How to import your old passwords into the new Apple Passwords
Apple now has an official password manager, but importing your old passwords from other apps into Apple Passwords can be a bit of a pain.Any password manager can import to Apple Passwords, so long as you have a Mac.The introduction of iOS 18 and macOS Seqouia has seen the old iCloud Keychain be rolled into the new Apple Passwords app, alongside a few other Apple password management features. If you already use a password manager outside of iCloud Keychain, you'll probably want to import your passwords if you intend on using Apple Passwords.Do note that Apple's new Passwords app is really built for storing login passwords. It does not, as yet, store the items like credit card numbers, software serial numbers, or secure documents, that other password managers too. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Glyde 4-in-1 Portable Charging Station review: Mobile charging without compromise
Glyde's specially designed sliding charging station is a great way to charge all your smaller Apple devices.Glyde 4-in-1 Portable Charging Station reviewCharging stations make it easier to get more done with fewer wires, and this one is space-efficient by being retractable. In a way, it's a spiritual successor to the MagSafe Duo, or TwelveSouth's version of the 2-in-1 MagSafe design.Journey is an Australia-based consumer tech company that specializes in chargers and cases. One of its latest releases is the Glyde 4-in-1 Portable Charging Station. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Security Bite: Mechanics of Apple CarPlay
9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. This week, I want to share a fascinating talk I came across on social media about an Apple service that doesn’t seem to get as much attention in the community: CarPlay. While Apple has not publicly disclosed the exact number of CarPlay users, I’d venture to say it’s one of its most used services. And one of the biggest concerns is anything that could compromise driver safety or privacy. So, how secure is CarPlay? more…

Read more »

Netflix now lets you share screenshots of your favorite moments from a movie or show
Pretty much every video streaming platform has DRM-protected content, which aims to prevent users from distributing copyrighted material. Unfortunately, this also means that users can’t easily share screenshots of specific moments of something they’re watching with others – but Netflix is introducing a new feature that will change that. more…

Read more »

iPhones stored for forensic analysis unexpectedly reboot, causing problems for police
Multiple iPhone units stored for forensic analysis have rebooted themselves, causing concern among law enforcement officials that Apple has a new security feature.iPhones stored for forensic analysis have reportedly begun rebooting themselves.The phones in question had a few things in common, they were all running iOS 18.0, and they had been disconnected from cellular networks for some time. They were sent into a forensics lab on October 3, 2024.The affected devices even included one that was in Airplane Mode and another that was kept in a Faraday cage, which prevents electrical signals from accessing the device. While it's most likely that the devices began boot-looping or that they ran low on battery, officials believe the restarts were caused by something else entirely. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Two senior presidential campaign officials' iPhones maybe hacked by Chinese group
Evidence suggests that the earlier Chinese Salt Typhoon breach of American telecoms may have led to the potential hacking of two presidential campaign officials' iPhones.iPhones potentially breachedWhether the hack actually happened, what data might have been obtained, or which officials were breached have not been revealed. The FBI is investigating claims by a security startup called iVerify that tie the events together.According to a report from Forbes, iVerify flagged anomalous behavior on two iPhones belonging to senior officials for one of the presidential candidates. Settings had been changed on the iPhones in "patterns that are not observed on healthy devices." Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Playlist cover artwork app ‘Denim’ now integrates with Spotify
As previously covered here on 9to5Mac, Denim is a powerful app that provides tools for creating and customizing cover artwork for playlist. Following an update in August that added many new options to the app, Denim is now getting another update – this time with Spotify integration. more…

Read more »

Apple’s App Store revenue rises 14% in October
Apple's App Store revenue experienced a 14% year-over-year increase in October, excluding currency fluctuations. This solid performance… The post appeared first on MacDailyNews.

Read more »

Rivian adds support for Control Center widgets in iOS 18
Following Tesla last month, Rivian is now rolling out support for Control Center widgets for iPhone users running iOS 18. more…

Read more »

9to5Mac Daily: November 7, 2024 – iCloud glitches, EU investigations
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by CardPointers: The best way to maximize your credit card rewards. Save 30% and get a $100 Savings Card today.  more…

Read more »

Belkin debuts compact Travel Bag for Apple Vision Pro
Following the launch of the Belkin Head Strap earlier this week, Belkin today is further expanding its accessory lineup for Apple Vision Pro. The company has unveiled its new Belkin Travel Bag as a “compact and lightweight” alternative to Apple’s own Travel Case. more…

Read more »

macOS High Power Mode comes to MacBook Pro and Mac mini with M4 Pro
The first reviews of Apple’s new M4 Mac lineup dropped today, including the Mac mini, iMac, and MacBook Pro. One interesting tidbit that emerged via Ars Technica’s review is that Apple has expanded the “High Power Mode” in macOS to the M4 Pro configurations of the Mac mini and MacBook Pro. more…

Read more »

Metro by T-Mobile drops holiday deals: Get Apple Watch SE and iPhone 12 together for under $100
The holidays are arriving early at Metro by T-Mobile! For the first time ever, the Apple Watch lineup — including Apple Watch Ultra 2… The post appeared first on MacDailyNews.

Read more »

Apple Scraps Plans for 27-inch iMac
Apple has confirmed it has no plans to release a 27-inch iMac, ending speculation about a larger successor to its flagship desktop computer. The tech giant will instead focus on its 24-inch M3 iMac and Mac Studio offerings. Read more of this story at Slashdot.

Read more »

Apple Scraps Plans for 27-inch iMac
Apple has confirmed it has no plans to release a 27-inch iMac, ending speculation about a larger successor to its flagship desktop computer. The tech giant will instead focus on its 24-inch M3 iMac and Mac Studio offerings. Read more of this story at Slashdot.

Read more »

Apple makes room for new Macs by rethinking retail Vision Pro demo stations
Apple is set to streamline its retail displays, making way for new Mac models by downgrading the Apple Vision Pro demo experience.Apple Vision ProStarting November 8, Apple will pilot a revised store layout in select retail locations, merging the Vision Pro demo and display tables. The shift will make space for the latest Mac products, including the M4 models.The new format will reduce the two separate Vision Pro tables — a layout for demo and display units — into a single, multifunctional table. Along with accommodating new Mac displays, Apple's move will address low Vision Pro sales. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

macOS Sequoia 15.2 upgrades AirPlay privacy
The latest macOS Sequoia 15.2 beta upgrades the experience of using AirPlay to share content from your Mac to your Apple TV. Now, there’s a new option to only share a specific window or app when using AirPlay from your Mac to Apple TV. more…

Read more »

TechCrunch: Apple’s 16-inch MacBook Pro (M4 Pro) is a powerful desktop replacement
Apple in October unveiled the new MacBook Pro, powered by the M4 family of chips — M4, M4 Pro, and M4 Max — delivering much faster… The post appeared first on MacDailyNews.

Read more »

Best iPad 2024: Compete and updated guide to which iPad to buy
Macworld Which iPad should you buy? There are a lot of choices and it can be confusing. There are four different varieties of iPad, listed below, and each is available with or without cellular (including 5G on certain models), which costs extra. That’s before we get into storage capacity, colors, and second-hand alternatives. Our in-depth buying guide assesses the whole range of iPads sold by Apple and explores all the factors that should influence your iPad buying decision such as value for money, how much storage you need, and whether or not to buy a cellular version. We also reveal whether an updated version of each device is likely to be launched soon–answering the question of whether now is a good time to buy an iPad. If you’re thinking of buying an iPad for college or university you might also like to read our guide to the best iPad for students. You may also like to read our best iPad for kids guide. Updated November 7, 2024 with info about the iPad mini (A17 Pro). Apple iPad comparison chart The table below summarizes the main features of the iPads in Apple’s current lineup and highlights the price for each. We have more information about the individual iPads and buying advice below. Click the links in the table of contents to go to the section most relevant to you. Model (launch date)Key features + specsStorage + cellular optionsPrice + buy linkiPad 10.9-inch 10th generation(October 2022)• Medium 10.9-inch screen• Touch ID on the Power button• A14 Bionic processor• 12MP/12MP cameras• Supports Apple Pencil (USB) and Apple Pencil 1• 248.6mm x 179.5mm x 7mm• 481g64GB256GB64GB (5G)256GB (5G)$349 / £349$499 / £499$499 / £499$649 / £649iPad mini(A17 Pro)(October 2024)• Small 8.3-inch screen• Touch ID on the Power button• A17 Pro processor• 12MP/12MP cameras• Supports Apple Pencil (USB-C) and Apple Pencil Pro• 195.4mm x 134.8mm x 6.3mm• 293g64GB256GB64GB (5G)256GB (5G)$499 / £499$649 / £649$649 / £649$799 / £799iPad Air 11-inch6th generation(May 2024)• Medium 11-inch screen• Touch ID on the Power button• M2 processor• 12MP/12MP cameras• Supports Apple Pencil (USB) and Apple Pencil Pro• 247.6mm x 178.5mm x 6.1mm• 462g128GB256GB512GB1TB128GB (5G)256GB (5G)512GB (5G)1TB (5G)$599 / £599$699 / £699$899 / £899$1,099 / £1,099$749 / £749$849 / £849$1,049 / £1,049$1,249 / £1,249iPad Air 13-inch(May 2024)• Largest 13-inch screen• Touch ID on the Power button• M2 processor• 12MP/12MP cameras• Supports Apple Pencil (USB) and Apple Pencil Pro• 280.6mm x 214.9mm x 6.1mm• 618g128GB256GB512GB1TB128GB (5G)256GB (5G)512GB (5G)1TB (5G)$799 / £799$899 / £899$1,099 / £1,099$1,299 / £1,299$949 / £949$1,049 / £1,049$1,249 / £1,249$1,449 / £1,449iPad Pro 11-inch 5th generation(May 2024)• Medium 11-inch screen• Face ID• M4 processor• 12MP/12MP cameras• Supports Apple Pencil (USB) and Apple Pencil Pro• 249.7mm x 177.5mm x 5.3mm• 446g256GB512GB1TB2TB256GB (5G)512GB (5G)1TB (5G)2TG (5G)$999 / £999$1,199 / £1,199$1,599 / £1,599$1,999 / £1,999$1,199 / £1,199$1,399 / £1,399$1,799 / £1,799$2,199 / £2,199iPad Pro 13-inch7th generation(May 2024)• Largest 13-inch screen• Face ID• M4 processor• 12MP/12MP cameras• Supports Apple Pencil (USB) and Apple Pencil Pro• 281.6mm x 215.5mm x 65.1mm• 582g256GB512GB1TB2TB256GB (5G)512GB (5G)1TB (5G)2TB (5G)$1,299 / £1,299$1,499 / £1,499$1,899 / £1,849$2,299 / £2,299 $1,499 / £1,499$1,699 / £1,699$2,099 / £2,099$2,499 / £2,499 Every iPad Apple sells Apple’s iPad lineup is perhaps one of the most expansive product lineups presented by the company. Below we offer information about each model, but we also answer questions further down the article such as which iPad is the best value for money, which size is best, how much storage you need, and whether to get cellular (you can jump to these sections from the table of contents above). The iPad that is best for you will depend on what you need from an iPad. If you just want an iPad for reading books, watching movies and TV shows, email, and web browsing, then you don’t need all the bells and whistles. An iPad or iPad mini might be best here. If you are looking for an iPad that will do everything that a laptop can, then you might want to consider a model that is more powerful and supports additional components, including one of Apple’s newer keyboards or the Apple Pencil, the iPad Air might suit you. And if you will be using your iPad for gaming, video editing, photo editing, or anything high-powered and graphic intensive, then you will probably be looking at an iPad Pro. Below we will run through every iPad you can buy so you can find the one that’s best for your needs. Apple iPad (2022, 10th gen): Best value Price When Reviewed: From $349 (64GB) | $499 (256GB) (was $449 and $599) Best Prices Today: $299 at Amazon$299 at Best Buy$299.99 at Target 64GB: $349/£349256GB: $499/£49964GB (cellular): $499/£499256GB (cellular): $649/£649 The 2022 iPad (10th generation) is the cheapest iPad–it was reduced by $100 in May 2024 from $449 to $349. It offers a lot of features for the price and it’s available in an assortment of fun colors. It has a 10.9-inch screen, a USB-C connector, and supports the Apple Pencil 1 or the Apple Pencil (USB). It’s also capable of 5G (if you were looking at the cellular model you wouldn’t want the 4G-capable 9th gen). Pros: A14 chip will be powerful enough for a good few years. No more Home Button – but there is Touch ID (on the Power button). Cons: Still feels cheap due to the unlaminated screen (will Apple ever update this?). Not as thin and light as the iPad Air. Best for: Anyone who needs a big screen (not a huge screen; they’ll want the 12.9-inch iPad Pro) but is on a budget, and can cope without the latest in processing. It’s a good option for anyone who likes the look of the iPad Air, but not the price. Is now a good time to buy? While the iPad is about two years old, Apple reduced its price in May 2024 and it’s a fantastic bargain. See: Best iPad (10th gen) deals Read our full Apple iPad (10th gen, A14, 2022) review Apple iPad mini (A17 Pro, 2024): Best for kids and travelers Price When Reviewed: $499 (128GB; Wi-Fi only) | $599 (256GB; Wi-Fi only) | $799 (512GB; Wi-Fi only) Best Prices Today: $478 at Amazon$499 at Apple$499 at Apple United States 128GB: $499/£499 256GB: $649/£649 512GB: $799/£799 64GB (cellular): $649/£649 256GB (cellular): $799/£799 512GB (cellular): $949/£949 This generation of iPad mini launched in October 2024. The iPad mini is available in four colors: Blue, Purple, Space Gray, and Starlight. The biggest draw of the iPad mini is probably its diminutive stature; it’s Apple’s smallest iPad with an 8.3-inch display. It’s perfect for carrying around in a bag or handing to children when they need entertainment. You get a speedy A17 Pro processor chip, a Liquid Retina screen, and 12MP/12MP rear/front cameras. It might be small, but it is actually more powerful than the standard iPad thanks to its A17 Pro processor, which is a few generations newer than the A14 in the 10th gen iPad. Pros: Very portable and respectably powerful. The cheapest version has a decent amount of storage (64GB). Supports Apple Pencil (USB-C) or Apple Pencil Pro. Cons: Small screen, which may not be great for those who get eyestrain or who like immersive films and games. Best for: The portability-conscious. Gamers on the go. Tablet photographers. Ebook readers. Kids. Is now a good time to buy? The iPad mini (A17 Pro) was released in October 2024, so you won’t find deep discounts at third-party retailers, where you’ll likely find it for a little bit lower than Apple’s MSRP. See: Best iPad mini deals Apple iPad Air 11-inch (6th gen, 2024): Best for power in an affordable package Price When Reviewed: $599 (128GB, Wi-Fi only) Best Prices Today: $551 at Amazon$599 at Apple$599 at Apple United States 128GB: $599 / £599 256GB: $699 / £699 128GB (cellular): $749 / £749 256GB (cellular): $849 / £849 The 11-inch iPad Air has an M2 processor that is powerful and energy-efficient (you may remember it from its widely praised performance in the Mac). The M2 pushes the iPad Air far ahead of the iPad mini and standard iPads with their A-series chips. The M2 also makes the Air an appealing alternative to the more expensive Pro models, with their faster M4 processors. Like all recent iPads, the Air features an all-screen design with no Home button. As with the 10th-gen iPad and the iPad mini, biometric security is handled by a fingerprint sensor in the power button rather than Face ID, which is reserved for the Pros. It has superb cameras (the front-facing 12MP camera and Center Stage), supports a wide range of Pro accessories, and now features 5G. Pros: Beautiful design. Superb processing and graphics power. Cheaper than the iPad Pro. Cons: Screen doesn’t feature ProMotion. Ideal for: Tablet gamers and anyone who wants to be able to run the most demanding apps now and in the future. Pro users (business, creative, design) who can’t afford an iPad Pro. Is now a good time to buy? Absolutely. It was updated in May of 2024 and will be around for a while. But would the iPad Pro be better? Read: iPad Air (M2) vs iPad Pro (M4), or look below. See: Best iPad Air deals Read our full Apple iPad Air 11-inch (M2, 2024) review 11-inch iPad Pro (5th gen, 2024): Best for power in a small package Price When Reviewed: $999 (Wi-Fi only) Best Prices Today: $969.52 at Amazon$999 at Apple$1099 at Best Buy 256GB: $999 / £999 / 128GB (cellular): $1,199 / £1,199 512GB: $1,199 / £1,199 / 256GB (cellular): $1,399 / £1,399 1TB: $1,599 / £1,599 / 1TB (cellular): $1,799 / £1,799 2TB: $1,999 / £1,999 / 2TB (cellular): $2,199 / £2,199 The current generation of iPad Pro models went on sale in May 2024. The iPad Pro comes in two sizes and a variety of capacities all the way up to a massive 2TB. The 2024 Pros feature M4 chips and are incredibly powerful–some might say more powerful than it has any right to be. The 11-inch iPad Pro features a display it calls Ultra Retina XDR, which is an implementation of OLED technology that offers deeper blacks, better details in shadows and low light, and better response to motion. Apple uses two OLED panels in an implementation it calls Tandem OLED to address the brightness concerns of a single OLED panel. The Tandem OLED generates 1000 nits of SDR/HDR brightness and 1600 nits of peak HDR brightness. The front-facing camera is now on the longer side of the iPad Pro for use in landscape mode and the rear 10MP ultra-wide camera is gone. The 12MP main camera now has an adaptive True Tone flash that works while scanning documents, which uses AI to sense shadows when scanning and uses the flash to fill in the spot, and multiple photos are taken and stitched together to create the best scan. Pros: Slim and light; dual cameras; Face ID; devastatingly quick and power-efficient processor. Cons: Very expensive. Its power could be overkill for many. Ideal for: Creative types who don’t need the absolutely largest screen. It’s great for watching films and TV shows (and offers quad-speaker audio to match), but there are other screens in the range that are a similar size and a lot more affordable. Is now a good time to buy? The 11-inch M4 iPad Pro was released in May 2024, so it’s a good time to buy. Apple likely won’t update it for a good amount of time. See: Best iPad Pro deals Read our full Apple iPad Pro 11-inch (M4, 2024) review 13-inch iPad Pro (7th gen, 2024): The ultimate iPad power package for creative pros Price When Reviewed: $1,299 (Wi-Fi only) Best Prices Today: $1099 at Best Buy$1,154.49 at Amazon$1199 at Apple United States 256GB: $1,299/£1,299 / 256GB (cellular): $1,499/£1,499 512GB: $1,499/£1,499 / 512GB (cellular): $1,499/£1,699 1TB: $1,899/£1,899 / 1TB (cellular): $2,099/£2,099 2TB: $2,299/£2,299 / 2TB (cellular): $2,499/£2,499 The iPad Pro 12.9-inch, updated in May 2024, offers the biggest screen ever on an Apple tablet, squeezed into a relatively small and very thin chassis. In other respects it’s largely the same as the 11-inch Pro (above): super-fast processor (the M4) with lots of RAM, excellent cameras, and a user experience that looks more than capable of replacing a laptop. The 13-inch iPad Pro, like the 11-inch version, has an Ultra Retina XDR. This is based on OLED technology, but Apple uses two OLED panels–it calls Tandem OLED and it generates 1000 nits of SDR/HDR brightness and 1600 nits of peak HDR brightness. This is all thoroughly impressive. But on the downside, the 12.9-inch Pro is far less portable than the mid-size iPads (it remains admirably slim, but the sheer screen area makes it a handful) and ruinously expensive, particularly at those upper storage tiers. Pros: Largest screen (13-inch); extremely fast processor with lots of RAM; landscape camera with Face ID; four speakers; Ultra Retina display. Cons: Least portable iPad currently available (although it is very slim); very expensive; processor speed will be overkill for many prospective buyers. Ideal for: Creative types most of all, but anyone who needs a big screen will be interested. Gamers and those who enjoy consuming media on the go will like the combination of a sumptuous screen and a quad-speaker audio system. Is now a good time to buy? The current Pros came out in May 2024. Apple probably won’t update it again for at least a year, maybe longer. See: Best iPad Pro deals iPad Buying Guide: What to look for when buying an iPad As you can see from the above there are a lot of iPads sold by Apple–that doesn’t even include the many previous-generation iPads that are still on sale at various resellers and at Apple’s Refurbished Store. When confronted by so much choice what should you consider when deciding which iPad to buy? For many the choice will be based on price and value for money. Some may be influenced by the screen size, others by the weight. The ability to get more than 256GB storage may be important, as may the inclusion of Face ID or Touch ID. Finally, the decision of whether to get a cellular version, which invites the assessment of the minefield of network contracts, will no doubt be a factor for some. We will look at each of those factors below. Which iPad is the best value for money? One person’s value for money is another person’s extravagance. You might be looking for the cheapest iPad. That would be the 10th generation iPad, launched in 2022. In May 2024, Apple reduced the price from its original $449 price to $349 (price drops were matched around the world). It has a 10.9-inch screen, a 12MP rear-facing camera, an A14 Bionic processor, and 5G as an option. If you are happy to buy an older iPad model then there are plenty of discounts available while they are still in stock. There are also some great savings to be had on refurbished models. We recommend you check the following deals roundups, where you can see the best prices right now on various iPads:  Best iPad Pro deals Best iPad (10th gen) deals Best iPad Air deals Best iPad mini deals If you have more to spend, what can you get for your money? The iPad mini more than justifies its slightly higher price tag of $499/£499 with its faster A17 Pro processor, True Tone flash, and a fully laminated, better quality, display, among other things. But its biggest draw will probably be its size for those who want a small iPad. The iPad mini is not much bigger than a hard-backed book making it the perfect size to carry around in a bag and a great size for kids. The 2022 iPadApple Next up is the iPad Air, which starts at $599/£599 for the 11-inch model. It might be worth every extra penny if you want a faster M2 processor. The iPad Air display is still superior to that of the iPad, fully laminated and with an antireflective coating (like the iPad mini). The iPad Pro, updated in May 2024 is the ultimate in this category. Starting at $999/£999, the Pro has a lot to offer, with an incredible display and an M4 chip for starters. But we think these features are probably more than the average person needs. Those are the prices that Apple sells its iPads for, but you don’t have to pay that much. Take a look at our regularly updated iPad deals page for the lowest prices and best discounts on iPads new and old. iPad screen size: Which size iPad to choose Size is a question of taste rather than simply going for the biggest iPad you can get your hands on. Bigger isn’t necessarily better if what you need is small and light. The most obvious aspect of this decision comes down to screen size. All screens are measured diagonally from corner to corner, or from the place where the corners would be. You’ve got four options: 8.3-inch iPad mini 10.9-inch iPad (10th gen) 11-inch iPad Air and iPad Pro 13-inch iPad Air and iPad Pro But how big a screen do you really need? You can think of the tablets in terms of print publications: the mini is roughly the height and width of a paperback book; the mid-size iPads are closer to a hardback (albeit much slimmer); and the 13-inch iPad Pro is like a magazine. The larger screen is obviously better for immersive entertainment. Whether watching films or playing games, it’s a more enjoyable, richer experience. But really this is a question of priorities. Are you more set on getting maximum screen space, or are you willing to compromise on that front in order to get a lower price tag and improved portability? iPad Pro 13-inch (2024): 281.6mm x 215.5mm x 65.1mm; 579g/582g (Wi-Fi/cellular) iPad Pro 11-inch (2024): 249.7mm x 177.5mm x 5.3mm; 444g/446g iPad Air 13-inch (2024): 280.6mm x 214.9mm x 6.1mm 617g/618g iPad Air 11-inch (2024): 247.6mm x 178.5mm x 6.1mm; 462g/462g iPad 10.9-inch (2022): 248.6mm x 179.5mm x 7mm; 477g/481g iPad mini 8.3-inch (2024): 195.4mm x 134.8mm x 6.3mm; 300.5g/308.2g Also read: Every iPad display compared. Want the lightest iPad? As you’d expect, the iPad mini is a lot lighter than the other iPads. There’s a big gap between that device and even the mid-size iPads. As well as its markedly lower weight the mini also has a smaller body, which slips easily into a rucksack or jacket pocket. If you plan to mainly use your iPad out and about, on vacation, or commuting, or perhaps you’re buying an iPad for a child, the mini is your best bet. The iPad, 11-inch iPad Air, and 11-inch Pro are pleasingly portable, but they still can’t match the mini for portability. The iPad has a similar length and width to the Air, but is thicker and heavier; the Pros are slimmer still. The 13-inch Pro and Air are considerably less portable than their smaller cousins, but we think Apple has done well to keep the weight down, especially with the Pro: it remains a slender, relatively lightweight, and portable alternative to a laptop. How much storage do you need? The five iPads offer anywhere from 64GB to 2TB of storage, but if you are looking at an old, refurbished, or preowned iPad you could be confronted with as little as 32GB storage, which isn’t enough. But what storage capacity do you really need for an iPad? Well, first of all, remember that you can’t upgrade the storage of an iPad at a later date: this is your limit from now until you buy another iPad, so aim high and buy as much storage as you can afford. It’s better to spend an extra few pounds now than to buy an entire new iPad in six months. Storage capacity is mainly used up by three things: music, photos, and videos, in increasing order of storage drain. If you want to keep lots of films or TV shows–or even a few, to be honest–then you need high storage: probably 128GB or higher for video fans. (If you’re buying an iPad with the kids in mind, remember that you’ll want storage space for multiple episodes of their favorite show on a long car journey.) The same applies to large photo or music libraries, to a lesser extent, although iCloud Photos and iTunes Match make it possible to keep your stuff in the cloud and access it remotely (if you pay the fees for iCloud storage). The other thing that will fill up your storage is apps, especially games which will use up a lot of space. For that reason gamers should aim high on storage: The iPad Ait starts with 128GB and the Pro has 256GB, while the mini and 10th-gen iPad both start at 64GB. We recommend getting what you can afford. See: How much storage do you need on an iPhone or iPad? for more advice. Should you get the most powerful iPad? The iPad Pro models are, as you would expect, faster than their smaller and cheaper equivalents, next up is the Air, then the iPad mini and finally the iPad. You can get an idea of relative speed by looking at a few relevant specs: iPad Pro 13-inch (2024): M4; 8GB/16GB RAM iPad Pro 11-inch (2024): M4; 8GB/16GB RAM 13-inch iPad Air (2024): M2; 8GB RAM 11-inch iPad Air (2024): M2; 8GB RAM iPad mini (2024): A17 Pro; 8GB RAM iPad 10.9-inch (2022): A14 Bionic; 4GB RAM The M-series chips have won widespread acclaim in the Mac range and produce outstanding performance in the iPads. But that doesn’t mean the A chips are sub-standard or incapable of running modern apps; keep in mind that much of the software on the App Store was designed with A chips in mind, and even now most developers will want to make their software accessible for as many iPad owners as possible. There is a good reason to choose the M-series chips over the A-series though. Some of the best iPadOS 16 features will only work with the M-series iPads. These include features like Stage Manager, which is a new feature for organizing your windows. There are also rumors that one day Apple may make a cutback version of macOS available on the iPad but this will be probably be restricted to the M-series chip, if indeed it ever happens.. But speculation aside, how powerful you need your iPad to be will be based on your requirements (and how long you intend to use your iPad for). The most demanding graphic-design, video-editing, and audio apps will see better performance on the M4 and even M2 processor, so if you’re looking at high-level workloads multiple years down the line the M4 and M2 would be a better option. But for most users, the A17 Pro will be comfortably fast enough for the mid- and long-term. Another important factor to consider is memory. The iPad 10.9-inch has 4GB. The mini and Air gets a jump up to 8GB, while the Pros have either 8GB or a whopping 16GB of RAM, depending on your storage tier: the 1TB and 2TB versions get the higher RAM allocation. If you want to run Apple Intelligence, you must have an iPad with at least 8GB of RAM. With the current iPad lineup, Apple Intelligence can run on all iPads expect the 10th gen iPad. Learn more about Apple Intelligence. Overall, we would advise those who want to use highly demanding apps, such as video and image editors and graphically advanced games, to choose an iPad Pro or Air. If you’re going to be using your tablet for the odd bit of email and web surfing, you’ll find an iPad or iPad mini perfectly decent. With these general observations out of the way, it’s time to look at each device in more depth. For each iPad we record the essential information, its pros and cons, which buyer should pick it, and whether now is a good time to buy. Should you get a Cellular iPad? For most people cellular connectivity is a luxury, even if it’s a nice one to have. For an extra $100 or $150, you’ll be able to access the web and email, and use connected apps, away from a Wi-Fi network. You need to factor in the cost of a data plan and find a network provider. Consider carefully how often you’re going to do that: with an iPad mini there’s likely to be more on-the-go use than with a full-size iPad, but it’s still a lot to pay for something you may only use from time to time. Have you got a regular (overground) commute where you’d enjoy catching up on news headlines or e-mail? Then it could be worth the extra. We think the best option, if you want to be able to get data on your iPad when you are out and about, is to create a hotspot and share it from your iPhone. Then you can use your iPad as if it is on the cellular network. Read about how to create an iPhone hotspot to share your mobile web connection to your iPad. Just bear in mind that the cellular option also brings with it a GPS radio, meaning you’ll be able to input accurate location data when using your device on the go. The other concern when buying a cellular iPad is whether to buy your iPad on a contract. Network providers will allow you to pay for your iPad and the data contract over a number of months – but after that term is up, and certainly not before, you may not be able to switch to a different data provider. Buying on contract may also mean that the iPad is locked to the original contract provider – which can also be a problem if you want to sell it in the future. Here’s how to unlock an iPad from its network, once you’ve fulfilled your contractual obligations. Should you buy a refurbished iPad? You can buy a refurbished iPad from AppleApple We’ll mention this only briefly because it’s covered in detail here: Why a refurbished iPad could be the best tablet for you, but one option you should absolutely consider is Apple’s Refurbished Store. It’s a sort of halfway house between new and second-hand: the devices are generally ones that have been returned within the 28-day period in which you are legally allowed to change your mind about a purchase, or they have been returned due to a fault that has been rectified, or they were ex-display or ex-demo units from Apple’s stores or marketing. You can rest assured that Apple has checked all the refurbished iPads that it sells thoroughly, replaced any problematic components, and rated them as good as new (and you get a full one-year warranty to prove it). Apple’s not the only place to buy a refurbished iPad, so beware that all refurbished iPads are not the same, so do check the small print before you buy. Look for refurbished models that have been fully checked out by Apple-certified engineers, especially those that come with a guarantee. Our best advice is to only consider the current or previous generation iPads when looking at refurbished models, then you are less likely to be caught out by a sub-par tablet. Buying a refurbished iPad from a reputable company is definitely preferable to buying a used iPad from someone on eBay. It’s too often the case that secondhand iPads sold that way end up as useless bricks because the person selling it didn’t properly log out of their account. Another way to save money is to buy from a reseller who is selling discontinued stock at a discount. We often see resellers significantly dropping the price on older iPad models that are usually just one generation out of date—just beware, they sell out quick! Should you buy the newest iPad generation? Speaking of older iPads, even if functioning perfectly right now, older models will reach the end of their useful life sooner than the newest models and that is a good reason to avoid buying an iPad that is more than one or two generations old. But keep in mind that iPads tend to start slowing down at around two to three years of age; at the four- or five-year mark you should expect noticable loss of performance and you won’t be able to get all the latest software updates. The current iPad range was mostly updated in 2024 and included the iPad mini, iPad Pro and the iPad Air. The 10th-gen iPad was released in October 2022 but had its price reduced in May 2024. Another reason to buy a recent iPad is the operating system it runs. Apple only supports the most recent three versions of iPadOS with security updates, so that means that only iPadOS 16, 17, and 18 are currently supported. See How long does Apple support iPads? for more information. So, while you don’t have to buy the newest generation, we would recommend that you buy one that was launched relatively recently to be sure that Apple will support it for as long as you intend to own it. On that basis, any of the iPads listed above should be a safe bet because they support the iPadOS that Apple will support for the next three years, and for many the support will stretch on for more years. Buying advice: Which iPad should you buy? The iPad 10.9-inch is a good option for newcomers and those who will mostly use their iPad as a media consumption device with some light work. For most people, however, our recommendation is the iPad Air (2024). The update in May 2024 brought it an M2 processor, which is more than enough for an iPad right now. Mind you, it’s still expensive compared to the standard iPad and the iPad mini, and to most rival tablets out there. The iPad mini is mainly recommended for those who see portability as their main priority. It’s an excellent little device, although the smaller screen makes it less immersive for games and entertainment options. The remaining iPads will be too expensive for the average buyer. The 11-inch and 13-inch Pro models are amazingly powerful and well-made, and the arrival of the M4 is excellent news but probably more power than anyone really needs right now. But if you’re a creative professional, the Pro is the iPad to get. Finally, before taking the plunge, have you considered if a laptop might suit your needs better? See iPad vs MacBook for more advice on that front.

Read more »

Rumor Replay: MacBook Pro redesign, Apple’s Vision roadmap, and more
Welcome to Rumor Replay, a new weekly column at 9to5Mac that provides a quick rundown of the most recent Apple product rumors, with my analysis and commentary. Today: two future MacBook Pro models and a big redesign, the Vision roadmap at Apple, 90Hz displays, and more. Here are this week’s Apple rumors. more…

Read more »

M4 iMac reviews roundup: So fast and colorful
Some early M4 iMac reviews touch on how much more colorful the new version is, and others focus more on the performance boost. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple devices may soon learn to ignore the ‘Hey Siri’ command heard on TV ads
Apple introduced the “Hey Siri” command with iOS 8 to let users easily interact with the virtual assistant without having to press any buttons. However, over the years, this has resulted in Siri being mistakenly triggered when the command is spoken on a TV ad. But Apple is finally working on a fix for this. more…

Read more »

Matter smart-home standard updates promise better Apple Home integration
The new Matter 1.4 update introduces several key improvements, including enhanced multi-admin capabilities and expanded device support. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

How to fix iPhone Notes disappearing after iCloud terms & conditions update
When iPhone users accepted new iCloud terms, some were shocked to see all their Notes disappear from the app. Here's how to get them back.Apple Notes on iPhoneA recent bug affecting Apple's Notes app has left some iPhone users concerned after their notes appeared to vanish. The issue seems to impact iPhones running iOS 18 versions after users agree to updated iCloud terms and conditions.Reports across social media indicate that the Notes app disconnects from iCloud, leaving the app empty and alarming users who rely on it for personal and professional information. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple TV+ reveals first look at third season of ‘Sago Mini Friends’
Apple TV+ on Thursday unveiled the first look at season three of the adorable preschool animated series "Sago Mini Friends"… The post appeared first on MacDailyNews.

Read more »

Some Apple Stores will pilot reduced Vision Pro presence as M4 Macs launch
Tomorrow is Apple’s big launch day for the first M4 Macs. And reportedly, in sync with those new debuts, the company will also start piloting a scaled back Vision Pro presence in some Apple Stores. more…

Read more »

iOS 18.2 release date: When to expect Apple’s big new features
iOS 18.1 arrived late last month, but the wait won’t be long for another huge update from Apple. iOS 18.2 will bring highly anticipated features like Genmoji, ChatGPT integration with Siri, and so much more. Here’s what to expect from iOS 18.2’s release date, and the big new features it will bring. more…

Read more »

iPad mini (A17 Pro) vs iPad (10th gen)
Macworld Apple’s 10th-generation iPad was introduced in October 2022. It gained a new colorful design with no Home button, USB-C instead of Lightning, a better camera, and a larger screen (10.9 inches up from 10.2 inches). The iPad mini was updated in October 2024. It costs $150/£150 more and offers a better processor and a slightly better display, and comes in a smaller package (which will either be an advantage or a disadvantage, depending on your preference). In this guide, we will assess whether you should spend extra to get the iPad mini or spend less to buy the 10th gen iPad. If you are on the market for a new iPad and are wondering which one will be best for you read on to find out how the cheapest iPad options compare. There are various factors likely to impact your decision, including value for money, cameras, and how well the iPad in question will do the tasks you need it to do. There are also some pretty obvious differences: size, weight, and design–specifically the lack of a Home button on two of the three models we are considering here. We’ll start by examining what you get for your money. We also compare the 10th gen iPad and iPad Air and for even more help read our iPad Buying guide. iPad mini vs iPad: Which is the best value for money? When Apple introduced the 10th gen iPad in October 2022 it kept the 9th gen iPad (introduced in September 2021) on sale. But in May 2024, Apple discontinued the 9th gen iPad and lowered the price of the 10th gen iPad to $349/£349, making it the cheapest option. Apple iPad (10th gen, A14, 2022) Read our review Price When Reviewed: From $349 (64GB) | $499 (256GB) (was $449 and $599) Best Prices Today: $299 at Amazon | $299 at Best Buy | $299.99 at Target Here are the iPad prices: (You can buy from Apple here.) iPadWi-FiCellulariPad (10th gen, 2022, 64GB)$349/£349$499/£499iPad (10th gen, 2022, 256GB)$499/£499$649/£649iPad mini (A17 Pro, 2024, 128GB)$499/£499$649/£649iPad mini (A17 Pro, 2024, 256GB)$599/£599$749/£749iPad mini (A17 Pro, 2024, 512GB)$799/£799$849/£849 There are a few things worth keeping in mind when it comes to price. The price Apple quotes may not be the price you need to pay: resellers frequently discount all iPads, so be sure to look through our deals round-ups so you don’t miss out on the best prices. See: Best iPad deals (10th gen) and Best iPad mini deals. You should also consider whether you want to pay for more storage. For example, Apple offers only two options for the 10th gen iPad, and it’s a considerable $150/£150 to upgrade to 256GB. For the iPad mini, the jump from 128GB to 256GB is $100/£100. Not a trivial increase. Apple iPad mini (A17 Pro) Read our review Price When Reviewed: $499 (128GB; Wi-Fi only) | $599 (256GB; Wi-Fi only) | $799 (512GB; Wi-Fi only) Best Prices Today: $478 at Amazon | $499 at Apple | $499 at Apple United States iPad mini vs iPad: How the specs compare From the chart below you can see there are a number of features that the iPad mini has that the iPad lacks. iPad mini (A17 Pro, 2024)iPad (10th gen, 2022)ColorsBlue, Purple, Space Gray, StarlightBlue, Pink, Silver, YellowScreen size8.3 inches10.9 inchesDisplayLiquid Retina display (2266‑by‑1488 resolution, at 326 ppi), 500 nits max, fully laminated display, antireflective coating, wide color (P3)Liquid Retina display (2360‑by‑1640 resolution, at 264 ppi), 500 nits max, fingerprint-resistant oleophobic coating, sRGBSecurityTouch ID on top button (no Home button)Touch ID on top button (no Home button)Dimensions & weight7.69 x 5.3 x .25 inches, .65 pounds195.4 x 134.8 x 6.2mm, 293g9.79 x 7.07 x .28 inches, 1.05 pounds248.6 x 179.5 x 7mm, 477gProcessorA17 ProA14Storage options128GB, 256GB, 512GB64GB, 256GBRear camera12MP wide, ƒ/1.8 aperture, five-element lens, True Tone flash, Smart HDR 412MP wide, ƒ/1.8 aperture, five-element lens, True Tone flash, Smart HDR 3Front camera12MP Ultra Wide, ƒ/2.4 aperture, Center Stage, Smart HDR 412MP Landscape Ultra Wide, ƒ/2.4 aperture, Center Stage, landscape orientation, Smart HDR 3Video 4K video recording at 24 fps, 25 fps, 30 fps, or 60 fps; 1080p HD video recording at 25 fps, 30 fps, or 60 fps; extended dynamic range for video up to 30 fps; slo-mo video support for 1080p at 120 fps or 240 fps4K video recording at 24 fps, 25 fps, 30 fps, or 60 fps; 1080p HD video recording at 25 fps, 30 fps, or 60 fps; extended dynamic range for video up to 30 fps; slo-mo video support for 1080p at 120 fps or 240 fpsChargingUSB-CUSB-CApple accessory supportApple Pencil (USB-C); Apple Pencil ProMagic Keyboard Folio, Apple Pencil 1Battery lifeUp to 10 hoursUp to 10 hoursBluetooth/Wi-FiBluetooth 5.3, Wi‑Fi 6E (802.11ax) with 2×2 MIMOBluetooth 5.2, WiFi 6Cellular support5G5G Color choices The iPad and iPad mini are both available in “fun” colors–if that’s not your style, the iPad is available in Silver and the iPad mini is available in Space Gray. The iPad and iPad mini are considered consumer-level products and Apple offers those products with colorful choices. Home button There is no Home button on the iPad mini or the 10th-gen iPad. They still use Touch ID (not Face ID) and it is still the simplest way to unlock the device, but now you tap your finger on the on/off switch at the top of the device. We think this is a superb solution, allowing Apple to give the iPad a larger display without increasing the size of the iPad. Relocating Touch ID from the Home button to the Power button will also be considered a bonus by those who prefer Touch ID over Face ID because of the simplicity and speed of using it. However, for some people the Home button is a familiar and simple way to navigate the iPad, and while it is possible to create a software version of the Home button in accessibility settings, some people won’t be prepared to wave goodbye to the Home button yet. If you aren’t ready to give it up then the 9th gen iPad is the only iPad with a Home button now. It’s discontinued, but you might be able to find it at third-party retailers or on Apple’s Certified Refurbished Store. Display The removal of the Home button does mean that both the iPad mini and the 10th gen iPad now have bigger displays than they did before. The iPad mini increased from 7.9 inches to 8.3 inches, while in 2022 the iPad screen grew from 10.2 inches to 10.9 inches. Despite the screen size increase, Apple has managed to keep the dimensions of the devices pretty much the same as the older models, so there is no real trade-off. You get a larger screen, but the device itself is practically the same size and weight. We’ll discuss the dimensions in more detail below. Obviously, the screen of the iPad mini is still smaller than that of the 10.9-inch iPad, but as we said above, some people will be looking for a smaller screen on a lighter device for a variety of reasons. If the thing that matters to you is screen size then the choice will be relatively simple, but if you are concerned about screen quality then there are differences to be considered. The iPad mini screen is superior to the 10th generation iPad. For one thing, the iPad mini benefits from a fully laminated display and anti-reflective coating, something shared with the iPad Air and iPad Pro. The standard iPad is the only iPad that lacks these features and it is at a disadvantage because of it. The non-laminated display just doesn’t give the same impression of quality. The iPad mini screen also trumps both iPads with denser pixels (326 ppi compared to 264 ppi) and it also boasts wide-color P3 gamut support while both iPads are just sRGB. But botjh iPads are limited to 500 nits max. Only the iPad Pro manages more than that. Cameras Both the iPad and iPad mini have a 12MP camera with ƒ/1.8 aperture. However, the iPad mini supports Smart HDR 4, which is Apple technology that combines multiple shots at different exposures to create an ideal image. The iPad uses Smart HDR 3, which is an older version of the technology. Both the iPad and iPad mini have a front camera for FaceTime calls or selfies. Both offer an Ultra Wide 12MP front camera with ƒ/2.4 aperture, 2x zoom, and support for Center Stage (a feature that keeps you in the frame even if you move around.). The iPad has relocated the front camera on the landscape side–much better suited to how people use their iPads during FaceTime calls. The iPad mini still has the camera on the portrait side. Apple Dimensions Despite every bit of technology in the iPad mini, if the screen is too small for you then you may prefer the iPad. However, for some the compact dimensions of the iPad mini are the main benefit. Recapping on those dimensions: iPad mini7.69 x 5.3 x .25 inches, .65 pounds195.4 x 134.8 x 6.2mm, 293g 10th gen iPad9.79 x 7.07 x .28 inches, 1.05 pounds248.6 x 179.5 x 7mm, 477g Ports and connectivity One final difference to mention: the iPad mini and the 10th gen iPad have a USB-C port, like the iPad Pro and Air models. The Lightning port is gone. If you are anything like us you probably have a house full of Lightning connectors and very few USB-C plugs, but there are benefits to USB-C, such as being able to attach an external display. The iPad mini and iPad also offers better connectivity options including Bluetooth, WiFi, and an option for 5G cellular. The last thing to mention is that the iPad mini works with the Apple Pencil (USB-C) and the Apple Pencil Pro. The iPad is only compatible with the Apple Pencil 1. Verdict Our advice is that, if you have the money, buy the iPad mini, but if you don’t need the additional features that model brings, and you want to save money, the 10th gen iPad is still a great option (and if there are any deals on that model you’ll see them below). iPad mini (A17 Pro) prices Retailer Price $478 View Deal $499 View Deal $499 View Deal $499 View Deal $499 View Deal $499.99 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price Price comparison from Backmarket iPad (10th generation) prices New Refurbished Retailer Price $299 View Deal $299 View Deal $299.99 View Deal $339 View Deal $339 View Deal $449 View Deal Price comparison from over 24,000 stores worldwide View more prices Product Price iPad 10.9 (2022) 64GB – Yellow – (WiFi) $288.09 View Deal iPad 10.9 (2022) 64GB – Blue – (WiFi) $304.44 View Deal iPad 10.9 (2022) 64GB – Silver – (WiFi) $305 View Deal $409.99 View Deal Price comparison from Backmarket

Read more »

Apple acquires Pixelmator, iOS 18.2 beta 2, Apple movie glasses
Benjamin and Chance discuss Apple’s surprise acquisition of Pixelmator, all the new features and changes in the latest OS betas, and the rumors around Apple’s indecision for the future of wearables on your face.  And in Happy Hour Plus, we speculate on what we’d like to see from the rumored 2026 MacBook Pro redesign. Subscribe at 9to5mac.com/join. Sponsored by Zocdoc: Go to Zocdoc.com/happyhour and download the Zocdoc app to sign up for free and book a top-rated doctor. Many are available as soon as today. Sponsored by LegalZoom: Launch, run, and protect your business to make it official at Legalzoom.com. Use promo code HAPPYHR to save 10%. more…

Read more »

T3: Apple’s MacBook Pro M4 is the ultimate upgrade for Intel and early Apple Silicon owners
Apple in October unveiled the new MacBook Pro, powered by the M4 family of chips — M4, M4 Pro, and M4 Max — delivering much faster… The post appeared first on MacDailyNews.

Read more »

Canadian Man Arrested in Snowflake Data Extortions
A 26-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service Snowflake. On October 30, Canadian authorities arrested Alexander Moucka, a.k.a. Connor Riley Moucka of Kitchener, Ontario, on a provisional arrest warrant from the United States. Bloomberg first reported Moucka's alleged ties to the Snowflake hacks on Monday. At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories used by some of the world’s largest corporations.

Read more »

Vulnerability Summary for the Week of October 28, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info acnoo -- flutter_api  Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through 1.0.5. 2024-10-28 9.8 CVE-2024-50486 audit@patchstack.com  adirectory--aDirectory  Unrestricted Upload of File with Dangerous Type vulnerability in adirectory aDirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through 1.3. 2024-10-29 10 CVE-2024-50420 audit@patchstack.com  Ajar Productions--Ajar in5 Embed  Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through 3.1.3. 2024-10-29 10 CVE-2024-50473 audit@patchstack.com  Amin Omer--Sudan Payment Gateway for WooCommerce  Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2. 2024-10-29 10 CVE-2024-50494 audit@patchstack.com  amu02aftab--Enable Shortcodes inside Widgets,Comments and Experts  The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. 2024-10-30 7.3 CVE-2024-9846 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Andy Moyle--Church Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Andy Moyle Church Admin allows Reflected XSS.This issue affects Church Admin: from n/a before 5.0.0. 2024-10-28 7.1 CVE-2024-50438 audit@patchstack.com  Apache Software Foundation--Apache Lucene.Net.Replicator  Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. 2024-10-31 8 CVE-2024-43383 security@apache.org  apple -- ipados  A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox. 2024-10-28 9.6 CVE-2024-40867 product-security@apple.com  apple -- ipados  The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, iOS 17.7 and iPadOS 17.7, macOS Sonoma 14.7, visionOS 2, iOS 18 and iPadOS 18. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44126 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, macOS Sonoma 14.7.1, iOS 18.1 and iPadOS 18.1. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44218 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44252 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A path handling issue was addressed with improved logic. This issue is fixed in visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1. A malicious app may be able to run arbitrary shortcuts without user consent. 2024-10-28 7.8 CVE-2024-44255 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44258 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, watchOS 11.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.8 CVE-2024-44285 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1. An application may be able to break out of its sandbox. 2024-10-28 8.8 CVE-2024-44122 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A sandboxed process may be able to circumvent sandbox restrictions. 2024-10-28 8.6 CVE-2024-44270 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44156 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44159 product-security@apple.comproduct-security@apple.com  apple -- macos  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library. 2024-10-28 7.5 CVE-2024-44203 product-security@apple.com  apple -- macos  This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. An app may be able to bypass certain Privacy preferences. 2024-10-28 7.5 CVE-2024-44208 product-security@apple.com  apple -- macos  A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information. 2024-10-28 7.5 CVE-2024-44289 product-security@apple.comproduct-security@apple.com  apple -- xcode  This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data. 2024-10-28 7.5 CVE-2024-44228 product-security@apple.com  Apple--iOS and iPadOS  A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may fill in passwords after failing authentication. 2024-10-28 9.1 CVE-2024-44217 product-security@apple.com  Apple--macOS  The issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to break out of its sandbox. 2024-10-28 9.3 CVE-2024-44256 product-security@apple.comproduct-security@apple.com  Apple--macOS  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.5 CVE-2024-44196 product-security@apple.comproduct-security@apple.com  Apple--macOS  A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44280 product-security@apple.comproduct-security@apple.com  Apple--macOS  This issue was addressed with additional entitlement checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44295 product-security@apple.comproduct-security@apple.com  Apple--visionOS  This issue was addressed through improved state management. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, Safari 18.1. An attacker may be able to misuse a trust relationship to download malicious content. 2024-10-28 8.8 CVE-2024-44259 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  Apple--visionOS  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.7 CVE-2024-44277 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7991 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7992 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8588 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8589 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8590 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8591 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8592 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in ASMKERN230A.dll through Autodesk AutoCAD can force a Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8593 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8594 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8595 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force an Out-of-Bound Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8596 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8597 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8598 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8599 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8600 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8896 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9489 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9826 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9827 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9996 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9997 psirt@autodesk.com  Autodesk--AutoCAD  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8587 psirt@autodesk.com  Automattic--Newspack Blocks  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8. 2024-11-01 8.5 CVE-2024-37423 audit@patchstack.com  Azexo--Marketing Automation by AZEXO  Incorrect Privilege Assignment vulnerability in Azexo Marketing Automation by AZEXO allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-30 8.8 CVE-2024-50506 audit@patchstack.com  azexo--Marketing Automation by AZEXO  Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-29 9.9 CVE-2024-50480 audit@patchstack.com  buynowdepot -- advanced_online_ordering_and_delivery_platform  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuyNowDepot Advanced Online Ordering and Delivery Platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through 2.0.0. 2024-10-28 9.8 CVE-2024-50497 audit@patchstack.com  Carl Alberto--Simple Custom Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through 1.2. 2024-10-29 7.1 CVE-2024-49647 audit@patchstack.com  CHANGING Information Technology--IDExpert  IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server. 2024-11-01 7.2 CVE-2024-10653 twcert@cert.org.twtwcert@cert.org.tw  Chetan Khandla--Woocommerce Product Design  Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-29 10 CVE-2024-50482 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 8.6 CVE-2024-50509 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 7.5 CVE-2024-50508 audit@patchstack.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /track-result.php. The manipulation of the argument Consignment leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10607 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10608 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability, which was classified as critical, has been found in code-projects E-Health Care System 1.0. Affected by this issue is some unknown functionality of the file /Admin/adminlogin.php. The manipulation of the argument email/admin_pswd as part of String leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "email" to be affected. But it must be assumed that parameter "admin_pswd" is affected as well. 2024-11-03 7.3 CVE-2024-10739 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file /Users/registration.php. The manipulation of the argument f_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-03 7.3 CVE-2024-10741 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Restaurant Order System  A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10733 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Simple Car Rental System  A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10702 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Wazifa System  A vulnerability was found in code-projects Wazifa System 1.0. It has been classified as critical. This affects an unknown part of the file /controllers/logincontrol.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10699 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- hospital_appointment_system  A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-28 9.8 CVE-2024-10449 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- online_institute_management_system  A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 9.8 CVE-2024-10509 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10556 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file birdsupdate.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10561 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 7.3 CVE-2024-10507 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10736 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10737 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  CozyThemes--Cozy Blocks  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.0.15. 2024-10-28 7.4 CVE-2024-50441 audit@patchstack.com  cure53--DOMPurify  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. 2024-10-31 9.1 CVE-2024-48910 security-advisories@github.comsecurity-advisories@github.com  D3TN--D3TN  Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block 2024-10-28 7.5 CVE-2024-10455 cve@gitlab.com  Daniel Schmitzer--DS.DownloadList  Deserialization of Untrusted Data vulnerability in Daniel Schmitzer DS.DownloadList allows Object Injection.This issue affects DS.DownloadList: from n/a through 1.3. 2024-10-30 9.8 CVE-2024-50507 audit@patchstack.com  David DONISA--WP donimedia carousel  Unrestricted Upload of File with Dangerous Type vulnerability in David DONISA WP donimedia carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through 1.0.1. 2024-10-30 9.9 CVE-2024-50511 audit@patchstack.com  Delta Electronics--InfraSuite Device Master  Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication. 2024-10-30 9.8 CVE-2024-10456 ics-cert@hq.dhs.gov  Deryck Oate--User Toolkit  Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through 1.2.3. 2024-10-30 9.8 CVE-2024-50503 audit@patchstack.com  Devsoft Baltic O--SurveyJS: Drag & Drop WordPress Form Builder  Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÃœ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136. 2024-10-29 9.9 CVE-2024-50427 audit@patchstack.com  Eclipse Foundation--mosquitto  In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients. 2024-10-30 9.1 CVE-2024-10525 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  Eclipse Foundation--mosquitto  In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. 2024-10-30 7.5 CVE-2024-3935 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  esafenet -- cdg  A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delFile/delDifferCourseList of the file /com/esafenet/servlet/ajax/PublicDocInfoAjax.java. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2024-10-31 9.8 CVE-2024-10595 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  gaizhenbiao -- chuanhuchatgpt  A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions

Read more »

Booking.com Phishers May Leave You With Reservations
A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its booking.com credentials stolen. We'll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world's most visited travel website.

Read more »

Change Healthcare Breach Hits 100M Americans
Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information.

Read more »

The Global Surveillance Free-for-All in Mobile Ad Data
Not long ago, the ability to remotely track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a powerful surveillance tool that should only be in the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows that anyone can now access this capability, thanks to a proliferation of commercial services that hoover up the digital exhaust emitted by widely-used mobile apps and websites.

Read more »

Vulnerability Summary for the Week of October 14, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info Acespritech Solutions Pvt. Ltd.--Social Link Groups  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Acespritech Solutions Pvt. Ltd. Social Link Groups allows Blind SQL Injection.This issue affects Social Link Groups: from n/a through 1.1.0. 2024-10-20 8.5 CVE-2024-49619 audit@patchstack.com  acm309--PutongOJ  PutongOJ is online judging software. Prior to version 2.1.0-beta.1, unprivileged users can escalate privileges by constructing requests. This can lead to unauthorized access, enabling users to perform admin-level operations, potentially compromising sensitive data and system integrity. This problem has been fixed in v2.1.0.beta.1. As a workaround, one may apply the patch from commit `211dfe9` manually. 2024-10-17 9.1 CVE-2024-48920 security-advisories@github.comsecurity-advisories@github.comsecurity-advisories@github.com  acronis -- cyber_files  Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.8 CVE-2024-49389 security@acronis.com  acronis -- cyber_files  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.3 CVE-2024-49390 security@acronis.com  acronis -- cyber_files  Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Files (Windows) before build 9.0.0x24. 2024-10-17 7.3 CVE-2024-49391 security@acronis.com  acronis -- cyber_protect  Sensitive information manipulation due to improper authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. 2024-10-15 9.1 CVE-2024-49388 security@acronis.com  acronis -- cyber_protect  Cleartext transmission of sensitive information in acep-collector service. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 38690. 2024-10-15 7.5 CVE-2024-49387 security@acronis.com  Agustin Berasategui--AB Categories Search Widget  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Agustin Berasategui AB Categories Search Widget allows Reflected XSS.This issue affects AB Categories Search Widget: from n/a through 0.2.5. 2024-10-18 7.1 CVE-2024-49240 audit@patchstack.com  Ahime--Ahime Image Printer  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ahime Ahime Image Printer.This issue affects Ahime Image Printer: from n/a through 1.0.0. 2024-10-16 7.5 CVE-2024-49245 audit@patchstack.com  Ahmet Imamoglu--Ahmeti Wp Timeline  Cross-Site Request Forgery (CSRF) vulnerability in Ahmet Imamoglu Ahmeti Wp Timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through 5.1. 2024-10-17 7.1 CVE-2024-49237 audit@patchstack.com  Al Imran Akash--Recently  Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently allows Object Injection.This issue affects Recently: from n/a through 1.1. 2024-10-16 9.8 CVE-2024-49218 audit@patchstack.com  anand23--Ajax Rating with Custom Login  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in anand23 Ajax Rating with Custom Login allows SQL Injection.This issue affects Ajax Rating with Custom Login: from n/a through 1.1. 2024-10-17 9.3 CVE-2024-49246 audit@patchstack.com  andrewmrobbins--ShopWP  The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as updating the plugin's settings and injecting malicious scripts. 2024-10-16 7.2 CVE-2019-25214 security@wordfence.comsecurity@wordfence.com  Apa--Apa Banner Slider  Cross-Site Request Forgery (CSRF) vulnerability in Apa Apa Banner Slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49622 audit@patchstack.com  Apa--APA Register Newsletter Form  Cross-Site Request Forgery (CSRF) vulnerability in Apa APA Register Newsletter Form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49621 audit@patchstack.com  apache -- activemq_artemis  Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an authenticated attacker to write arbitrary files to the filesystem and indirectly achieve RCE. Users are recommended to upgrade to version 2.29.0 or later, which fixes the issue. 2024-10-14 8.8 CVE-2023-50780 security@apache.org  apache -- cloudstack  Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1 Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. 2024-10-16 8.8 CVE-2024-45693 security@apache.orgsecurity@apache.orgsecurity@apache.org  apache -- cloudstack  The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend service. An attacker that has access to a user's browser can use an unexpired session to gain access to resources owned by the logged out user account. This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3; and from 4.19.0.0 through 4.19.1.1. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. 2024-10-16 7.1 CVE-2024-45462 security@apache.orgsecurity@apache.orgsecurity@apache.org  Apache Software Foundation--Apache CloudStack  Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks to their existing instances. Due to missing validation checks for KVM-compatible templates or volumes in CloudStack 4.0.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1, an attacker that can upload or register templates and volumes, can use them to deploy malicious instances or attach uploaded volumes to their existing instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue. Additionally, all user-uploaded or registered KVM-compatible templates and volumes can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run this on their secondary storage(s) and inspect output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "nn"; done The command can also be run for the file-based primary storages; however, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. For checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "nn"; done 2024-10-16 8.5 CVE-2024-45219 security@apache.orgsecurity@apache.orgsecurity@apache.org  Apache Software Foundation--Apache Solr  Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue. 2024-10-16 9.8 CVE-2024-45216 security@apache.org  Apache Software Foundation--Apache Solr  Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from the backup and give it a new name, are created without setting the "trusted" metadata. ConfigSets that do not contain the flag are trusted implicitly if the metadata is missing, therefore this leads to "trusted" ConfigSets that may not have been created with an Authenticated request. "trusted" ConfigSets are able to load custom code into classloaders, therefore the flag is supposed to only be set when the request that uploads the ConfigSet is Authenticated & Authorized. This issue affects Apache Solr: from 6.6.0 before 8.11.4, from 9.0.0 before 9.7.0. This issue does not affect Solr instances that are secured via Authentication/Authorization. Users are primarily recommended to use Authentication and Authorization when running Solr. However, upgrading to version 9.7.0, or 8.11.4 will mitigate this issue otherwise. 2024-10-16 8.1 CVE-2024-45217 security@apache.org  Arif Nezami--Better Author Bio  Cross-Site Request Forgery (CSRF) vulnerability in Arif Nezami Better Author Bio allows Cross-Site Scripting (XSS).This issue affects Better Author Bio: from n/a through 2.7.10.11. 2024-10-17 7.1 CVE-2024-49229 audit@patchstack.com  arisoft--ARI Adminer WordPress Database Manager  The ARI-Adminer plugin for WordPress is vulnerable to authorization bypass due to a lack of file access controls in nearly every file of the plugin in versions up to, and including, 1.1.14. This makes it possible for unauthenticated attackers to call the files directly and perform a wide variety of unauthorized actions such as accessing a site's database and making changes. 2024-10-16 7.3 CVE-2019-25215 security@wordfence.comsecurity@wordfence.com  arraytics--WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin  The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible. 2024-10-17 9.8 CVE-2024-9263 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Asep Bagja Priandana--Woostagram Connect  Unrestricted Upload of File with Dangerous Type vulnerability in Asep Bagja Priandana Woostagram Connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through 1.0.2. 2024-10-20 10 CVE-2024-49327 audit@patchstack.com  Autodesk--Revit  A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-16 7.8 CVE-2024-7993 psirt@autodesk.com  Autodesk--Revit  A maliciously crafted RFA file, when parsed through Autodesk Revit, can force a Stack-Based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-16 7.8 CVE-2024-7994 psirt@autodesk.com  Avchat.net--AVChat Video Chat  Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2. 2024-10-20 7.1 CVE-2024-49605 audit@patchstack.com  bc2018--WordPress Landing Page Squeeze Page Responsive Landing Page Builder Free WP Lead Plus X  The WP Lead Plus X plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.99. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform administrative actions, such as adding pages to the site and/or replacing site content with malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-10-16 8.3 CVE-2020-36839 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Bhaskar Dhote--Back Link Tracker  Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Back Link Tracker allows Blind SQL Injection.This issue affects Back Link Tracker: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49617 audit@patchstack.com  Boyan Raichev--IP Loc8  Deserialization of Untrusted Data vulnerability in Boyan Raichev IP Loc8 allows Object Injection.This issue affects IP Loc8: from n/a through 1.1. 2024-10-16 9.8 CVE-2024-48028 audit@patchstack.com  Brandon Clark--SiteBuilder Dynamic Components  Deserialization of Untrusted Data vulnerability in Brandon Clark SiteBuilder Dynamic Components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through 1.0. 2024-10-20 9.8 CVE-2024-49625 audit@patchstack.com  Brandon White--Author Discussion  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through 0.2.2. 2024-10-20 8.5 CVE-2024-49609 audit@patchstack.com  brx8r--Nice Backgrounds  Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through 1.0. 2024-10-20 10 CVE-2024-49330 audit@patchstack.com  ChanGate--Property Management System  Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. 2024-10-15 9.8 CVE-2024-9972 twcert@cert.org.twtwcert@cert.org.tw  chertz--WP Easy Post Types  The WP Easy Post Types plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.4 via deserialization of untrusted input from the 'text' parameter in the 'ajax_import_content' function. This allows authenticated attackers, with subscriber-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. 2024-10-18 8.8 CVE-2024-10079 security@wordfence.comsecurity@wordfence.com  chertz--WP Easy Post Types  The WP Easy Post Types plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 1.4.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify, or delete plugin options and posts. 2024-10-18 7.3 CVE-2024-10078 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Cisco--Cisco Analog Telephone Adaptor (ATA) Software  A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to view or delete the configuration or change the firmware on an affected device. This vulnerability is due to a lack of authentication on specific HTTP endpoints. An attacker could exploit this vulnerability by browsing to a specific URL. A successful exploit could allow the attacker to view or delete the configuration or change the firmware. 2024-10-16 8.2 CVE-2024-20458 ykramarz@cisco.com  Cisco--Cisco Analog Telephone Adaptor (ATA) Software  A vulnerability in the web-based management interface of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user. 2024-10-16 7.1 CVE-2024-20421 ykramarz@cisco.com  cmssoft--CSV Product Import Export for WooCommerce  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cmssoft CSV Product Import Export for WooCommerce allows SQL Injection.This issue affects CSV Product Import Export for WooCommerce: from n/a through 1.0.0. 2024-10-17 8.5 CVE-2024-49244 audit@patchstack.com  code-projects -- pharmacy_management_system  A vulnerability classified as critical has been found in code-projects Pharmacy Management System 1.0. This affects an unknown part of the file /php/manage_customer.php?action=search. The manipulation of the argument text leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-15 9.8 CVE-2024-9976 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Blood Bank Management System  A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file member_register.php. The manipulation of the argument fullname/username/password/email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "password" to be affected. But it must be assumed that other parameters are affected as well. 2024-10-15 7.3 CVE-2024-9986 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  CodeFlock--FREE DOWNLOAD MANAGER  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through 1.0.0. 2024-10-17 8.6 CVE-2024-49315 audit@patchstack.com  CodePassenger--Job Board Manager for WordPress  Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through 1.0. 2024-10-17 9.8 CVE-2024-49322 audit@patchstack.com  Codezips--Sales Management System  A vulnerability was found in Codezips Sales Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file deletecustcom.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10165 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Sales Management System  A vulnerability was found in Codezips Sales Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file checkuser.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10166 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Sales Management System  A vulnerability classified as critical has been found in Codezips Sales Management System 1.0. This affects an unknown part of the file deletecustind.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-20 7.3 CVE-2024-10167 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Cookie Scanner Nikel Schubert--Cookie Scanner  Cross-Site Request Forgery (CSRF) vulnerability in Cookie Scanner - Nikel Schubert Cookie Scanner allows Stored XSS.This issue affects Cookie Scanner: from n/a through 1.1. 2024-10-17 7.1 CVE-2024-49220 audit@patchstack.com  cyberlord92--Miniorange OTP Verification with Firebase  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 3.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources, and the user current password check is missing. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. 2024-10-17 9.8 CVE-2024-9862 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  cyberlord92--Miniorange OTP Verification with Firebase  The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.6.0 due to the insecure 'administrator' default value for the 'default_user_role' option. This makes it possible for unauthenticated attackers to register an administrator user even if the registration form is disabled. 2024-10-17 9.8 CVE-2024-9863 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  cyberlord92--Miniorange OTP Verification with Firebase  The Miniorange OTP Verification with Firebase plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.6.0. This is due to missing validation on the token being supplied during the otp login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the phone number associated with that user. 2024-10-17 8.1 CVE-2024-9861 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Dan Alexander--SermonAudio Widgets  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dan Alexander SermonAudio Widgets allows SQL Injection.This issue affects SermonAudio Widgets: from n/a through 1.9.3. 2024-10-20 8.5 CVE-2024-49614 audit@patchstack.com  Dassault Systmes--3DSwymer  An authorization bypass through user-controlled key vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an authenticated attacker to access some unauthorized data. 2024-10-16 7.7 CVE-2024-8040 3DS.Information-Security@3ds.com  Dassault Systmes--ENOVIA Collaborative Industry Innovator  A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session. 2024-10-16 8.7 CVE-2024-6380 3DS.Information-Security@3ds.com  Dell--Dell OpenManage Enterprise  Dell OpenManage Enterprise, version(s) OME 4.1 and prior, contain(s) an Improper Control of Generation of Code ('Code Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. 2024-10-17 8 CVE-2024-45766 security_alert@emc.com  Denis--Azz Anonim Posting  Unrestricted Upload of File with Dangerous Type vulnerability in Denis Azz Anonim Posting allows Upload a Web Shell to a Web Server.This issue affects Azz Anonim Posting: from n/a through 0.9. 2024-10-16 10 CVE-2024-49257 audit@patchstack.com  Dennis Hoppe--Encyclopedia / Glossary / Wiki  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dennis Hoppe Encyclopedia / Glossary / Wiki allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through 1.7.60. 2024-10-17 7.1 CVE-2024-49320 audit@patchstack.com  didi--DDMQ  A vulnerability has been found in didi DDMQ 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Console Module. The manipulation with the input /;login leads to improper authentication. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. 2024-10-20 7.3 CVE-2024-10173 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Dotsquares--Google Map Locations  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dotsquares Google Map Locations allows Reflected XSS.This issue affects Google Map Locations: from n/a through 1.0. 2024-10-20 7.1 CVE-2024-49606 audit@patchstack.com  dueclic -- wp_2fa_with_telegram  The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validate_tg' action. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to log in as any existing user on the site, such as an administrator. 2024-10-15 8.8 CVE-2024-9687 security@wordfence.comsecurity@wordfence.com  dueclic -- wp_2fa_with_telegram  The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication. 2024-10-15 7.5 CVE-2024-9820 security@wordfence.comsecurity@wordfence.com  easy.jobs--EasyJobs  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14. 2024-10-17 7.1 CVE-2024-43997 audit@patchstack.com  edo888--Translate WordPress Google Language Translator  The Google Language Translator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in versions up to, and including, 6.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Specifically affects users with older browsers that lack proper URL encoding support. 2024-10-16 7.1 CVE-2021-4452 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Edush Maxim--GoogleDrive folder list  Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2. 2024-10-20 7.1 CVE-2024-49335 audit@patchstack.com  emrevona--WP Fastest Cache  The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete arbitrary files from the server. 2024-10-16 8.8 CVE-2020-36836 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  ESi Technology--AIM LINE Marketing Platform  AIM LINE Marketing Platform from Esi Technology does not properly validate a specific query parameter. When the LINE Campaign Module is enabled, unauthenticated remote attackers can inject arbitrary FetchXml commands to read, modify, and delete database content. 2024-10-15 9.8 CVE-2024-9982 twcert@cert.org.twtwcert@cert.org.tw  F5--BIG-IP  BIG-IP monitor functionality may allow an attacker to bypass access control restrictions, regardless of the port lockdown settings.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. 2024-10-16 7.2 CVE-2024-45844 f5sirt@f5.com  facebook--Facebook Chat Plugin Live Chat Plugin for WordPress  The Facebook Chat Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_update_options function in versions up to, and including, 1.5. This flaw makes it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. 2024-10-16 7.4 CVE-2020-36838 security@wordfence.comsecurity@wordfence.com  Fahad Mahmood--Endless Posts Navigation  Cross-Site Request Forgery (CSRF) vulnerability in Fahad Mahmood Endless Posts Navigation allows Stored XSS.This issue affects Endless Posts Navigation: from n/a through 2.2.7. 2024-10-20 7.1 CVE-2024-49629 audit@patchstack.com  Fahad Mahmood--Keep Backup Daily  : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Fahad Mahmood Keep Backup Daily allows Retrieve Embedded Sensitive Data.This issue affects Keep Backup Daily: from n/a through 2.0.7. 2024-10-17 7.5 CVE-2024-48024 audit@patchstack.com  filemanagerpro -- file_manager  The File Manager Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.3.9. This is due to missing or incorrect nonce validation on the 'mk_file_folder_manager' ajax action. This makes it possible for unauthenticated attackers to upload arbitrary files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. 2024-10-16 8.8 CVE-2024-8507 security@wordfence.comsecurity@wordfence.com  filemanagerpro -- file_manager  The File Manager Pro plugin for WordPress is vulnerable to arbitrary backup file downloads and uploads due to missing file type validation via the 'mk_file_folder_manager_shortcode' ajax action in all versions up to, and including, 8.3.9. This makes it possible for unauthenticated attackers, if granted access to the File Manager by an administrator, to download and upload arbitrary backup files on the affected site's server which may make remote code execution possible. 2024-10-16 8.8 CVE-2024-8746 security@wordfence.comsecurity@wordfence.com  Fliperrr Team--Creates 3D Flipbook, PDF Flipbook  Unrestricted Upload of File with Dangerous Type vulnerability in Fliperrr Team Creates 3D Flipbook, PDF Flipbook allows Upload a Web Shell to a Web Server.This issue affects Creates 3D Flipbook, PDF Flipbook: from n/a through 1.2. 2024-10-16 9.9 CVE-2024-48034 audit@patchstack.com  formosasoft -- ee-class  The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to inject arbitrary SQL commands to read, modify and delete database contents. 2024-10-15 8.8 CVE-2024-9980 twcert@cert.org.twtwcert@cert.org.tw  formosasoft -- ee-class  The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server. 2024-10-15 8.8 CVE-2024-9981 twcert@cert.org.twtwcert@cert.org.tw  Gabriele Valenti--Telecash Ricaricaweb  Deserialization of Untrusted Data vulnerability in Gabriele Valenti Telecash Ricaricaweb allows Object Injection.This issue affects Telecash Ricaricaweb: from n/a through 2.2. 2024-10-16 9.8 CVE-2024-48030 audit@patchstack.com  Gerry Ntabuhashe--GERRYWORKS Post by Mail  : Incorrect Privilege Assignment vulnerability in Gerry Ntabuhashe GERRYWORKS Post by Mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through 1.0. 2024-10-20 8.8 CVE-2024-49608 audit@patchstack.com  Giveaway Boost--Giveaway Boost  Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4. 2024-10-20 9.8 CVE-2024-49332 audit@patchstack.com  google -- chrome  Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) 2024-10-15 8.8 CVE-2024-9954 chrome-cve-admin@google.comchrome-cve-admin@google.com  google -- chrome  Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) 2024-10-15 8.8 CVE-2024-9965 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google Cloud--Migrate to Containers  There exists an insecure default user permission in Google Cloud Migrate to containers from version 1.1.0 to 1.2.2 Windows installs. A local "m2cuser" was greated with administrator privileges. This posed a security risk if the "analyze" or "generate" commands were interrupted or skipping the action to delete the local user "m2cuser". We recommend upgrading to 1.2.3 or beyond 2024-10-16 7.8 CVE-2024-9858 cve-coordination@google.com  Google--Chrome  Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9955 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9957 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9959 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9960 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 8.8 CVE-2024-9961 chrome-cve-admin@google.comchrome-cve-admin@google.com  Google--Chrome  Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) 2024-10-15 7.8 CVE-2024-9956 chrome-cve-admin@google.comchrome-cve-admin@google.com  Gora Tech LLC--Cooked Pro  Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0. 2024-10-17 10 CVE-2024-49291 audit@patchstack.com  Grafana--Grafana  The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input. These queries are insufficiently sanitized before being passed to `duckdb`, leading to a command injection and local file inclusion vulnerability. Any user with the VIEWER or higher permission is capable of executing this attack. The `duckdb` binary must be present in Grafana's $PATH for this attack to function; by default, this binary is not installed in Grafana distributions. 2024-10-18 9.9 CVE-2024-9264 security@grafana.com  Grayson Robbins--Disc Golf Manager  Deserialization of Untrusted Data vulnerability in Grayson Robbins Disc Golf Manager allows Object Injection.This issue affects Disc Golf Manager: from n/a through 1.0.0. 2024-10-16 9.8 CVE-2024-48026 audit@patchstack.com  Hasan Movahed--Duplicate Title Validate  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hasan Movahed Duplicate Title Validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through 1.0. 2024-10-20 8.5 CVE-2024-49623 audit@patchstack.com  helmholz -- myrex24_v2_virtual_server  An unauthenticated remote attacker can perform a brute-force attack on the credentials of the remote service portal with a high chance of success, resulting in connection lost. 2024-10-15 7.5 CVE-2024-45272 info@cert.vde.cominfo@cert.vde.com  Henrique Rodrigues--SafetyForms  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Rodrigues SafetyForms allows Blind SQL Injection.This issue affects SafetyForms: from n/a through 1.0.0. 2024-10-20 8.2 CVE-2024-49615 audit@patchstack.com  Hgiga--OAKlouds  The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can download arbitrary system files, which may be deleted subsequently . 2024-10-14 9.8 CVE-2024-9924 twcert@cert.org.twtwcert@cert.org.tw  HMS Networks--EWON FLEXY 202  The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials. 2024-10-17 8.2 CVE-2024-7755 ics-cert@hq.dhs.gov  HP Inc.--Certain HP DesignJet products  Certain HP DesignJet products may be vulnerable to credential reflection which allow viewing SMTP server credentials. 2024-10-15 7.5 CVE-2024-5749 hp-security-alert@hp.com  Hung Trang Si--SB Random Posts Widget  : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hung Trang Si SB Random Posts Widget allows PHP Local File Inclusion.This issue affects SB Random Posts Widget: from n/a through 1.0. 2024-10-16 7.5 CVE-2024-48029 audit@patchstack.com  Igor Funa--Ad Inserter  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Igor Funa Ad Inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.7.37. 2024-10-17 7.1 CVE-2024-49248 audit@patchstack.com  Imagination Technologies--Graphics DDK  Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU. 2024-10-14 7.8 CVE-2024-43701 367425dc-4d06-4041-9650-c2dc6aaa27ce  Infotuts--SW Contact Form  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infotuts SW Contact Form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through 1.0. 2024-10-20 8.5 CVE-2024-49612 audit@patchstack.com  Innovaweb Sp. z o.o.--Free Stock Photos Foter  Deserialization of Untrusted Data vulnerability in Innovaweb Sp. Z o.O. Free Stock Photos Foter allows Object Injection.This issue affects Free Stock Photos Foter: from n/a through 1.5.4. 2024-10-16 8.8 CVE-2024-49227 audit@patchstack.com  Jack Zhu--photokit  Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0. 2024-10-20 10 CVE-2024-49610 audit@patchstack.com  James Park--Analyse Uploads  Relative Path Traversal vulnerability in James Park Analyse Uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through 0.5. 2024-10-16 8.6 CVE-2024-49253 audit@patchstack.com  JetBrains--YouTrack  In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests 2024-10-17 8.1 CVE-2024-49579 cve@jetbrains.com  jetmonsters--Timetable and Event Schedule by MotoPress  The Timetable and Event Schedule by MotoPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wp_ajax_route_url() function called via a nopriv AJAX action in versions up to, and including, 2.3.8. This makes it possible for unauthenticated attackers to call that function and perform a wide variety of actions such as including random template, injecting malicious web scripts, and more. 2024-10-16 7.3 CVE-2020-36840 security@wordfence.comsecurity@wordfence.com  Jon Vincent Mendoza--Dynamic Elementor Addons  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jon Vincent Mendoza Dynamic Elementor Addons allows PHP Local File Inclusion.This issue affects Dynamic Elementor Addons: from n/a through 1.0.0. 2024-10-18 7.5 CVE-2024-49243 audit@patchstack.com  Jordan Lyall--MyTweetLinks  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jordan Lyall MyTweetLinks allows Blind SQL Injection.This issue affects MyTweetLinks: from n/a through 1.1.1. 2024-10-20 8.5 CVE-2024-49618 audit@patchstack.com  Joshua Clayton--Feed Comments Number  Unrestricted Upload of File with Dangerous Type vulnerability in Joshua Clayton Feed Comments Number allows Upload a Web Shell to a Web Server.This issue affects Feed Comments Number: from n/a through 0.2.1. 2024-10-16 10 CVE-2024-49216 audit@patchstack.com  Julian Weinert // cs&m--cSlider  Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m cSlider allows Stored XSS.This issue affects cSlider: from n/a through 2.4.2. 2024-10-17 7.1 CVE-2024-49221 audit@patchstack.com  Kubernetes--Image Builder  A security issue was discovered in the Kubernetes Image Builder versions

Read more »

Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach
Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being "USDoD," a prolific cybercriminal who rose to infamy in 2022 after infiltrating the FBI's InfraGard program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the consumer data broker National Public Data that led to the leak of Social Security numbers and other personal information for a significant portion of the U.S. population.

Read more »

Sudanese Brothers Arrested in ‘AnonSudan’ Takedown
The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running Anonymous Sudan (a.k.a. AnonSudan), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers. One of the brothers is facing life in prison for allegedly seeking to kill people with his attacks.

Read more »

Lamborghini Carjackers Lured by $243M Cyberheist
The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later, while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom.

Read more »

Early Black Friday sale: HomePod minis for $84.99 at Verizon, save $14 (15% off)
Snag an Apple HomePod mini in your favorite color at early Black Friday prices, now $15 off at Verizon ($84.99). Compact yet powerful, the HomePod mini delivers rich, 360-degree sound and integrates seamlessly with your Apple devices and smart home setup. Their sale price applies to all mini colors and represents a rare HomePod sale price. Verizon service is not required for purchase. Buy online and choose free shipping or free local store pickup (if available). Sale price for online orders only, in-store price may vary. See our HomePod Price Tracker for the latest prices and deals from Apple and its retailers.

Read more »

Apple AirPods Pro with USB-C on Black Friday sale today for $169, $80 off MSRP
Best Buy has Apple's AirPods Pro with USB-C in stock and on Black Friday sale today for $169.99. That's $80 off MSRP. Sale prices for online orders only, in-store price may vary. Order online and choose free shipping or free local store pickup. This is limited-time, early Black Friday pricing. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily.

Read more »

Price Drop! Clearance 14-inch M3 Pro/M3 Max MacBook Pros for $400 off original MSRP
B&H Photo has dropped prices on clearance 14" M3 Pro and M3 Max MacBook Pros by $400 off original MSRP with prices now available starting at $1599. B&H offers free 1-2 day delivery to most US addresses: - 14" 11-Core M3 Pro MacBook Pro (18GB RAM/512GB SSD): $1599 $400 off MSRP - 14" 12-Core M3 Pro MacBook Pro (18GB RAM/1TB SSD): $1999 $400 off MSRP - 14" 14-Core M3 Max MacBook Pro (36GB RAM/1TB SSD): $2799 $400 off MSRP For the latest prices and sales, see our 14" MacBook Pro Price Tracker, updated daily.

Read more »

Take $50 off Apple’s 10th-generation iPads with the latest sales
Amazon and Best Buy are offering $50 discounts on Apple's 10th-generation iPads this week, with models now available starting at only $299. These are the lowest prices available for Apple's entry-level iPads: (1): Best Buy has Apple's 10th-generation WiFi iPads on sale for $50 off MSRP in their online store. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 10" 10th-generation 64GB WiFi iPads: $299 $50 off MSRP - 10" 10th-generation 256GB WiFi iPads: $449 $50 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $449 $50 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $599 $50 off MSRP (2): Amazon has Apple's 10th-generation WiFi iPads on sale for $50 off MSRP as well. Shipping is free: - 10" 10th-generation 64GB WiFi iPads: $299 $50 off MSRP - 10" 10th-generation 256GB WiFi iPads: $449 $50 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $449 $50 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $599 $50 off MSRP Note that Amazon's prices are dynamic, and the sale price may vary depending on model and color. See their site for the latest information. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Take $50 off Apple’s 10th-generation iPads with the latest sales
Amazon and Best Buy are offering $50 discounts on Apple's 10th-generation iPads this week, with models now available starting at only $299. These are the lowest prices available for Apple's entry-level iPads: (1): Best Buy has Apple's 10th-generation WiFi iPads on sale for $50 off MSRP in their online store. Sale prices for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available): - 10" 10th-generation 64GB WiFi iPads: $299 $50 off MSRP - 10" 10th-generation 256GB WiFi iPads: $449 $50 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $449 $50 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $599 $50 off MSRP (2): Amazon has Apple's 10th-generation WiFi iPads on sale for $50 off MSRP as well. Shipping is free: - 10" 10th-generation 64GB WiFi iPads: $299 $50 off MSRP - 10" 10th-generation 256GB WiFi iPads: $449 $50 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $449 $50 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $599 $50 off MSRP Note that Amazon's prices are dynamic, and the sale price may vary depending on model and color. See their site for the latest information. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Early Black Friday Sale: New iPads for only $199
Best Buy has Apple's 9th generation 10.2" WiFi iPads on early Black Friday sale for starting at only $199 on their online store for a limited time. Sale prices for online orders only, in-store prices may vary. Order online, and choose free shipping or free local store pickup (if available): - 10" 64GB WiFi iPad (Space Gray or Silver): $199.99 MSRP $329 - 10" 256GB WiFi iPad (Space Gray or Silver): $349.99 MSRP $479 - 10" 64GB WiFi + Cellular iPad (Space Gray or Silver): $329.99 MSRP $459 - 10" 256GB WiFi + Cellular iPad (Space Gray or Silver): $479.99 MSRP $609 Best Buy's prices are among the lowest prices available for these base-model iPads. These are clearance iPads and will be available while supplies last. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Clearance 13-inch M2 MacBook Airs with 8GB of memory on sale again for only $699
Amazon has clearance 13" MacBook Airs with M2 CPUs and 8GB of RAM in stock today and on sale again for $300 off MSRP with prices starting at only $699. Shipping is free. These are the lowest prices available for M2-powered MacBook Airs anywhere: - 13" M2 MacBook Air 8GB/256GB (Space Gray): $699, $300 off MSRP - 13" M2 MacBook Air 8GB/256GB (Silver): $699, $300 off MSRP - 13" M2 MacBook Air 8GB/256GB (Midnight): $699, $300 off MSRP - 13" M2 MacBook Air 8GB/256GB (Starlight): $699, $300 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker, updated daily.

Read more »

13-inch M2 MacBook Air (16GB RAM/256GB SSD) on early Black Friday sale for $799, $200 off MSRP, with free store pickup
Best Buy has Apple's newly upgraded 13" MacBook Airs with M2 CPUs and 16GB of RAM on early Black Friday sale for $200 off MSRP, only $799. Their price equals that of Amazon's, which we posted yesterday. It's the lowest price out there for a new MacBook with 16GB of memory and a great deal: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Sale price for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

13-inch M2 MacBook Air (16GB RAM/256GB SSD) on early Black Friday sale for $799, $200 off MSRP, with free store pickup
Best Buy has Apple's newly upgraded 13" MacBook Airs with M2 CPUs and 16GB of RAM on early Black Friday sale for $200 off MSRP, only $799. Their price equals that of Amazon's, which we posted yesterday. It's the lowest price out there for a new MacBook with 16GB of memory and a great deal: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Sale price for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

13-inch M2 MacBook Air (16GB RAM/256GB SSD) on early Black Friday sale for $799, $200 off MSRP, with free store pickup
Best Buy has Apple's newly upgraded 13" MacBook Airs with M2 CPUs and 16GB of RAM on early Black Friday sale for $200 off MSRP, only $799. Their price equals that of Amazon's, which we posted yesterday. It's the lowest price out there for a new MacBook with 16GB of memory and a great deal: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Sale price for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

13-inch M2 MacBook Air (16GB RAM/256GB SSD) on early Black Friday sale for $799, $200 off MSRP, with free store pickup
Best Buy has Apple's newly upgraded 13" MacBook Airs with M2 CPUs and 16GB of RAM on early Black Friday sale for $200 off MSRP, only $799. Their price equals that of Amazon's, which we posted yesterday. It's the lowest price out there for a new MacBook with 16GB of memory and a great deal: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP Sale price for online orders only, in-store prices may vary. Order online and choose free shipping or free local store pickup (if available). For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

Early Black Friday Deal: Apple’s newly upgraded 13-inch M2 MacBook Air with 16GB of RAM for $799, $200 off MSRP
Amazon has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM on early Black Friday sale for $200 off MSRP, only $799. Their prices are the lowest currently available for these newly upgraded 13" M2 MacBook Airs. At the time of this post, the discount applied only to Silver and Starlight colors, but other colors may also qualify for the discount soon -- check their site for the latest information: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $799 $200 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »