The fileop module of the NXLog service in NXLog Community Edition 2.10.2150 allows remote attackers to cause a denial of service (daemon crash) via a crafted Syslog payload to the Syslog service. This attack requires a specific configuration. Also, the name of the directory created must use a Syslog field. (For example, on Linux it is not possible to create a .. directory. On Windows, it is not possible to create a CON directory.) 2021-01-05 4.3 CVE-2020-35488 MISC orangehrm -- orangehrm SQL injection in the Buzz module of OrangeHRM through 4.6 allows remote authenticated attackers to execute arbitrary SQL commands via the orangehrmBuzzPlugin/lib/dao/BuzzDao.php loadMorePostsForm[profileUserId] parameter to the buzz/loadMoreProfile endpoint. 2021-01-05 5.5 CVE-2020-29437 MISC MISC CONFIRM MISC pagelayer -- pagelayer An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks, allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization, but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur. 2021-01-01 6.5 CVE-2020-35947 MISC MISC pagelayer -- pagelayer An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF, which can lead to XSS. 2021-01-01 6.8 CVE-2020-35944 MISC MISC proofpoint -- insider_threat_management_server The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker (with admin or config-admin privileges in the console) to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization. 2021-01-06 6.5 CVE-2020-10657 MISC CONFIRM redlion -- crimson An attacker could send a specially crafted message to Crimson 3.1 (Build versions prior to 3119.001) that could leak arbitrary memory locations. 2021-01-06 5 CVE-2020-27283 MISC redlion -- crimson The default configuration of Crimson 3.1 (Build versions prior to 3119.001) allows a user to be able to read and modify the database without authentication. 2021-01-06 6.4 CVE-2020-27285 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20008 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20003 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20006 MISC rest/json_project -- rest/json The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2016-20007 MISC seal_finance_project -- seal_finance The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021. 2021-01-03 5 CVE-2021-3006 MISC MISC seopanel -- seo_panel Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter. 2021-01-01 4.3 CVE-2021-3002 MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. 2021-01-06 4.9 CVE-2019-16954 MISC MISC MISC stableyieldcredit_project -- stableyieldcredit The _deposit function in the smart contract implementation for Stable Yield Credit (yCREDIT), an Ethereum token, has certain incorrect calculations. An attacker can obtain more yCREDIT tokens than they should. 2021-01-03 5 CVE-2021-3004 MISC MISC thecodingmachine -- gotenberg A directory traversal vulnerability in the Markdown engine of Gotenberg through 6.2.1 allows an attacker to read any container files. 2021-01-07 5 CVE-2020-13449 MISC MISC thedaylightstudio -- fuel_cms FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors. 2021-01-05 4.3 CVE-2020-26046 MISC MISC treasuredata -- fluent_bit flb_gzip_compress in flb_gzip.c in Fluent Bit before 1.6.4 has an out-of-bounds write because it does not use the correct calculation of the maximum gzip data-size expansion. 2021-01-03 6.8 CVE-2020-35963 MISC MISC MISC uclouvain -- openjpeg There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality, they could cause an out-of-bounds read. The highest impact of this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27845 MISC uclouvain -- openjpeg There's a flaw in openjpeg's t2 encoder in versions prior to 2.4.0. An attacker who is able to provide crafted input to be processed by openjpeg could cause a null pointer dereference. The highest impact of this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27842 MISC uclouvain -- openjpeg There's a flaw in openjpeg in versions prior to 2.4.0 in src/lib/openjp2/pi.c. When an attacker is able to provide crafted input to be processed by the openjpeg encoder, this could cause an out-of-bounds read. The greatest impact from this flaw is to application availability. 2021-01-05 4.3 CVE-2020-27841 MISC ultimatemember -- ultimate_member The Ultimate Member plugin before 2.1.13 for WordPress mishandles hidden name="timestamp" fields in forms. 2021-01-06 5 CVE-2020-36170 MISC ultimatemember -- ultimate_member An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role (e.g., Administrator) during a profile update, and effectively escalate their privileges. 2021-01-04 6.5 CVE-2020-36156 MISC MISC MISC veno_file_manager_project -- veno_file_manager Veno File Manager 3.5.6 is affected by a directory traversal vulnerability. Using the traversal allows an attacker to download sensitive files from the server. 2021-01-04 5 CVE-2020-22550 MISC MISC veritas -- desktop_and_laptop_option Veritas Desktop and Laptop Option (DLO) before 9.5 disclosed operational information on the backup processing status through a URL that did not require authentication. 2021-01-05 5 CVE-2020-36159 MISC vikisolutions -- vera An issue was discovered in Viki Vera 4.9.1.26180. A user without access to a project could download or upload project files by opening the Project URL directly in the browser after logging in. 2021-01-05 5.5 CVE-2019-20484 MISC webform_report_project -- webform_report The Webform Report project 7.x-1.x-dev for Drupal allows remote attackers to view submissions by visiting the /rss.xml page. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 5 CVE-2019-25012 MISC win911 -- win-911 An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via “WIN-911 Mobile Runtime” service. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the privileges when executed. 2021-01-05 4.6 CVE-2020-13539 MISC MISC win911 -- win-911 An exploitable local privilege elevation vulnerability exists in the file system permissions of the Win-911 Enterprise V4.20.13 install directory via WIN-911 Account Change Utility. Depending on the vector chosen, an attacker can overwrite various executables which could lead to escalation of the privileges when executed. 2021-01-05 4.6 CVE-2020-13540 MISC Back to top   Low Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info beetel -- 777vr1_firmware Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter. 2021-01-06 3.5 CVE-2020-25498 MISC MISC MISC MISC dell -- emc_unity_operating_environment Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user. 2021-01-05 2.1 CVE-2020-26199 MISC dell -- unisphere Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions. 2021-01-05 3.5 CVE-2020-35170 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 2021-01-04 3.5 CVE-2020-29496 MISC dell -- wyse_management_suite Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with low privileges could exploit this vulnerability to store malicious HTML or JavaScript code under the device tag. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 2021-01-04 3.5 CVE-2020-29497 MISC electronjs -- zonote zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true). 2021-01-01 3.5 CVE-2020-35717 MISC MISC MISC MISC gigamon -- gigavue-os GigaVUE-OS (GVOS) 5.4 - 5.9 uses a weak algorithm for a hash stored in internal database. 2021-01-05 2.1 CVE-2020-23250 MISC google -- android An issue was discovered on LG mobile devices with Android OS 10 software. There was no write protection for the MTK protect2 partition. The LG ID is LVE-SMP-200028 (January 2021). 2021-01-05 2.1 CVE-2021-3022 MISC ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191274. 2021-01-04 3.5 CVE-2020-4910 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191273. 2021-01-04 3.5 CVE-2020-4909 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could reveal credential information in the HTTP response to a local privileged user. IBM X-Force ID: 191288. 2021-01-04 2.1 CVE-2020-4913 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392. 2021-01-04 2.1 CVE-2020-4918 XF CONFIRM ibm -- cloud_pak_system IBM Cloud Pak System 2.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191390. 2021-01-04 3.5 CVE-2020-4916 XF CONFIRM ibm -- emptoris_strategic_supply_management IBM Emptoris Strategic Supply Management 10.1.0, 10.1.1, and 10.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190986. 2021-01-07 3.5 CVE-2020-4895 XF CONFIRM mk-auth -- mk-auth MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly. 2021-01-04 3.5 CVE-2021-21494 MISC MISC semperplugins -- all_in_one_seo_pack An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor, leading to stored XSS. 2021-01-01 3.5 CVE-2020-35946 MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. 2021-01-04 3.5 CVE-2019-16960 MISC MISC MISC solarwinds -- web_help_desk SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. 2021-01-04 3.5 CVE-2019-16956 MISC MISC MISC tenda -- f3_firmware Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior. 2021-01-01 3.3 CVE-2020-35391 MISC vikisolutions -- vera An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload, and read another user's cookie and use that to login to the application. 2021-01-05 3.5 CVE-2019-20483 MISC zohocorp -- manageengine_desktop_central Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report. 2021-01-06 3.5 CVE-2019-16962 MISC MISC Back to top   Severity Not Yet Assigned Primary Vendor -- Product Description Published CVSS Score Source & Patch Info actionpack_gem_for_ruby_on_rails -- actionpack_gem_for_ruby_on_rails In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. 2021-01-06 not yet calculated CVE-2020-8264 MISC MISC advanced_webhost_billing_system -- advanced_webhost_billing_system   Advanced Webhost Billing System 3.7.0 is affected by Cross Site Request Forgery (CSRF) attacks that can delete a contact from the My Additional Contact page. 2021-01-08 not yet calculated CVE-2020-25950 MISC asp.net -- cute_editor   Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. 2021-01-07 not yet calculated CVE-2020-24903 MISC barco -- multiple_products   Barco TransForm NDN-210 Lite, NDN-210 Pro, NDN-211 Lite, and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result in unauthenticated remote code execution in the username and password fields of the logon prompt. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. 2021-01-07 not yet calculated CVE-2020-17500 MISC CONFIRM MISC barco -- transform_n   Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules, ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17502 MISC CONFIRM MISC barco -- transform_n   The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter "locking" is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17503 MISC CONFIRM MISC barco -- transform_n   The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards. 2021-01-08 not yet calculated CVE-2020-17504 MISC CONFIRM MISC bssi -- web-sesame   A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension (code review). Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contain sources used to generate the bundle, configuration settings (e.g., API keys), and developers' comments. 2021-01-06 not yet calculated CVE-2020-29041 MISC MISC buns -- buns   This affects all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule). 2021-01-08 not yet calculated CVE-2020-7794 MISC cairosvg -- cairosvg   CairoSVG is a Python (pypi) package. CairoSVG is an SVG converter based on Cairo. In CairoSVG before version 2.5.1, there is a regular expression denial of service (REDoS) vulnerability. When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS). If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time. This is fixed in version 2.5.1. See Referenced GitHub advisory for more information. 2021-01-06 not yet calculated CVE-2021-21236 MISC MISC CONFIRM MISC ceph -- ceph A flaw was found in ceph in versions prior to 16.y.z where ceph stores mgr module passwords in clear text. This can be found by searching the mgr logs for grafana and dashboard, with passwords visible. 2021-01-08 not yet calculated CVE-2020-25678 MISC MISC cisco -- jabber   Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. 2021-01-07 not yet calculated CVE-2020-26085 CISCO citrix -- secure_mail Citrix Secure Mail for Android before 20.11.0 suffers from improper access control allowing unauthenticated access to read limited calendar related data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. 2021-01-06 not yet calculated CVE-2020-8275 MISC citrix -- secure_mail   Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device. 2021-01-06 not yet calculated CVE-2020-8274 MISC cockpit -- cockpit   Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. 2021-01-08 not yet calculated CVE-2020-35131 MISC MISC MISC d-link -- dsl-2888a_devices   An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The One Touch application discloses sensitive information, such as the hashed admin login password and the Internet provider connection username and cleartext password, in the application's response body for a /tmp/var/passwd or /tmp/home/wan_stat URI. 2021-01-08 not yet calculated CVE-2020-24577 MISC CONFIRM MISC dell -- client_and_commerical_consumer_platforms   Select Dell Client Commercial and Consumer platforms support a BIOS password reset capability that is designed to assist authorized customers who forget their passwords. Dell is aware of unauthorized password generation tools that can generate BIOS recovery passwords. The tools, which are not authorized by Dell, can be used by a physically present attacker to reset BIOS passwords and BIOS-managed Hard Disk Drive (HDD) passwords. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to bypass security restrictions for BIOS Setup configuration, HDD access and BIOS pre-boot authentication. 2021-01-04 not yet calculated CVE-2020-5361 MISC dell -- inspiron_5675_bios   Dell Inspiron 5675 BIOS versions prior to 1.4.1 contain a UEFI BIOS RuntimeServices overwrite vulnerability. A local attacker with access to system memory may exploit this vulnerability by overwriting the RuntimeServices structure to execute arbitrary code in System Management Mode (SMM). 2021-01-08 not yet calculated CVE-2020-26186 MISC dell -- multiple_products   Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system file. A local authenticated attacker with access to the system files may use the exposed password to gain access with the privileges of the compromised user. 2021-01-05 not yet calculated CVE-2020-29489 MISC dell -- multiple_products   Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a Denial of Service vulnerability on NAS Servers with NFS exports. A remote authenticated attacker could potentially exploit this vulnerability and cause Denial of Service (Storage Processor Panic) by sending specially crafted UDP requests. 2021-01-05 not yet calculated CVE-2020-29490 MISC drupal -- aes_encryption   The AES encryption project 7.x and 8.x for Drupal does not sufficiently prevent attackers from decrypting data, aka SA-CONTRIB-2017-027. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 not yet calculated CVE-2017-20001 MISC drupal -- kcfinder_integration   uploader.php in the KCFinder integration project through 2018-06-01 for Drupal mishandles validation, aka SA-CONTRIB-2018-024. NOTE: This project is not covered by Drupal's security advisory policy. 2021-01-01 not yet calculated CVE-2018-25002 MISC MISC MISC eaton -- easysoft   Eaton's easySoft software v7.20 and prior are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion. 2021-01-07 not yet calculated CVE-2020-6656 MISC MISC MISC MISC eaton -- easysoft   The Eaton's easySoft software v7.20 and prior are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application. 2021-01-07 not yet calculated CVE-2020-6655 MISC MISC evolucare -- ecsimaging   ** UNSUPPORTED WHEN ASSIGNED ** EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2021-01-07 not yet calculated CVE-2021-3029 MISC MISC formstone -- formstone   Formstone

Read more »

iTunes at 20: How One App Changed Apple’s Course
It's been 20 years since iTunes was released. This app was the cornerstone of Apple's development. The post appeared first on The Mac Security Blog.

Read more »

Sealed U.S. Court Records Exposed in SolarWinds Breach
The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the U.S. Courts.

Read more »

All Aboard the Pequod!
Like countless others, I frittered away the better part of Jan. 6 doomscrolling and watching television coverage of the horrifying events unfolding in our nation's capital, where a mob of President Trump supporters and QAnon conspiracy theorists was incited to lay siege to the U.S. Capitol. For those trying to draw meaning from the experience, might I suggest consulting the literary classic Moby Dick, which simultaneously holds clues about QAnon's origins and offers an apt allegory about a modern-day Captain Ahab and his ill-fated obsessions.

Read more »

How to Uninstall Flash Player
Flash Player is dead. It's time to uninstall it from your Mac. Here's how to do this. The post appeared first on The Mac Security Blog.

Read more »

New Year’s Resolution: Cull Your Notifications – Intego ...
There's new malware attacking cryptocurrency apps, WhatsApp warns users about data it is sharing with Facebook, and Apple loses a copyright fight with a company that virtualizes iOS so security researchers can look for vulnerabilities. We also look at how you can manage and secure notifications on your devices, so you don't get too distracted, and also so personal information isn't visible when your devices are locks. The post New Year’s Resolution: Cull Your Notifications – Intego Mac Podcast Episode 169 appeared first on The Mac Security Blog.

Read more »

Hamas May Be Threat to 8chan, QAnon Online
In October 2020, KrebsOnSecurity looked at how a web of sites connected to conspiracy theory movements QAnon and 8chan were being kept online by DDoS-Guard, a dodgy Russian firm that also hosts the official site for the terrorist group Hamas. New research shows DDoS-Guard relies on data centers provided by a U.S.-based publicly traded company, which experts say could be exposed to civil and criminal liabilities as a result of DDoS-Guard's business with Hamas.

Read more »

A Brief History of Adobe Flash Player: From Multimedia to Ma...
On December 31, 2020, Adobe Flash Player is officially dead. This browser plugin, which provided multimedia content for the early internet, has been plagued by security issues, and became the most exploited vector for malware on the Mac. We look back on 25 years of Flash. Apple security in 2019: year in review Apple Security […] The post A Brief History of Adobe Flash Player: From Multimedia to Malware – Intego Mac Podcast Episode 168 appeared first on The Mac Security Blog.

Read more »

Happy 11th Birthday, KrebsOnSecurity!
Today marks the 11th anniversary of KrebsOnSecurity! Thank you, Dear Readers, for your continued encouragement and support! With the ongoing disruption to life and livelihood wrought by the Covid-19 pandemic, 2020 has been a fairly horrid year by most accounts. And it’s perhaps fitting that this was also a leap year, piling on an extra […]

Read more »

The History of Adobe Flash Player: From Multimedia to Malwar...
Flash Player was an early tool that provided multimedia content on the internet, but it wasn't long before it became one of the most dangerous vectors of malware. The post The History of Adobe Flash Player: From Multimedia to Malware appeared first on The Mac Security Blog.

Read more »

Boost Mobile continues to offer no contract Apple iPhone SE ...
Boost Mobile is offering 2020 Apple iPhone SE models for $150 off MSRP with service. Their discount reduces the cost of an iPhone SE/64GB to $249.99. 128GB models are offered at a $50 discount: $399.99. Note that availability at Boost can vary, depending on color and configuration. Order online, then pick a Boost unlimited plan when the phone arrives. Boost Mobile is part of the newly expanded DISH network, and they offer plans beginning at $15 per month for one line. No annual contract is required. Boost’s $249 iPhone SE is the cheapest no-contract 2020 iPhone we’ve seen available anywhere. For the latest prices and sales, keep an eye on our iPhone Price Tracker, → Read More...

Read more »

B&H launches Apple iMac sale with 21″ and 27″ models...
B&H Photo has Apple 21″ and 27″ iMacs on sale today for up to $150 off MSRP with prices starting at $1049. Shipping is free. These are the same iMacs sold by Apple in their retail and online stores. B&H’s prices are among the lowest available for these models from any Apple reseller; – 21″ 2.3GHz 2-Core iMac: $1049 $50 off MSRP – 21″ 3.6GHz 4-Core 4K iMac: $1249 $50 off MSRP – 21″ 3.0GHz 6-Core 4K iMac: $1349 $150 off MSRP – 27″ 3.1GHz 6-core iMac: $1699 $100 off MSRP – 27″ 3.3GHz 6-core iMac: $1879 $120 off MSRP – 27″ 3.8GHz 8-core iMac: $2299 $0 off MSRP For the latest prices and sales, see our iMac Price Tracker, → Read More...

Read more »

Select 11″ WiFi iPad Pros on sale today for $50 off Apple�...
B&H Photo has select 2020 Apple 11″ WiFi iPad Pros on sale today for $50 off Apple’s MSRP, each including free expedited shipping to most addresses in the US: – 11″ 256GB WiFi iPad Pro: $849 $50 off – 11″ 512GB WiFi iPad Pro: $1049 $50 off – 11″ 1TB WiFi iPad Pro: $1249 $50 off Keep an eye on our 11″ iPad Pro Price Tracker for the latest → Read More...

Read more »

Clearance 8-core iMac Pro available again for $3819 at Apple...
Apple has Certified Refurbished, clearance, 27″ 3.2GHz 8-Core iMac Pros available $3819 including free shipping. Their price is $1180 off the original MSRP of new models. A standard Apple one-year warranty is included. Apple’s refurbished price is the cheapest currently available for an iMac Pro from any reseller. For the latest prices and sales, see our iMac Pro Price Tracker, → Read More...

Read more »

B&H launches 16″ MacBook Pro sale with models availabl...
B&H has Apple’s 16″ MacBook Pros on sale for $200-$250 off Apple’s MSRP with prices starting at $2199. Expedited shipping is free to many addresses in the US. Their prices are among the lowest available for new 16″ MacBook Pros from Apple resellers: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2549 $250 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2599 $200 off MSRP These are all the same MacBook Pros sold by Apple in their retail and online stores. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

B&H launches 16″ MacBook Pro sale with models availabl...
B&H has Apple’s 16″ MacBook Pros on sale for $200-$250 off Apple’s MSRP with prices starting at $2199. Expedited shipping is free to many addresses in the US. Their prices are among the lowest available for new 16″ MacBook Pros from Apple resellers: – 2019 16″ 2.6GHz 6-Core MacBook Pro Space Gray: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Space Gray: $2549 $250 off MSRP – 2019 16″ 2.6GHz 6-Core MacBook Pro Silver: $2199 $200 off MSRP – 2019 16″ 2.3GHz 8-Core MacBook Pro Silver: $2599 $200 off MSRP These are all the same MacBook Pros sold by Apple in their retail and online stores. See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple and → Read More...

Read more »

At only $809, these are the cheapest MacBooks for sale today...
Apple has restocked at full line of Certified Refurbished 2020 13″ Intel-based MacBook Airs available starting at only $809 and up to $280 off original MSRP. Each MacBook features a new outer case, comes with a standard Apple one-year warranty, and is shipped free. The following configurations are available: – 13″ 1.1GHz Dual-Core MacBook Air Space Gray: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Silver: $809 $190 off MSRP – 13″ 1.1GHz Dual-Core MacBook Air Gold: $809 $190 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Space Gray: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Silver: $1019 $280 off MSRP – 13″ 1.1GHz Quad-Core MacBook Air Gold: $1019 $280 off MSRP Check Apple’s site for the latest stock status, and note that Apple may sell out at any time. The dual-core models are the cheapest MacBooks you can purchase today at Apple. For the latest sales & prices, see our 13″ MacBook Air Price Tracker, → Read More...

Read more »

Find the best price on an Apple iPhone MagSafe Charger using...
Looking for an Apple MagSafe Charger for your new iPhone 12, or perhaps an Apple MagSafe Duo Charger for your new iPhone and Apple Watch? Check out our new MagSafe Charger Price Tracker. We scan the lowest prices on Apple’s new iPhone chargers from at least 13 major Apple retailers on a daily basis, and we’ll be adding more products and resellers to the tracker as these new products become available. Current sale prices include the MagSafe Charger for $35.99 ($4 off MSRP) at Abt Electronics, Amazon, and Walmart’s → Read More...

Read more »

Save $67 on 13″ M1 MacBook Pros at Expercom, plus take $40...
Apple reseller Expercom has 2020 13″ M1 MacBook Pros on sale for $67 off Apple’s MSRP with prices starting at $1232. In addition to their MacBook Pro sale prices, take $40 off AppleCare+ when purchased along with the MacBook Pro ($229, regularly $269): – 2020 13″ MacBook Pro M1 CPU/256GB SSD: $1232.65 $67 off MSRP – 2020 13″ MacBook Pro M1 CPU/512GB SSD: $1432.65 $67 off MSRP Discounts are also available on various build-to-order options. Note that some configurations might require 3-5 days for shipping. For the latest prices & sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »

Back in stock! 16″ MacBook Pros starting at only $2039 at ...
After a long absence, Apple has restocked a full line of Certified Refurbished 16″ MacBook Pros for up to $420 off the cost of new models, starting at $2039. Each model features a new outer case, shipping is free, and an Apple 1-year warranty is standard. These models are the cheapest 16″ MacBook Pros currently available for sale anywhere: – 16″ 2.6GHz 6-Core MacBook Pro (Space Gray): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Space Gray): $2379 save $420 – 16″ 2.6GHz 6-Core MacBook Pro (Silver): $2039 save $360 – 16″ 2.3GHz 8-Core MacBook Pro (Silver): $2379 save $420 See our 16″ MacBook Pro Price Tracker for the latest prices & deals from Apple’s resellers, → Read More...

Read more »

Saturday Steal! Clearance 2020 Mac mini for only $549!
Other World Computing has clearance 2020 Intel-based 4-core Mac minis on sale for only $549 this weekend, $250 off Apple’s original MSRP. These are new, unopened, factory-sealed models: – 3.6GHz 4-core Mac mini: $549 $250 off original MSRP This is the cheapest new 2020 Apple Mac for sale anywhere right now. Available while supplies last! For the latest prices and sales, keep an eye on our Mac mini Price Tracker, → Read More...

Read more »

Save up to $112 on 13″ Intel-based MacBook Pros at Experco...
Apple reseller Expercom has 2020 13″ 2.0GHz Intel-based MacBook Pros on sale for $100-$112 off Apple’s MSRP with prices starting at $1699. In addition to their MacBook Pro sale prices, take $70 off AppleCare+ when purchased along with the MacBook Pro ($199, regularly $269): – 2020 13″ MacBook Pros 2.0GHz Intel CPU/512GB SSD: $1699 $100 off MSRP – 2020 13″ MacBook Pros 2.0GHz Intel CPU/1TB SSD: $1888.80 $112 off MSRP Discounts are also available on various build-to-order options. Note that some configurations might require a week or so for shipping. For the latest prices & sales, keep an eye on our 13″ MacBook Pro Price Tracker, → Read More...

Read more »