Save up to $2,000 with exclusive Bluetti portable power station Black Friday deals
Bluetti is offering incredible discounts up to 57% off of essential portable power station models and exclusive coupons during its Black Friday sales event. Don't miss out.Bluetti Black FridayWhether you're looking to upgrade an older home battery backup system or want to check out a new model for the first time, Bluetti has you covered. These giant batteries and inverters can keep your devices powered through any storm, on the road, or at the campsite, letting users go off grid.Bluetti specializes in whole home power backup systems and a range of portable power stations. They are a very compelling solution and utilize the latest features and technologies you'd expect from a premium portable power station brand. Continue Reading on AppleInsider

Read more »

Elevate your MacBook with iVANKY’s new FusionDock lineup [Video]
Regarding docking solutions for your MacBook, iVANKY’s FusionDock lineup is like your tech sidekick, helping you level up your workspace. Whether you’re a power user juggling multiple displays or just need a reliable dock to expand your MacBook’s capabilities, FusionDock has your back. Known for top-notch compatibility, sleek design, and serious performance, these docks are made to keep your workflow smooth and your desk clutter-free. Let’s dive into the lineup and see what each dock can do for your MacBook! Get an additional 10% off by using the code “FOR9to5Mac” for a limited time. more…

Read more »

WhatsApp now rolling out voice message transcripts to all users
More than a year ago, WhatsApp began testing a new feature for transcribing audio messages into text. The feature was only available to beta users, but starting today, everyone can benefit from voice message transcripts on WhatsApp. more…

Read more »

Number of companies supporting passkeys in apps and websites tops 200
Over 200 companies have adopted passkey technology, signaling a significant step towards a passwordless future. This milestone… The post appeared first on MacDailyNews.

Read more »

Security Bite: Ransomware groups surge in Q3 2024, with shifting dominance
9to5Mac Security Bite is exclusively brought to you by Mosyle, the only Apple Unified Platform. Making Apple devices work-ready and enterprise-safe is all we do. Our unique integrated approach to management and security combines state-of-the-art Apple-specific security solutions for fully automated Hardening & Compliance, Next Generation EDR, AI-powered Zero Trust, and exclusive Privilege Management with the most powerful and modern Apple MDM on the market. The result is a totally automated Apple Unified Platform currently trusted by over 45,000 organizations to make millions of Apple devices work-ready with no effort and at an affordable cost. Request your EXTENDED TRIAL today and understand why Mosyle is everything you need to work with Apple. Corvus, one of the leading cyber insurance providers, has published its quarterly Cyber Threat Report for Q3 2024, focused on the shifting ransomware landscape. While the rising number of ransomware attacks should be no surprise to anyone, the report outlines how cybercriminals are becoming more competitive and adopting more aggressive strategies rather than waiting for the next mass-exploit event. more…

Read more »

Siri chatbot may be coming in 2026 as part of iOS 19
A new rumor suggests Apple wants to make Siri more conversational by making it use a large language model backend similar to ChatGPT and AI rivals, but it won't be ready until 2026.Siri could get an LLM backend in 2026When Apple was first rumored to be tackling artificial intelligence, one thing that was repeated often — Apple would not release a chatbot. The idea that users would converse with Siri in the same way they did with ChatGPT was seemingly off the table for the launch.Since then, a lot has changed, and according to a report from Bloomberg, Apple has begun work on an LLM-based Siri that might debut in iOS 19 in early 2026. This report lines up with AppleInsider's earlier exclusive on Apple AI testing tools that point to Siri becoming more tied to Apple's AI features. Rumor Score: 🤔 Possible Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple is working on a huge Siri upgrade for iOS 19 and macOS 16
Macworld Apple is really driving hard in its race to be a top player in AI. The Apple Intelligence features are coming in so hot that they’re being released in stages, taking months after the release of iOS 18. And now a new report says the company is full steam ahead on a new version of Siri that goes well beyond the enhanced, more personal Siri coming this spring. According to a report from Mark Gurman at Bloomberg, Apple is building a new version of Siri that makes use of more advanced large language models (LLMs), and employees on the project are calling it “LLM Siri.” The new Siri will be able to hold natural back-and-forth conversations, not unlike the new Advanced Voice Mode of OpenAI’s ChatGPT. It will also handle more sophisticated requests more quickly. According to the report, Apple is already testing the new Siri as a separate app on iPhones, iPads, and Macs, but it will be released as a replacement for the built-in OS feature we know today. The new Siri is expected to be unveiled in 2025 as part of iOS 19 and macOS 16, but won’t be available at launch—instead, they’ll come in an update early in 2026 (i.e. iOS 19.3 or the like). Siri is expected to get a big upgrade early in 2025 as part of iOS 18.3 or 18.4. Though the fundamental AI model isn’t changing, that version of Siri will be able to build a personal profile of you based on your on-device data (contacts, Messages, location history, and so on) in order to “know” you better. It will also be able to make use of hundreds of new App Intents, which are hooks that third-party app developers can use to allow Siri to perform functions or access data from within apps on your iPhone, iPad, or Mac. Next month, Siri will get ChatGPT integration and some new visual intelligence features, but still remains largely the Siri we’ve known for years. The report doesn’t clarify exactly how the new Siri will work; Apple emphasizes on-device processing for better privacy, speed, and reliability. But advanced LLM models are huge, requiring large amounts of processing and significant RAM. The AI models of Apple Intelligence in iOS 18 already require around 2GB of RAM, which is why they need an iPhone 15 Pro Max or iPhone 16 to run (those are Apple’s only phones with 8GB of total RAM). If Apple is already testing the system on current devices, there’s a good chance your current phone will run it, but it may need a live internet connection to do so.

Read more »

M4 Mac mini two weeks later: The invisible Mac that does it all
I’ve had my M4 Mac mini for two weeks now, and it still seems kind of remarkable that this tiny little box can do so much. My uses for the M4 mini are probably unconventional, but that’s also the beauty of the product: it serves a versatile set of needs, all at a very low price point (). Here are my takeaways after a fortnight of use. more…

Read more »

9to5Mac Daily: November 21, 2024 – Apple Black Friday event, iOS 18.2 tidbits
Listen to a recap of the top stories of the day from 9to5Mac. 9to5Mac Daily is available on iTunes and Apple’s Podcasts app, Stitcher, TuneIn, Google Play, or through our dedicated RSS feed for Overcast and other podcast players. Sponsored by CardPointers: The best way to maximize your credit card rewards. 9to5Mac Daily listeners can exclusively save 50%. more…

Read more »

Bloomberg: Apple developing new ‘LLM Siri’ for iOS 19 and macOS 16
While Apple is in the midst of rolling out new Apple Intelligence features as part of iOS 18, it’s also working on yet-to-be-announced features for iOS 19. One of those features is an upgraded version of Siri powered by more advanced large language models, or LLMs. The news was detailed in a new report today from Bloomberg. more…

Read more »

Apple now directly selling ads in Apple News
Apple has begun selling advertising inventory for Apple News. The company is introducing new ad units designed to increase revenue for both… The post appeared first on MacDailyNews.

Read more »

Grab Apple's 16-inch MacBook Pro M4 at record low $2,199 price
Apple's M4 Pro 16-inch MacBook Pro is on sale for $2,199, that's $300 off the price of a brand new notebook with its latest generation of Apple Silicon.Save $300 on this M4 MacBook ProIt's only been available a matter of weeks, but the 16-inch MacBook Pro with the M4 Pro chip is already being discounted as part of the pre-Black Friday sales. In offers from Amazon and Best Buy, you can secure the portable powerhouse for hundreds of dollars less than the launch price.Buy for $2,199 Continue Reading on AppleInsider | Discuss on our Forums

Read more »

How to change your Apple Account primary email address
Macworld When you first register for an Apple Account (formerly Apple ID), you can use either a new email address provided by Apple (with an @icloud.com address) or one you already have. You can have multiple email addresses associated with your Apple ID, but only one primary address—the core address you’ll use to log in and to which important Apple Account-related emails would be delivered. It used to be a pain to change this, involving a multi-step process that you can only do on the web. With iOS 18.1, Apple has made it a lot easier to change your primary Apple ID address, and you can do it right from your iPhone or iPad. (The web still works, too.) Here’s how you do it. Change your Apple Account primary email on your iPhone or iPad First, ensure your devices are running iOS 18.1, iPadOS 18.1, or a later version. Open Settings, then tap your name at the top to access your Apple account settings Tap Sign-In & Security Tap the email address marked “Primary email” Turn off the Primary Email switch to remove this as your main email. You’ll be prompted to select a new primary email address, either from another email associated with your Apple Account or by adding a new one Follow the onscreen steps to enter and verify your new primary email address If you have a third-party email address (not an @icloud.com or @me.com address) associated with your Apple Account and you want to remove it, just select it and tap Remove from Account. If it’s your Primary address you’ll be prompted to choose or create a new primary. For Apple-supplied email address (@icloud.com or @me.com) you’ll instead see an option to Change Email Address, which lets you pick a different email address but not remove it from your account. Change your Apple Account primary email on the web If you don’t have an iPhone or iPad (you only use a Mac, or maybe an Apple TV or something) you can change your primary email on the web. Go to account.apple.com and sign in Select Sign-In and Security on the left menu, and then Email & Phone Numbers Click the Remove button (-) next to your primary email Follow the onscreen steps to enter and verify your new primary email address

Read more »

Rumor Replay: Apple Television, AirTag 2 upgrades, iPhone 17 tidbits
This is Rumor Replay, a new weekly column at 9to5Mac that provides a quick rundown of the most recent Apple product rumors, with my analysis and commentary. Today: Apple Television, AirTag 2 upgrades, iPhone 17 tidbits, and a new Pro Display XDR. Here are this week’s Apple rumors. more…

Read more »

Fix the mess caused by Sign in with Apple and Hide My Email
I always use Sign In With Apple and Hide My Email whenever it’s an option — but how do you find, manage or delete these accounts? (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple’s M2 MacBook Air is just $699 at Amazon, the lowest price ever
Amazon’s new price drop on Apple’s M2 MacBook Air delivers the lowest price on record, with a $500 discount bringing the laptop down to just… The post appeared first on MacDailyNews.

Read more »

Apple TV set rumors resurface, AirTag 2, TV+ original movies strategy
Benjamin and Chance discuss the merits of Apple returning to the long-gestating idea of an Apple television set, in the context of its refocusing on smart home devices. Also, the second-generation AirTag is rumored to arrive in 2025 with some nice enhancements, and Apple’s original film division continues to waver on strategy.  And in Happy Hour Plus, Chance bemoans Apple’s abandonment of accessories like the MagSafe Battery Pack, and gives his thoughts on the new Belkin strap for Vision Pro. Subscribe at 9to5mac.com/join. Sponsored by SelectQuote: Get the right life insurance for YOU, for LESS, at SelectQuote.com/HAPPYHOUR. : This Black Friday, discover Dreame Technologies’ innovative family of smart home cleaning solutions—designed to revolutionize your cleaning routine! Don’t miss out on groundbreaking deals, plus enjoy an . Experience the future of cleaning today! Sponsored by Shopify: Grow your business no matter what stage you’re in. Sign up for a $1 per month trial at shopify.com/happyhour. more…

Read more »

This Black Friday deal slashes $300 off the highest-end M4 MacBook Pros for the first time
Macworld Apple introduced the 16-inch M4 Pro MacBook Pro just a few weeks ago, so you may not expect to find any good Black Friday deals on it so soon after its release. But that’s not the case! In fact, you can get an excellent deal right now–Amazon is selling the 16-inch MacBook Pro with an M4 Pro processor, 24GB of RAM, and 512GB of storage for $2,199. That’s a savings of $300 off the regular price and the best price we’ve ever seen. But wait, it gets better. That $300 price cut applies if you decide to upgrade the RAM or the chip as well. For example, you can get the 16-inch MacBook Pro with an M4 Pro, 48GB of RAM, and a 512GB SSD for $2,599 (regular price $2,899). Or you can get the 16-inch MacBook Pro with an M4 Max, 36GB of RAM, and a 1TB SSD for $3,199 (regular price ($3,499). Or, if you want to go to the extreme, you can get the 16-inch MacBook Pro with an M4 Max, 48GB of RAM, and a 1TB SSD for $3,699 (regular price $3,999). All of these models are available in Space Black or Silver. Buy it now on Amazon The M4 Pro and Max chips in the 16-inch MacBook Pro are Apple’s fastest MacBook chips available, ideal for professionals or anyone who needs to do some serious data processing. The M4 Pro and Max laptops also have Thunderbolt 5, which offers a big speed boost with data transfers and enhanced external display support. The laptops also feature a new 12-megapixel Center Stage camera, a major upgrade from the 1080p camera in the M3-based MacBook Pro. One important note: The Amazon deal is for MacBook Pros with the standard display with glossy glass. Apple introduced a Nano-texture matter glass with the M4-series MacBook Pro, but Amazon doesn’t offer that option. The standard glass is the same glossy display Apple has offered for years, and it’s a great one. So if you need a new MacBook, go grab this fantastic deal for a fantastic laptop before the price goes back up.

Read more »

Need holiday gift ideas? Grab the best accessories for iPhone, iPad, Mac, more
It’s the time of year for gift giving, and early Black Friday sales are already in full swing. But if you’re like me, you might struggle coming up with holiday gift ideas—both for yourself and for others. New accessories are a great place to start, so here’s a collection of many of the best accessory options out there for Apple users—for iPhone, iPad, Mac, and much more. more…

Read more »

iOS 18.2 likely to arrive on December 9th with major Apple Intelligence features
Apple's iOS 18.2 with major Apple Intelligence features will likely be released on Monday, December 9th. Expect iPadOS 18.2, macOS… The post appeared first on MacDailyNews.

Read more »

Hear the sweet sound of Sonos Black Friday bargains
The big Sonos Black Friday sale launched Thursday with great deals on headphones, speakers, soundbars and bundles. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Best Mac 2024: Every Apple Mac and MacBook compared
Macworld If you’re wondering which Mac to buy, you’ve come to the right place. In our Mac buying guide, you’ll find everything you need to know about the MacBook Air, MacBook Pro, Mac mini, iMac, Mac Pro and Mac Studio, with expert buying advice to help you choose the machine (and configuration) that’s right for you. Apple makes six different types of Mac: MacBook Air, MacBook Pro, Mac mini, iMac, Mac Studio, and Mac Pro, but within each of those categories there are variations in the size, specs and features, so things can get pretty complicated. That’s where this guide comes in, helping you make the right decision. If you’re simply looking for a great offer, visit our MacBook Pro deals, MacBook Air deals, iMac deals, Mac Studio deals, and Mac mini deals pages which are regularly updated. For help choosing the best Mac laptop, we also have a MacBook buying guide. Shopping for a Mac during Black Friday, read: Best Black Friday Mac deals and Best Black Friday MacBook deals. We have included the newest Macs for 2024: the M4 iMac and M4 Mac mini and M4 MacBook Pro. Read our M4 iMac review and M4 Pro Mac mini review. Those Macs were updated in October 2024. At the same time Apple doubled the RAM in the MAcBook Air M3 and M2, so we have updated our advice accordingly. Should I upgrade from my Intel Mac? We are now more than four years into Apple’s transition from Intel processors to its own silicon that includes CPU, GPU, and unified memory. The transition began with the introduction of the M1 in November 2020. Since June 2023 every Mac Apple sells uses Apple’s own chips rather than Intel processors. If you are yet to upgrade your Intel Mac to one powered by Apple’s silicon what are you waiting for! If you are concerned that a must-have app doesn’t run on an M-series Mac, consider finding a new app because the performance gains are tremendous. Another good reason to update your Intel Mac is that it is unlikely to be supported by Apple for much longer in terms of security updates. With the arrival of macOS Sequoia the number of supported Intel Macs is fewer than ever, and although Apple will be supporting Sonoma for a couple more years, and Ventura for another year, only a few of the most recent Intel Macs still be supported in a year or so. Read: The Intel Macs that can run macOS Sequoia. For more information see our Mac processor comparison where we compare Apple silicon and Intel. We also offer advice about how much storage, RAM and cores in How much MacBook RAM, SSD, GPU and CPU do you really need? Every Mac Apple sells Below we’ll take you through each Mac currently available from Apple, to give you an overview of what’s on offer and what you’ve got to choose from. 13-inch MacBook Air, M2 (2022) Price When Reviewed: $999 Best Prices Today: $749 at Amazon$899 at B&H$924 at Walmart Electronics What is it? The MacBook Air is Apple’s most affordable laptop, designed with portability in mind. There are currently three versions of the MacBook Air available from Apple: an 13-inch MacBook Air with M2 chip, a 13-inch MacBook Air with M3 chip, and a 15-inch MacBook Air with M3 chip. The M2 MacBook Air had a price cut when the M3 model was introduced in March 2024: it now starts at $999/£999. The M2 MacBook Air was introduced in July 2022 with a brand-new look and a 13.6-inch screen (up from 13.3-inches). It’s a great machine, but the newer MacBook Air is only $100/$100 more than the M2 model and is well worth the upgrade. Another update came in October 2024 when Apple doubled the RAM (unified memory) from 8GB to 16GB without changing the price. This is an excellent update meaning that the MacBook Air is better value than ever. Who’s it for? The MacBook Air is ideal for the budget-conscious. It’s also for anyone who is always on the go, doesn’t want to be bogged down by a regular-size laptop, and needs a computer that’s more versatile than an iPad. How much does the 13-inch MacBook Air (M2) cost? Prices start at $999/£999 M2 MacBook Air with 256GB SSD and 16GB RAM and $1,199/£1,199 for the MacBook Air M2 with 512GB SSD and 16GB RAM. Make sure to check how much RAM is in the model you are buying and that it is priced accordingly. To update the RAM to 16GB would previously have cost $200/£200. What are the specifications? The entry-level M2 MacBook Air has 8 GPU cores, just like the entry-level M3 model, but the M3 is a step up from the M2 thanks to the newer 3nm manufacturing process. The M3 also offers faster Wi-Fi than the M2. Apple M2, 8-core CPU, 8-core GPU, 16GB memory, 256GB SSD, two Thunderbolt/USB 4 ports: $999/£999. Apple M2, 8-core CPU, 10-core GPU, 16GB memory, 512GB SSD, two Thunderbolt/USB 4 ports: $1,199/£1,199. Additional options: 24GB memory. Up to 2TB storage. What are display specifications? The 13.6-inch Liquid Retina on the M2 MacBook Air display has a native resolution of 2,560×1,664 and 500 nits brightness. How do I connect stuff? The MacBook Air with M2 chip has a MagSafe port for charging as well as a pair of Thunderbolt/USB 4 connectors. If you want to connect USB-A devices, you need either a USB-C to USB adapter, like Apple’s $19 / £19 one, or a USB-C hub that has USB-A ports. See our round-up of the best USB-C hubs and adapters. If you want to plug in more than one external display officially you can’t – but we know a workaround, read: How to connect two or more external displays to an M-series MacBook. The M2 MacBook Air has built-in Wi-Fi 6 (802.11ax) for connecting to a network (the M3 offers faster Wi-Fi 6E (802.11ax). It also provides built-in Bluetooth 5.3 for wirelessly connecting a mouse or other peripherals. If you want to connect to an ethernet network, you need an adapter. How fast is it? The M2 provides performance that is leaps and bounds faster than the Intel processors that were previously found in the MacBook Air, and Apple claims an 18 percent total CPU improvement over the M1, and a 35 percent improvement in graphics speed. It’s plenty fast enough for general purpose use. But because it doesn’t have a fan to keep the computer cool, it may throttle down its speed during long processing sessions, such as video editing or compiling code, for which the MacBook Pro with it’s fan is a better choice. Macworld’s buying advice: The MacBook Air with M2 is a great affordable laptop for someone who does general-purpose work and moves around a lot, such as a student or a self-employed person. But it only costs another $100/£100 to upgrade to the M3 model, so unless you want to use that $100/£100 to upgrade the storage, we recommend the M3 over the M2. You may also want to avoid the entry-level models due to slower SSDs, but that may not be an issue if the kind of work you do doesn’t require a lot of writing to the hard drive. 13-inch MacBook Air, M3 (2024) Price When Reviewed: $1,099 Best Prices Today: $849 at Amazon$999 at B&H$1014 at Walmart Electronics Apple introduced the M3 version of the MacBook Air in March 2024, it then updated the Unified Memory (RAM) from 8GB to 16GB in October 2024 and didn’t change the price. What is it? The M3 MacBook Air looks identical to the M2 version (above), but there are some changes to the specs that make this a much better machine–and it only costs $100/£100 more. There is also a 15-inch MacBook Air with M3 chip, which we discuss below. Who’s it for? The MacBook Air with M3 is great value and ideal for the budget-conscious. If you are always on the go, don’t want to be bogged down by a regular-size laptop, and need a versatile computer, it’s a great choice. How much does the 13-inch MacBook Air (M3) cost? Prices start at $1,099/£1,099 – and Apple has doubled the RAM to 16GB from 8GB without increasing the price. There are three configurations and you can create build-to-order models with even more memory or storage. What are the specifications? The specs for the M3 MacBook Air look similar to the M2 model, but while it looks like identical cores and memory support, there is a leap from the M2 to the M3 which should improve performance. We used to recommend 16GB RAM as a build-to-order option because we didn’t think 8GB was enough, but now Apple has listened and offers that as standard. Apple M3, 8-core CPU, 8-core GPU, 16GB memory, 256GB SSD, two Thunderbolt/USB 4 ports: $1,099/£1,099. Apple M3, 8-core CPU, 10-core GPU, 16GB memory, 512GB SSD, two Thunderbolt/USB 4 ports: $1,299/£1,299. Apple M3, 8-core CPU, 10-core GPU, 24GB memory, 512GB SSD, two Thunderbolt/USB 4 ports: $1,499/£1,499. Additional options: Up to 2TB storage. What are display specifications? The 13.6-inch Liquid Retina on the M3 MacBook Air display has a native resolution of 2,560×1,664 and 500 nits brightness. How do I connect stuff? All MacBook Air models (since the M2) have a MagSafe port for charging as well as a pair of Thunderbolt/USB 4 connectors. If you want to connect USB-A devices, you need either a USB-C to USB adapter, like Apple’s $19 / £19 one, or a USB-C hub that has USB-A ports. See our round-up of the best USB-C hubs and adapters. Unlike the M2 MacBook Air, the M3 MacBook Air is able to support more than one external display (although there is a workaround for older Mac laptops, read: How to connect two or more external displays to an M1, M2 or M3 MacBook.) The MacBook Air has Wi-Fi 6E (802.11ax) for connecting to a network (faster than the Wi-Fi 6 (802.11ax) in the M2 model. It provides built-in Bluetooth for wirelessly connecting a mouse or other peripherals. If you want to connect to an ethernet network, you need an adapter. How fast is it? In our tests the M3 shoots ahead of the M2 – in fact the M3 is better than the M1 Pro was in some of our tests. Apple says the M3 is “60 percent faster” than the M1 MacBook Air and “up to 13x faster” than the fastest Intel-based MacBook Air. So the MacBook Air should be more than fast enough for general-purpose use. The only issue is that, because it doesn’t have a fan to keep the computer cool, it may slow down during long processing sessions to keep cool. So if you are likely to be video editing or compiling code the MacBook Pro with its fan is a better choice. Macworld’s buying advice: The MacBook Air is a great choice for someone who does general-purpose work and moves around a lot, such as a student or a self-employed person. Note that it’s impossible to upgrade the storage or memory after purchase, so you should buy the model with the largest amount of storage and memory you can afford. The good news about the M3 MacBook Air is that it doesn’t appear to be saddled with slow storage in the same way that the M2 model is. We have previously recommended that buyers should avoid the entry-level models due to slower SSDs, but it appears that the storage in the 256GB M3 MacBook Air model is made up of two 128GB NAND chips, rather than one 256GB chip, so the two drives can process data simultaneously, so the storage in the 256GB M3 MacBook Air should work faster. We compare the MacBook Air vs MacBook Pro separately. Also read Best MacBook: Which MacBook should you buy? Apple 15-inch MacBook Air (M3, 2024) Price When Reviewed: $1,299 Best Prices Today: $1,044 at Amazon$1199 at B&H$1199 at Walmart Electronics What is it? The 15-inch MacBook Air arrived in June 2023, and a few months later, in March 2024, Apple updated it with an M3 chip. Compared to the 13-inch MacBook Air the 15-inch model offers a bigger screen (obviously) and a six-speaker system rather than four speakers. Surprisingly, battery life isn’t better on the 15-inch, despite the bigger battery. As with the other MacBook Air models, the MacBook Air now comes with 16GB RAM as standard. Who’s it for? The 15-inch MacBook Air is ideal for anyone who wants a big-screen laptop without having to spend a fortune. The 14-inch and 16-inch MacBook Pro models cost considerably more than the 15-inch MacBook Air does. It’s a great choice for anyone who is always on the go due to its lightweight design. How much does the 15-inch MacBook Air (M3) cost? There are three configurations starting at $1,299/£1,399. The price hasn’t changed despite Apple increasing the RAM from 8GB to 16GB, which used to cost $200/£200 at point of sale. What are the specifications? The specifications of the M3 MacBook Air are generally the same, although the entry-level 13-inch has a 8-core GPU option the 15-inch doesn’t have. You are essentially paying $200/£200 more for the bigger screen. Apple M3, 8-core CPU, 10-core GPU, 16GB memory, 256GB SSD, two Thunderbolt/USB 4 ports: $1,299/£1,299. Apple M3, 8-core CPU, 10-core GPU, 16GB memory, 512GB SSD, two Thunderbolt/USB 4 ports: $1,499/£1,499. Apple M3, 8-core CPU, 10-core GPU, 24GB memory, 512GB SSD, two Thunderbolt/USB 4 ports: $1,699/£1,699. Additional options: Up to 2TB storage. There are some differences between the 13- and 15-inch models in terms of audio, with the larger model featuring more speakers as well as a larger screen. What are display specifications? The 15.3-inch Liquid Retina display has a native resolution of 2,880×1,864 and 500 nits brightness. The 13.6-inch Liquid Retina display has a native resolution of 2,560×1,664 and 500 nits brightness. How do I connect stuff? All MacBook Air with M2 or M3 chip have a MagSafe port for charging as well as a pair of Thunderbolt/USB 4 connectors. The M3 MacBook Air offers Wi-Fi 6E (802.11ax) for connecting to a network (faster than the Wi-Fi 6 (802.11ax) in the M2 models. It also provides built-in Bluetooth for wirelessly connecting a mouse or other peripherals. If you want to connect to an ethernet network, you need an adapter. Unlike the M2 MacBook Air, the M3 MacBook Air is able to support more than one external display (although there is a workaround for older Mac laptops, read: How to connect two or more external displays to an M1, M2 or M3 MacBook.) How fast is it? This is the same M3 as found in the 13-inch MacBook Pro, so you can expect similar performance, however, the Air doesn’t have a fan to keep the computer cool, so it may throttle down its speed during long processing sessions, such as video editing or compiling code, for which a MacBook Pro would be a better option. In our tests the M3 was better than the M1 Pro, and Apple says the M3 is “60 percent faster” than the M1 MacBook Air and “up to 13x faster” than the fastest Intel-based MacBook Air. Macworld’s buying advice: The 15-inch MacBook Air is a more affordable Mac laptop than the 14-inch MacBook Pro, so if you want your screen to be bigger than 13 inches, and you don’t need the power of a MacBook Pro for the kind of work you do, the 15-inch MacBook Air is a great option. Our recommendation is to up the amount of RAM (Unified Memory) when you buy it as you can’t update it later and we think 8GB isn’t really enough. If you can afford to you should also avoid the 256GB SSD model because that SSD is known to be slower, but that may not be an issue if the kind of work you do doesn’t involve writing to the drive often. If you took that advice the MacBook Air (with 16GB RAM and 512GB SSD) costs $1,699/£1,699, which, depending on where you live, is either $100 more, or the same price as the 14-inch MacBook Pro ($1,599/£1,699). That MacBook Pro comes with the same 8-core CPU, 10-core GPU and 512GB SSD, but only offers 8GB RAM, the 16GB Unified Memory update would add another $200/£200 to that price. Apple 14-inch MacBook Pro (M4, 2024) Price When Reviewed: $1,599 | $1,799 | $1,999 Best Prices Today: $1,399 at Amazon$1474 at Walmart Electronics$1599 at Apple What is it? In October 2024 Apple updated the 14-inch MacBook Pro with the M4 chip. The M4 14-inch MacBook Pro arrived a year after the M3 version replaced the 13-inch MacBook Pro, which is no longer sold. The 14-inch MacBook Pro was already much better than the old 13-inch MacBook Pro thanks to the HDR ProMotion display, more storage, HDMI and SDXC slots, better battery life and a newer design. The 2024 update makes it better than ever with double the RAM (16GB rather than a paltry 8GB). Who’s it for? The 14-inch MacBook Pro is for a more demanding user than the MacBook Air. Its main benefit is the design allows for better cooling, which means that if you push the machine it won’t slow down to avoid overheating. However, there are other MacBook Pro available from Apple (including a 16-inch model) that offer faster processors, so if you really need a powerful machine one of those might be more suitable–we’ll discuss the M4 Pro and M4 Max models below. How much does the 14-inch MacBook Pro cost? The entry-level 14-inch MacBook Pro starts at $1,599/£1,599. There’s another model available with twice the storage (1TB) for $200/£200 more. Great news if you are in the U.K. – the new models cost less than the predecessors did. What are the specifications? Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 512GB SSD, three Thunderbolt 4 ports, SDXDC, HDMI, $1,599/£1,599. Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 1TB SSD, three Thunderbolt 4 ports, SDXDC, HDMI, $1,799/£1,799. Apple M4, 10-core CPU, 10-core GPU, 24GB memory, 1TB SSD, three Thunderbolt 4 ports, SDXDC, HDMI, $1,999/£1,999. Additional options: 32GB memory; up to 2TB storage What are display specifications? The 14.2-inch Liquid Retina XDR display has a native resolution of 3,024×1,964 and 1,000 nits brighness, 1600 nits peak, 600 nits SDR brightness,and ProMotion for adaptive refresh rates up to 120Hz. The notch at the top of the display conceals the 12MP FaceTime camera which now features Centre Stage. How do I connect stuff? Apple now includes three Thunderbolt 4 ports (up from just two). These are compatible with USB-C (if you have wired devices that aren’t USB-C or are an older version of Thunderbolt, you’ll need an adapter, we have a separate MacBook Pro Thunderbolt adapter guide to help you decide which ones you’ll need). The 14-inch MacBook Pro also come with an HDMI port for connecting an external display or projector, and an SDXC Card slot for plugging in memory cards from cameras, audio recorders, and other devices. The HDMI port also supports multichannel audio output. The 14-inch MacBook Pro has Wi-Fi and Bluetooth for wireless connectivity. The 2024 models offer Wi-Fi 6E (802.11ax) and Bluetooth 5.3, as was the case with the predecessor. How fast is it? The M4 version of the 14-inch MacBook Pro is now a generation ahead of the MacBook Air. Even without the chip boost, you can expect more out of the MacBook Pro just because it features a fan for cooling (the MacBook Air doesn’t have the space for this). If you need a really powerful Mac then you should look to the M4 Pro or even the M4 Max. Macworld’s buying advice: The 14-inch MacBook Pro costs $1,599/£1,599, which is quite a bit higher than the $1,299/£1,349 price the 13-inch MacBook Pro sold for. And much more than the 13-inch MacBook Air (with the M3 model starting at $1,099/£1,099). That’s $500/£500 more than the entry-level 13-inch M3 MacBook Air, and $600/£600 more than the M2 MacBook Air. That’s enough to buy a Mac mini and have money left over! The MacBook Pro is a chip generation ahead of the MacBook Air, but that is unlikely to be the case for long. So if budget is what is important to you, buy a MacBook Air. Read our full Apple 14-inch MacBook Pro (M4) review 14-inch MacBook Pro (M4 Pro/M4 Max, 2024) Price When Reviewed: $1,999 | $2,399 Best Prices Today: $1,749 at Amazon$1749 at B&H$1839 at Walmart Electronics What is it? The 14-inch MacBook Pro with M4 Pro or M4 Max was introduced in October 2024 (a year after the M3 Pro and M3 Max models). This is one of Apple’s top-of-the-line laptops, the other being the 16-inch MacBook Pro (discussed next). There’s not a huge difference between the specs on offer–both offer the M4 Max as a processor option–but the 14-inch MacBook Pro is cheaper than the 16-inch. If you want a laptop that can handle any task you throw at it—and you don’t have a constraining budget—you want one of these laptops. The new M4 Pro/Max models offer better battery life (22 hours) than the previous generation did (18 hours). Who’s it for? When Apple called these “Pro” laptops, they weren’t kidding around. If your work is very demanding processing power, these laptops are happy to handle it. Work in pro-level software all the time? Get a 14- or 16-inch MacBook Pro. With either the M4 Pro or M4 Max processor, they’re the fastest laptops Apple has ever created. How much does the 14-inch MacBook Pro cost? There are three configurations starting at $1,999/£1,999 for the 14-inch MacBook Pro M4 Pro with 12-core CPU, 16-core GPU, 24GB unified memory and 512GB SSD, and $2,399/£2,399 for the 14-inch MacBook Pro M4 Pro with 14-core CPU and 20-core GPU, 24GB unified memory and 1TB SSD. The third option is the M4 Max version with 14-core CPU, 32-core GPU, 36GB memory and 1TB SSD, that costs $3,199/£3,199. All those prices are £100 lower in the U.K. than they were. What are the specifications? Here are the standard configurations for the 14-inch MacBook Pro Apple M4 Pro, 12-core CPU, 16-core GPU, 24GB memory, 512GB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 70W Power Adapter, $1,999/£1,999. Apple M4 Pro, 14-core CPU, 20-core GPU, 24GB memory, 1TB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 96W Power Adapter, $2,399/£2,399. Apple M4 Max, 14-core CPU, 32-core GPU, 36GB memory, 1TB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 96W Power Adapter, $3,199/£3,199. Additional options: M4 Max, 16-core CPU, 40-core GPU; 36GB (now possible with Pro chip) 48GB, 96GB or 128GB unified memory; up to 8TB SSD (with Max). What are display specifications? The 14.2-inch Liquid Retina XDR display hasn’t changed from its native resolution of 3,024×1,964, 254 pixels per inch, 1,600 nits of maximum brightness and 1,000 nits for HDR content, but it now offers 1000 nits for standard content, up from 600. You’ll also get 1,000,000 to 1 contrast ratio, and ProMotion support with a refresh rate up to 120Hz. The notch at the top of the display conceals the 12MP Center Stage camera with support for Desk View and 1080p HD video recording. The notch does not affect the available screen area—the work area is a 16-by-10 space, while the screen surrounding the notch is considered extra space and is used to display the menu bar. How do I connect stuff? The 14-inch MacBook Pro has Wi-Fi 6E (802.11ax) and Bluetooth 5.3 for wireless connectivity. As for its ports, Apple includes three Thunderbolt 5/USB C ports. If you have a Thunderbolt device, you can plug it directly into the laptop. The same goes for any USB-C device. These laptops also come with an HDMI port for connecting an external display or projector, and an SDXC Card slot for plugging in memory cards from cameras, audio recorders, and other devices. The HDMI port in the 2023 model supports multichannel audio output. How do I charge the laptop? Battery life improved for this generation. Up from 18 hours to 22 hours for the M4 Pro (still 18 hours on the M4 Max). A fast charging feature allows the laptop to go from no charge to 50 percent in 30 minutes, but you need to have the proper power adapter to do this. It won’t work with the 70W adapter that comes with the $1,999 MacBook Pro. The 14-inch models need to use the 96W adapter (which is a $20/£10 upgrade) and can do fast charging through MagSafe or a Thunderbolt port. How fast is it? Apple built the 14-inch and 16-inch MacBook Pro models with pro users in mind and it shows in the performance. Now that Apple has introduced the M4 Pro and M4 Max you can enjoy the fastest Mac laptops Apple has ever made, although when it comes to graphics prowess the Max will always beat the Pro. So if you need the fastest then you’ll want to upgrade to the M4 Max. Macworld’s buying advice: The only reason not to buy the 14-inch M4 Pro or M4 Max MacBook Pro would be if you saw a good deal on the M3 Pro/M3 Max version–we’ve been seeing some excellent deals and price cuts on the older models, just remember that there was less RAM in those model (18GB rather than 24GB at the entry level). Our other advice would be that if you are considering the 14-inch MacBook Pro because you need a powerful Mac then, ignore the $1,999/£1,999 model in favor of the $2,399/£2,399 model which has more CPU and GPU cores. If you don’t need 1TB storage, save money by adding the M4 Pro with 14-core CPU, 20-core GPU as a build-to-order option to the $1,999/£1,999 model for an additional $200/£200, bringing the price to $2,199/£2,199. 16-inch MacBook Pro (M4 Pro/M4 Max, 2024) Price When Reviewed: $2,499 | $2,899 Best Prices Today: $2,249 at Amazon$2249 at B&H$2299 at Walmart Electronics What is it? The 16-inch MacBook Pro, like the 14-inch model above, was updated in October 2024. It offers a similar set of specs and configuration options as the 14-inch MacBook Pro (above), but it has a higher price, a bigger screen and better battery life (24 hours, up from 22 hours on the predecessor). Who’s it for? This is Apple’s largest “Pro” laptop and it’s designed for people who need a portable Mac to do work that demands extreme processing power. You could save some money by opting for the 14-inch MacBook Pro, but if you need a big screen on your laptop this is the Mac for you. You’ll also benefit from longer battery life. Configured with the M4 Max this is the fastest and most powerful laptop Apple has ever created. How much does the 16-inch MacBook Pro cost? There are four standard configurations starting at $2,499/£2,499 for the 16-inch MacBook Pro M4 Pro with 14-core CPU, 20-core GPU and 24GB RAM, 512GB SSD; $2,899/£2,899 for the MacBook Pro M4 Pro with 14-core CPU, 20-core GPU, 48GB RAM, and 512GB SSD; $3,499/£3,499 for the MacBook Pro M4 Max with 14-core CPU, 32-core GPU, 36GB RAM, and 1TB SSD; and the M4 Max with 16-core CPU, 40-core GPU, 48GB RAM and 1TB SSD for $3,999/£3,999. What are the specifications? Here are the standard configurations for the 16-inch MacBook Pro introduced in 2024. Apple M4 Pro, 14-core CPU, 20-core GPU, 24GB memory, 512GB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 140W power adapter, $2,499/£1,299. Apple M4 Pro, 14-core CPU, 20-core GPU, 48GB memory, 512GB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 140W power adapter, $2,899/£2,899. Apple M4 Max, 14-core CPU, 32-core GPU, 36GB memory, 1TB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 140W power adapter, $3,499/£3,499. Apple M4 Max, 16-core CPU, 40-core GPU, 48GB memory, 1TB SSD, three Thunderbolt 5 ports, SDXC, HDMI, 140W power adapter, $3,999/£3,999. Additional options: 48GB, 64GB, or 128GB unified memory. Up to 8TB SSD. What are display specifications? The 16.2-inch Liquid Retina XDR display has a native resolution of 3,456×2,234, 1,600 nits of maximum brightness and 1,000 nits for HDR content, but it now offers 1000 nits for standard content, up from 600. You’ll also get 1,000,000 to 1 contrast ratio, and ProMotion support with a refresh rate up to 120Hz. The notch at the top of the display conceals the 12MP Center Stage camera with support for Desk View and 1080p HD video recording. The notch does not affect the available screen area—the work area is a 16-by-10 space, while the screen surrounding the notch is considered extra space and is used to display the menu bar. How do I connect stuff? The 16-inch MacBook Pro has Wi-Fi 6E (802.11ax) and Bluetooth 5.3 for wireless connectivity. As for its ports, Apple includes three Thunderbolt/USB 4 ports that are compatible with USB-C. If you have a Thunderbolt device, you can plug it directly into the laptop. The same goes for any USB-C device. However, if you have wired devices that aren’t USB-C or are an older version of Thunderbolt, you’ll need an adapter. We have a separate MacBook Pro Thunderbolt adapter guide to help you decide which ones you’ll need. Unfortunately, be prepared to shell out a good amount of extra cash. These laptops also come with an HDMI 2.0 port for connecting an external display or projector, and an SDXC Card slot for plugging in memory cards from cameras, audio recorders, and other devices. The HDMI port supports multichannel audio output. How do I charge the laptop? Apple has equipped the 14-inch and 16-inch laptops with MagSafe, a magnetic connector that breaks away with a good tug. It’s a nice safety feature, but you can also charge using the Thunderbolt port, too. Battery life is improved for this generation: up from 22 hours to 24 hours. The fast charging feature allows the laptop to go from no charge to 50 percent in 30 minutes, but you need to have the proper power adapter to do this. Fast charging does not work through Thunderbolt or with an adapter with lower wattage, so you’ll need the 140W power adapter that is included in the box for this. How fast is it? The 16-inch MacBook Pro models were built with pro users in mind so you can expect excellent performance. Your software will be able to take full advantage of the CPU’s multiple cores. If you are a professional, you’ll benefit from the M4 Pro or M4 Max. Macworld’s buying advice: The M4 Pro and Max launched in October 2024, so don’t expect an update until late in 2025 or beyond. As above, look out for deals on the M3 Pro and M3 Max models, but note that there is more RAM in the newer models (24GB up from 18GB for the entry-level M4 Pro). We often see excellent deals and price cuts on these models which while not as powerful are still excellent machines. Read our full Apple 16-inch MacBook Pro (M4 Pro) review Mac mini (M4/M4 Pro, 2024) Price When Reviewed: $599 | $799 | $999 Best Prices Today: $559 at B&H$574 at Walmart Electronics$599 at AppleNot Available at Amazon What is it? The Mac mini with M4 and a Mac mini with M4 Pro were introduced in October 2024. This was already Apple’s smallest desktop Mac, but now it is even smaller following a redesign that means it now measures 5-inches by 5-inches, down from 7.75-inches by 7.75-inches. It offers a nice combination of speed and, at just $599/£599, affordability (in fact the 2024 is even cheaper in the U.K. where it costs £50 less than it did). It’s not only fast enough for general-purpose use, but its multi-core speed is quite good—if you use a professional app like a video editor, 3D software, or developer tools, the Mac mini can handle it, no problem. Who’s it for? Because of its price and performance, the Mac mini is a great Mac for just about anybody. It makes for an ideal primary Mac for a home or small office. Professionals on a budget will be satisfied with the Mac mini. If you’re switching from a PC, you can use your PC’s keyboard and mouse with the Mac mini. The Mac mini is also ideal as a secondary Mac in your home, and it can integrate into your home entertainment center. How much does the Mac mini cost? There are three standard configurations starting at $599/£599 for the Mac mini M4 with 10-core CPU, 10-core GPU, 16GB unified memory and 256GB SSD. There’s also a $799/£799 Mac mini M4 with 10-core CPU, 10-core GPU, 16GB unified memory and 512GB SSD, and a $999/£999 Mac mini M4 with 10-core CPU, 10-core GPU, 24GB unified memory and 512GB SSD. At the top of the range is an M4 Pro Mac mini with 12-core CPU, 16-core GPU, 24GB unified memory and 512GB SSD which costs $1,399/£1,399. The price is about $1,000/£1,000 less for a similarly specced MacBook Pro, although, in each case, the MacBook has a bigger SSD. What are the specifications? Apple sells three Mac mini models. Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 256GB SSD, three Thunderbolt 4 ports, 2 USB-C, HDMI, $599/£599. Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 512GB SSD, three Thunderbolt 4 ports, 2 USB-C, HDMI, $799/£799. Apple M4, 10-core CPU, 10-core GPU, 24GB memory, 512GB SSD, three Thunderbolt 4 ports, 2 USB-C, HDMI, $999/£999. Apple M4 Pro, 12-core CPU, 16-core GPU, 24GB memory, 512GB SSD, three Thunderbolt 5 ports, 2 USB-C, HDMI, $1,399/£1,399. Additional options: M4 Pro with 14-core CPU, 16-core GPU; 48GB or 64GB unified memory; up to 8TB SSD. The Mac mini does not include a display, keyboard, or mouse, so you’ll have to provide your own, or you can customize your order to include these devices as extra-cost options. How do I connect stuff? Like Apple’s other Macs, the Mac mini has Wi-Fi and Bluetooth. The $599 and $799 M4-based Mac minis have three Thunderbolt 4/USB 4 ports, while the M4 Pro-based Mac mini has three Thunderbolt 5 ports. All Mac minis also offer an additional two USB-C ports, an HDMI 2.0 port, a headphone jack, and a gigabit ethernet port. They no longer offer USB-A ports (the M2 models did). To connect a display, you can use the HDMI port or a Thunderbolt port. You might have to buy an adapter if your display doesn’t have either HDMI or a port that can connect to Thunderbolt. How fast is it?  The $599 and $799 M4-based Mac minis are very fast, and offer the best performance-to-price ratio of any Mac that Apple offers. The Mac mini with M4 Pro offers the same 12-core CPU and 16-core GPU, 24GB memory and 512GB storage that is found in the M4 Pro MacBook Pro for $1,399 rather than $1,999 which represented a huge saving and a great way to get a powerful Mac without spending a fortune. Macworld’s buying advice: The Mac mini is an excellent machine for most Mac users—new or experienced, professional or general consumer. Plus the price is excellent: if you’re on a budget, it’s a great choice, especially if you already have a spare keyboard, mouse, and display. Apple 24-inch iMac (M4, 2024) Price When Reviewed: $1,299 | $1,499 | $1,699 | $1,899 Best Prices Today: $1,199 at Amazon$1199 at B&H$1204 at Walmart Electronics What is it? In October 2024 Apple introduced the M4 version of the 24-inch iMac. Little has changed since the redesign of 2021, which represented the first major update in more than a decade, with a cleaner design and a choice of seven bright colors (slightly lighter shades for 2024). Who’s it for? The iMac is great for both novices and demanding users. It can handle general-purpose and heavy-duty tasks equally well, although those after a replacement for a 27-inch IMac or iMac Pro might want to wait to see if the rumored iMac Pro ever materializes, or settle for a Mac mini Pro (above) or Mac Studio (below). It’s ideal for someone who needs to buy a complete computer setup (keyboard, mouse or trackpad, and display) and wants to maximize workspace efficiency. The 24-inch iMac is a design icon that will look great in any office. How much does the iMac cost? When the M4 iMac Apple dropped prices outside the U.S. The three standard configurations start at $1,299/£1,299 for the entry-level model, $1,499/£1,499 for the mid-range, and $1,699/£1,699 for the top of the range. What are the specifications? The 24-inch iMac uses Apple’s M4 chip, the same M4 that features in the 14-inch MacBook Pro, but in each case there is half the storage and the price is $100 less. There are several configurations available as well as build-to-order options: Apple M4, 8-core CPU, 8-core GPU, 16GB memory, 256GB SSD, two Thunderbolt 4 ports, $1,299/£1,299. Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 256GB SSD, four Thunderbolt 4 ports, $1,499/£1,499. Apple M4, 10-core CPU, 10-core GPU, 16GB memory, 512GB SSD, four Thunderbolt 4 ports, $1,699/£1,699. Apple M4, 10-core CPU, 10-core GPU, 24GB memory, 512GB SSD, four Thunderbolt 4 ports, $1,899/£1,899. Additional options: 32GB memory; up to 2TB storage What are the display specifications? The 24-inch 4.5K Retina display has 11.3 million pixels and supports the P3 wide color gamut, over a billion colors, 500 nits of brightness, and True Tone. Apple treats the display with an anti-reflective coating to help with readability. The display hasn’t changed since the M1 model launched. How do I connect stuff? The $1,299 24-inch iMac 24 has two Thunderbolt 4 ports that also work with USB-C devices. The $1,499 and $1,699 iMacs have four Thunderbolt 4 ports (the previous generation had two Thunderbolt/USB 4 and two USB 3 ports). If you have a USB-A device, you need to buy an adapter, such as Apple’s ($19 / £19). If you have multiple USB-A devices and other items, consider a Thunderbolt hub. The 24-inch iMac also has a headphone jack on the side. Wi-Fi 6E and Bluetooth 5.3 are built-in. Apple doesn’t put a gigabit ethernet port on the 24-inch iMac—instead, it’s on the power adapter. But that ethernet-equipped power adapter comes standard with the $1,499 and $1,699 models. It’s not included with the $1,299 model, but you can select it as an option at the point of purchase—and yes, that means you’ll have to pay extra for it. How fast is it?: Since the 24-inch iMac has the same M4 as the entry-level 14-inch MacBook Pro, its speed is very similar. That means it’s fast. It’s got all the speed general consumers need, and it can handle pro applications with no problem. However, the $1,299 model has only one fan inside its body, while the $1,499 and $1,699 models have two fans. That means the high-priced models do a better job keeping the internals cool. The $1,299 model may need to slow down its performance on heavy-duty tasks in order to maintain a proper temperature. Macworld’s buying advice: The iMac was greatly improved when Apple introduced the 24-inch model back in 2021, from the design to the display to its performance. But, we hope rumors that Apple may launch an iMac Pro model are true. If you are buying one the sweet spot is the $1,499/£1,499 model, which gets you more ports, Touch ID, and ethernet. Read our full Apple iMac (M4) review Mac Studio (M2 Max/M2 Ultra, 2023) Price When Reviewed: $1,999 Note: This model hasn’t been updated since 2023. An update is expected in 2025. What is it? The Mac Studio joined Apple’s Mac lineup in March 2022 and was updated in June 2023 when it gained the M2 Max and M2 Ultra. It’s a desktop “modular” Mac that’s more powerful (and more expensive) than the Mac mini and similarly speced to the Mac Pro, but lacking the Mac Pro’s expansion options. Who’s it for? The Mac Studio is for the user who wants the maximum processing power. It’s not the only powerful Mac available–the Mac Pro also runs on the M2 Ultra–but it is the cheapest way to get either the M2 Max or M2 Ultra chips. If you want the expansion options of the Mac Pro then you’ll want to look elsewhere, but the Mac Studio brings all the power usually reserved for the ultimate Mac in a small package. How much does the Mac Studio cost? There are two standard configurations starting at $1,999/£2,099 (was £1,999) for the Mac Studio M2 Max with 30-core GPU and 512GB SSD, and $3,999/£4,199 (was £3,999) for the Mac Studio M2 Ultra with 60-core GPU and 1TB SSD. There are also build to order options that include 76-core GPU, up to 192GB Unified Memory, and 8TB SSD. Fully maxed out a Mac Studio would cost $8,799/£8,999. What are the specifications? The Mac Studio uses either the M2 Max or M2 Ultra processors. Apple offers two standard configurations: Apple M2 Max SoC with a 12-core CPU, 30-core GPU, 32GB of memory, and a 16-core Neural Engine; 512GB SSD, $1,999/£2,099 Apple M2 Ultra SoC with a 24-core CPU, 60-core GPU, 64GB of memory, and a 32-core Neural Engine; 1TB SSD, $3,999/£4,199 Additional options: M2 Ultra SoC with a 76-core GPU, up to 192GB unified memory and up to 8TB SSD. The Mac Studio does not include a display, keyboard, or mouse, so you’ll have to provide your own, or you can customize your order to include these devices as extra-cost options. Apple released the Studio Display at the same time as the original Mac Studio, but it can be used with third-party displays, too.  How do I connect stuff?  The Mac Studio has the following ports: M2 Max: Four Thunderbolt 4 ports on back; two USB-C ports on front. M2 Ultra: Four Thunderbolt 4 ports on back; two Thunderbolt 4 ports on front. SDXC Card slot on front. Two USB-A ports. 10Gb ethernet. HDMI 2.0. 3.5 mm headphone jack (with advanced support for high-impedance headphones, a feature lacked by the M1-series models) 802.11ax Wi-Fi 6E (was 802.11ax Wi-Fi 6 in predecessor) Bluetooth 5.3 (was Bluetooth 5.0 in predecessor) Thunderbolt supports USB-C and USB-4. To connect to a network, you can use the built-in ethernet port, or you can use Wi-Fi, which comes standard. To connect a display, you can use the HDMI 2.0 port or the Thunderbolt ports. You might have to buy an adapter if your display doesn’t have either HDMI or a port that can connect to Thunderbolt. You can connect up to eight 4K displays, six 6K displays, or three 8K displays to the M2 Ultra. The M2 Max supports fewer displays. How fast is it? Despite the arrival of the M3 Max, the M2 Max Mac Studio is a very fast Mac at a very competitive price point. Once Apple adds the M3 Max as an option Its speed will be equal to that of the 14- and 16-inch MacBook Pro models that feature the M3 Max, but even now it costs a fraction of the price: $1,999 compared to $3,199/£3,299 for the 14-inch and $3,599/£3,699 for the 16-inch, making it an excellent choice for anyone on a budget. Even with the arrival of the M3 Max, the M2 Ultra Mac Studio is Apple’s fastest chip, both in CPU and GPU speed. We expect that when the M3 Ultra arrives the speed gains will be great. Macworld’s buying advice: The Mac Studio is ideal for users who use processor- and graphics-intensive apps, such as media production, software development, graphics software, and more. If you find yourself spending a lot of time watching progress bars while you work, you’ll benefit from the power of the Mac Studio. The only question is whether you can wait until Apple upgrades the processors to M3 Max and M3 Ultra, which we anticipate happening around WWDC in June 2024. The only disadvantage is that the Mac Studio relies on external connections for expandability. If you want a pro-level Mac with the ability to swap expansion cards you should look at Apple silicon-based Mac Pro below. Also read: Why Mac pros should switch to a Mac Studio. Apple Mac Pro (M2 Ultra, 2023) Price When Reviewed: From $6,999 Best Prices Today: $6999 at Apple Note: This model hasn’t been updated since 2023. An update is expected in 2025. What is it? The Mac Pro is Apple’s workstation. It’s designed for professionals who need a powerful and flexible machine. Apple took its time to update the Mac Pro with its own silicon, but in June 2023, three and a half years after the previous update, the company finally came up with the goods. Who’s it for? The Mac Pro is designed for professionals who work with applications that use as many processing cores as possible—video-editing applications, image-editing software, 3D programs, audio editing, software developers, and the like. How much does the Mac Pro cost? The Mac Pro starts at $6,999/£7,199 (which is up from the previous generation’s starting price of $5,999/£5,499). That’s for the Tower version, there is also a Rack mount version that starts at $7,499/£7,699. Those are the starting prices, you can choose various configuration options, such as the 76-core GPU and the 192GB unified memory and 8TB storage – just as with the Mac Studio. A fully specced out Mac Pro Tower costs $11,799/£11,999. What are the specifications? The specifications on offer are identical to the Mac Studio with M2 Ultra: Apple M2 Ultra SoC with a 24-core CPU, 60-core GPU, 64GB of memory, and a 32-core Neural Engine; 1TB SSD Additional options: M2 Ultra SoC with a 76-core GPU, up to 192GB unified memory and up to 8TB SSD. How do I connect stuff? Mac Pro has the following ports: M2 Max: Four Thunderbolt 4 ports on back; two USB-C ports on front. M2 Ultra: Four Thunderbolt 4 ports on back; two Thunderbolt 4 ports on front. SDXC Card slot on front. Two USB-A ports. 10Gb ethernet. HDMI 2.0. 3.5 mm headphone jack (with advanced support for high-impedance headphones, a feature lacked by the M1-series models) 802.11ax Wi-Fi 6E (was 802.11ax Wi-Fi 6 in predecessor) Bluetooth 5.3 (was Bluetooth 5.0 in predecessor) To connect a display, you can use the HDMI 2.0 port or the Thunderbolt ports. You might have to buy an adapter if your display doesn’t have either HDMI or a port that can connect to Thunderbolt. You can connect up to eight 4K displays, six 6K displays or three 8K displays. To connect external devices, the Mac Pro has eight Thunderbolt 4/USB-C ports, three USB-A ports, two HDMI ports, and Dual 10Gb Ethernet. But the real draw for creative pros will be the seven PCI Express expansion slots, one of which comes with an Apple I/O card installed. How fast is it? Apple says the 2023 Mac Pro is up to 3x faster than the previous-generation Intel-based model. With support for 192GB of unified memory, Apple says the Mac Pro supports “more memory than the most advanced workstation graphics cards, taking on demanding workloads other systems can’t even process.” Apple says that, like the M2 Ultra Mac Studio, the M2 Ultra Mac Pro can plan an “unprecedented 22 streams of 8K ProRes video.” Macworld’s buying advice: The Mac Pro provides the processing power that the most demanding users need. We’re talking about production environments, like TV and audio recording studios, animation houses, and software developers. If you feel like you can never have enough power, you’re probably the professional the Mac Pro is aimed at. But if you don’t need the expandability then the Mac Studio will probably be adequate. If you’re more of a “prosumer” than a professional—someone who is an expert Mac user, but doesn’t use high-end apps—the Mac Pro is overkill. You’re probably not going to be able to take advantage of what the Mac Pro has to offer. You just need to figure out whether you want to wait until June 2024, or possibly longer, for the M3 Ultra.

Read more »

Today in Apple history: Apple signs damaging deal with Microsoft
On November 21, 1985, an Apple-Microsoft deal gave Redmond the right to mimic the Macintosh’s look and feel. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Max out your Mac mini M4 with this multiport hub/stand
Satechi’s upcoming multiport hub, stand and SSD enclosure in one might be just the accessory your Mac mini M4 needs. (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

Apple Music celebrates Billie Eilish's record-breaking year
Billie Eilish has been named the Apple Music Artist of the Year for 2024, celebrating a year defined by chart-topping music, award-winning film soundtracks, and record-breaking performances.Apple Music named Billie Eilish its 2024 Artist of the YearApple Music has named Billie Eilish its 2024 Artist of the Year, highlighting a year of achievements for the singer-songwriter. Her third album, Hit Me Hard And Soft, earned widespread acclaim. The album topped Apple Music's all-genre chart in 138 countries.Eilish's influence in 2024 went beyond her music. Her song What Was I Made For? from the Barbie movie soundtrack earned her an Academy Award and two additional Grammys. She also performed Birds of a Feather at the summer games' closing ceremony, making headlines and driving record Shazam activity. Continue Reading on AppleInsider | Discuss on our Forums

Read more »

Apple Music’s Artist of the Year for 2024: Billie Eilish
Singer-songwriter Billie Eilish was announced on Thursday as Apple Music’s Artist of the Year for 2024. The post appeared first on MacDailyNews.

Read more »

Apple Music names Billie Eilish Artist of the Year for second time
With Billie Eilish named Apple Music Artist of the Year for 2024, she becomes the first article to snag the honor twice (also 2019). (via Cult of Mac - Apple news, rumors, reviews and how-tos)

Read more »

iOS 18.2 lets you set new default iPhone apps, here’s how it works
iOS 18.2 is just weeks away from its public release, and beyond a ton of great Apple Intelligence features, the update also lets you set new default iPhone apps. Here’s how that works. more…

Read more »

On having fun with computers
Last night got a little wild… technologically speaking. Since I was a kid, I’ve loved bringing together my hobbies of playing guitar and doing stuff with computers. Nothing professional, just expressional. So when I was doing just that around 10:30 p.m., the technology stars aligned and I had a gadget epiphany. The TL;DR is I’m having fun with computers! more…

Read more »

Black Friday Week deals now live: Apple Watch Series 10 $330, black Ultra 2 all-time low, AirPods Pro 2 best price ever, much more
Amazon’s official are now in full swing and the Apple gear deals are seriously flying now. We have the best prices ever on the new Apple Watch Series 10 starting from $330 shipped including several configurations. Those offers join doorbuster pricing on the black Apple Watch Ultra 2 that deliver the absolute lowest totals we have tracked yet, and perhaps best of all, Apple’s flagship AirPods Pro 2 have dropped to the best prices we have ever tracked as well at $160. All of those sit alongside a massive selection of now live Black Friday Week offers in our master roundup over a 9to5Toys. Scope it all out down below.  more…

Read more »

Feds Charge Five Men in ‘Scattered Spider’ Roundup
Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio.

Read more »

Fintech Giant Finastra Investigating Data Breach
The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world's top 50 banks, notified customers of a potential breach after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company. 

Read more »

Vulnerability Summary for the Week of November 11, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Beauty Parlour Management System  A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 7.3 CVE-2024-11100 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11257 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11258 1000 Projects--Portfolio Management System MCA  A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11256 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47441 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47442 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47443 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-45114 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47450 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47451 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47452 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49507 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49508 adobe -- indesign  InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49509 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47426 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47427 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47428 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47429 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47430 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47431 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47432 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47433 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47434 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49515 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49516 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49517 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49518 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49519 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49520 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49525 Adobe--Adobe Commerce  Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction. 2024-11-12 7.7 CVE-2024-49521 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49526 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49528 Adobe--Photoshop Desktop  Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49514 adonesevangelista -- agri-trading_online_shopping_system  A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout. 2024-11-14 7.5 CVE-2024-50968 algolplus--Advanced Order Export For WooCommerce  The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). 2024-11-13 8.1 CVE-2024-10828 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21974 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21975 AMD--AMD Cloud Manageability Service Software  Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21939 AMD--AMD Management Console  Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21957 AMD--AMD Management Plug-In for SCCM  Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21938 AMD--AMD Provisioning Console (APC) Software  Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21958 AMD--AMD Ryzen AI Software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 8.8 CVE-2024-21976 AMD--AMD Ryzen Master Monitoring SDK  Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21945 AMD--AMD Ryzen Master Utility for Overclocking Control  Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21946 AMD--AMD Software: PRO Edition  Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21937 AMI--AptioV  APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode. 2024-11-12 7.2 CVE-2024-42442 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 9 CVE-2024-51490 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51484 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51485 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL?-?Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.4 CVE-2024-51486 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51487 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the map_id parameter. 2024-11-13 7.2 CVE-2024-50971 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrow_id parameter. 2024-11-13 7.2 CVE-2024-50972 angeljudesuarez -- tailoring_management_system  A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "inccat" to be affected. But it must be assumed "desc", "date", and "amount" are affected as well. 2024-11-11 9.8 CVE-2024-11074 anisha -- job_recruitment  A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11076 anisha -- job_recruitment  A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11077 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 9.8 CVE-2024-11099 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 8.8 CVE-2024-11127 Anthony Carbon--WDES Responsive Mobile Menu  Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through 5.3.18. 2024-11-16 9.8 CVE-2024-52414 Apache Software Foundation--Apache Airflow  Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets. 2024-11-15 7.5 CVE-2024-45784 Apache Software Foundation--Apache CloudStack  Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.5 or 4.19.1.3, or later, which addresses this issue. Additionally, all user-registered KVM-compatible templates can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run the following command on their file-based primary storage(s) and inspect the output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. However, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "nn"; doneFor checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "nn"; done 2024-11-12 8.5 CVE-2024-50386 Apache Software Foundation--Apache Traffic Server  Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue. 2024-11-14 9.1 CVE-2024-50306 Apache Software Foundation--Apache Traffic Server  Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-38479 Apache Software Foundation--Apache Traffic Server  Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-50305 Arttia Creative--Datasets Manager by Arttia Creative  Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative.This issue affects Datasets Manager by Arttia Creative: from n/a through 1.5. 2024-11-14 10 CVE-2024-52375 Autodesk--Installer  A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management. 2024-11-15 7.2 CVE-2024-9500 Avigilon--VideoIQ iCVR HD camera  Avigilon - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-45253 axelkeller--GPX Viewer  The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-13 8.8 CVE-2024-10629 ays-pro--Chartify WordPress Chart Plugin  The Chartify - WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2024-11-14 9.8 CVE-2024-10571 Baxter--Life2000 Ventilation System  The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 10 CVE-2024-48966 Baxter--Life2000 Ventilation System  The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance. 2024-11-14 10 CVE-2024-48967 Baxter--Life2000 Ventilation System  The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48970 Baxter--Life2000 Ventilation System  The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges. 2024-11-14 9.3 CVE-2024-48971 Baxter--Life2000 Ventilation System  The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-48973 Baxter--Life2000 Ventilation System  The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48974 Baxter--Life2000 Ventilation System  There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-9832 Baxter--Life2000 Ventilation System  Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-9834 BdThemes--Instant Image Generator  Unrestricted Upload of File with Dangerous Type vulnerability in BdThemes Instant Image Generator allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through 1.5.4. 2024-11-14 10 CVE-2024-52377 Bigfive--CF7 Reply Manager  Unrestricted Upload of File with Dangerous Type vulnerability in Bigfive CF7 Reply Manager.This issue affects CF7 Reply Manager: from n/a through 1.2.3. 2024-11-16 9.9 CVE-2024-52404 Bikram Joshi--B-Banner Slider  Unrestricted Upload of File with Dangerous Type vulnerability in Bikram Joshi B-Banner Slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through 1.1. 2024-11-16 9.9 CVE-2024-52405 BlackBerry--SecuSUITE  A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege. 2024-11-12 7.3 CVE-2024-51721 Boa web server--Boa web server 0.94.14rc21  Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-47916 Bosch Rexroth AG--IndraDrive FWA-INDRV*-MP*  A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages. 2024-11-13 7.5 CVE-2024-48989 Ciprian Popescu--W3P SEO  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO allows Stored XSS.This issue affects W3P SEO: from n/a before 1.8.6. 2024-11-14 7.1 CVE-2024-51684 Cisco--Cisco BroadWorks  A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting does not occur for certain incoming TCP connections. An attacker could exploit this vulnerability by sending a high rate of TCP connections to the server. A successful exploit could allow the attacker to cause TCP connection resources to grow rapidly until the Cisco BroadWorks Network Server becomes unusable.Note: To recover from this vulnerability, either Cisco BroadWorks Network Server software must be restarted or the Cisco BroadWorks Network Server node must be rebooted. For more information, see the section of this advisory.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.6 CVE-2023-20125 Cisco--Cisco Cyber Vision  A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.5 CVE-2022-20685 Cisco--Cisco Industrial Network Director  A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITYSYSTEM on the underlying operating system of an affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 9.9 CVE-2023-20036 Cisco--Cisco IOS XR Software  A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root. 2024-11-15 8.8 CVE-2022-20655 Cisco--Cisco Modeling Labs  A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerability, the attacker would need valid user credentials that are stored on the associated external authentication server.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. 2024-11-15 9.1 CVE-2023-20154 Cisco--Cisco Redundancy Configuration Manager  A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container.This vulnerability exists because the debug mode is incorrectly enabled for specific services. An attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled. A successful exploit could allow the attacker to execute arbitrary commands as the root user.The attacker would need to perform detailed reconnaissance to allow for unauthenticated access. The vulnerability can also be exploited by an authenticated attacker.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.1 CVE-2022-20649 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.  The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic.Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.4 CVE-2022-20814 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.  2024-11-15 7.4 CVE-2022-20853 Citrix Session Recording--Citrix Session Recording  Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server 2024-11-12 8.8 CVE-2024-8069 Clarisse K.--Writer Helper  Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper allows Upload a Web Shell to a Web Server.This issue affects Writer Helper: from n/a through 3.1.6. 2024-11-16 9.9 CVE-2024-52399 cli--cli  The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. 2024-11-14 8 CVE-2024-52308 cmorillas1--External Database Based Actions  The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator. 2024-11-15 7.5 CVE-2024-10311 cmsMinds--Boat Rental Plugin for WordPress  Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through 1.0.1. 2024-11-14 10 CVE-2024-52376 code-projects--Job Recruitment  A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11241 codeSavory--BasePress Migration Tools  Unrestricted Upload of File with Dangerous Type vulnerability in codeSavory BasePress Migration Tools allows Upload a Web Shell to a Web Server.This issue affects BasePress Migration Tools: from n/a through 1.0.0. 2024-11-16 9.9 CVE-2024-52407 craftcms--cms  Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5. 2024-11-13 8.4 CVE-2024-52291 craftcms--cms  Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8. 2024-11-13 7.7 CVE-2024-52292 craftcms--cms  Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3. 2024-11-13 7.2 CVE-2024-52293 creativeinteractivemedia--Real3D Flipbook Lite 3D FlipBook, PDF Viewer, PDF Embedder  The 3D FlipBook, PDF Viewer, PDF Embedder - Real 3D FlipBook WordPress Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-16 8.8 CVE-2024-9849 cyberlord92--Login using WordPress Users ( WP as SAML IDP )  The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2024-11-16 7.2 CVE-2024-9887 Dang Ngoc Binh--Audio Record  Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record allows Upload a Web Shell to a Web Server.This issue affects Audio Record: from n/a through 1.0. 2024-11-11 10 CVE-2024-51792 Davor Zeljkovic--Convert Docx2post  Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post allows Upload a Web Shell to a Web Server.This issue affects Convert Docx2post: from n/a through 1.4. 2024-11-16 9.1 CVE-2024-52397 decidim--decidim  Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0. 2024-11-13 7.7 CVE-2024-45594 decidim-ice--decidim-module-decidim_awesome  An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands. 2024-11-12 9 CVE-2024-43415 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. 2024-11-12 7.8 CVE-2024-49557 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. 2024-11-12 7.8 CVE-2024-49558 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. 2024-11-12 7.8 CVE-2024-49560 Dell--SmartFabric OS10 Software  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution 2024-11-12 7.8 CVE-2024-48837 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39354 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39605 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-47131 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user's password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user's account. 2024-11-11 9.8 CVE-2024-11068 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11062 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11063 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11064 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11065 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through the specific web page. 2024-11-11 7.2 CVE-2024-11066 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password. 2024-11-11 7.5 CVE-2024-11067 DMC--Airin Blog  Deserialization of Untrusted Data vulnerability in DMC Airin Blog allows Object Injection.This issue affects Airin Blog: from n/a through 1.6.1. 2024-11-16 9.8 CVE-2024-52413 DonnellC--Global Gateway e4 | Payeezy Gateway  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway.This issue affects Global Gateway e4 | Payeezy Gateway: from n/a through 2.0. 2024-11-14 8.6 CVE-2024-52371 DoThatTask--Do That Task  Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task allows Upload a Web Shell to a Web Server.This issue affects Do That Task: from n/a through 1.5.5. 2024-11-14 10 CVE-2024-52374 dotnetzip.semverd_project -- dotnetzip.semverd  Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2024-11-13 9.8 CVE-2024-48510 Elastic--Kibana  A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest** The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted* Under Integration the Read or All privilege is granted* Access to the fleet-setup privilege is gained through the Fleet Server's service account token 2024-11-14 9.1 CVE-2024-37285 Eugen Bobrowski--Debug Tool  Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a through 2.2. 2024-11-16 10 CVE-2024-52416 Flowcraft UX Design Studio--Advanced Personalization  Deserialization of Untrusted Data vulnerability in Flowcraft UX Design Studio Advanced Personalization allows Object Injection.This issue affects Advanced Personalization: from n/a through 1.1.2. 2024-11-16 9.8 CVE-2024-52411 fortinet -- forticlient  A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts. 2024-11-12 8.8 CVE-2024-36513 fortinet -- forticlient  A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering. 2024-11-12 7.8 CVE-2024-36507 Fortinet--FortiClientWindows  A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages. 2024-11-13 7.8 CVE-2024-47574 Fortinet--FortiManager  A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigDataat least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests. 2024-11-12 7.5 CVE-2024-23666 Fortinet--FortiOS  A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link. 2024-11-12 7.5 CVE-2023-50176 FraudLabs Pro--FraudLabs Pro SMS Verification  Cross-Site Request Forgery (CSRF) vulnerability in FraudLabs Pro FraudLabs Pro SMS Verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through 1.10.1. 2024-11-14 7.1 CVE-2024-51688 FreeBSD--FreeBSD  The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option. 2024-11-12 7.5 CVE-2024-45289 GeekRMX--Twitter @Anywhere Plus  Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through 2.0. 2024-11-14 7.1 CVE-2024-51659 GentleSource--Appointmind  Cross-Site Request Forgery (CSRF) vulnerability in GentleSource Appointmind allows Stored XSS.This issue affects Appointmind: from n/a through 4.0.0. 2024-11-14 7.1 CVE-2024-51679 GeoVision--GV-VS12  Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports. 2024-11-15 9.8 CVE-2024-11120 GitLab--GitLab  An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. 2024-11-14 8.5 CVE-2024-9693 glpi-project--glpi  GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17. 2024-11-15 8.1 CVE-2024-40638 gogs--gogs/gogs  A remote command execution vulnerability exists in gogs/gogs versions

Read more »

An Interview With the Target & Home Depot Hacker
In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.

Read more »

Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November's patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.

Read more »

FBI: Spike in Hacked Police Emails, Fake Subpoenas
The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies.

Read more »

Canadian Man Arrested in Snowflake Data Extortions
A 26-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service Snowflake. On October 30, Canadian authorities arrested Alexander Moucka, a.k.a. Connor Riley Moucka of Kitchener, Ontario, on a provisional arrest warrant from the United States. Bloomberg first reported Moucka's alleged ties to the Snowflake hacks on Monday. At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories used by some of the world’s largest corporations.

Read more »

Vulnerability Summary for the Week of October 28, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info acnoo -- flutter_api  Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through 1.0.5. 2024-10-28 9.8 CVE-2024-50486 audit@patchstack.com  adirectory--aDirectory  Unrestricted Upload of File with Dangerous Type vulnerability in adirectory aDirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through 1.3. 2024-10-29 10 CVE-2024-50420 audit@patchstack.com  Ajar Productions--Ajar in5 Embed  Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through 3.1.3. 2024-10-29 10 CVE-2024-50473 audit@patchstack.com  Amin Omer--Sudan Payment Gateway for WooCommerce  Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2. 2024-10-29 10 CVE-2024-50494 audit@patchstack.com  amu02aftab--Enable Shortcodes inside Widgets,Comments and Experts  The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. 2024-10-30 7.3 CVE-2024-9846 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Andy Moyle--Church Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Andy Moyle Church Admin allows Reflected XSS.This issue affects Church Admin: from n/a before 5.0.0. 2024-10-28 7.1 CVE-2024-50438 audit@patchstack.com  Apache Software Foundation--Apache Lucene.Net.Replicator  Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. 2024-10-31 8 CVE-2024-43383 security@apache.org  apple -- ipados  A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox. 2024-10-28 9.6 CVE-2024-40867 product-security@apple.com  apple -- ipados  The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, iOS 17.7 and iPadOS 17.7, macOS Sonoma 14.7, visionOS 2, iOS 18 and iPadOS 18. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44126 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, macOS Sonoma 14.7.1, iOS 18.1 and iPadOS 18.1. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44218 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44252 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A path handling issue was addressed with improved logic. This issue is fixed in visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1. A malicious app may be able to run arbitrary shortcuts without user consent. 2024-10-28 7.8 CVE-2024-44255 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44258 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, watchOS 11.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.8 CVE-2024-44285 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1. An application may be able to break out of its sandbox. 2024-10-28 8.8 CVE-2024-44122 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A sandboxed process may be able to circumvent sandbox restrictions. 2024-10-28 8.6 CVE-2024-44270 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44156 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44159 product-security@apple.comproduct-security@apple.com  apple -- macos  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library. 2024-10-28 7.5 CVE-2024-44203 product-security@apple.com  apple -- macos  This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. An app may be able to bypass certain Privacy preferences. 2024-10-28 7.5 CVE-2024-44208 product-security@apple.com  apple -- macos  A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information. 2024-10-28 7.5 CVE-2024-44289 product-security@apple.comproduct-security@apple.com  apple -- xcode  This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data. 2024-10-28 7.5 CVE-2024-44228 product-security@apple.com  Apple--iOS and iPadOS  A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may fill in passwords after failing authentication. 2024-10-28 9.1 CVE-2024-44217 product-security@apple.com  Apple--macOS  The issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to break out of its sandbox. 2024-10-28 9.3 CVE-2024-44256 product-security@apple.comproduct-security@apple.com  Apple--macOS  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.5 CVE-2024-44196 product-security@apple.comproduct-security@apple.com  Apple--macOS  A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44280 product-security@apple.comproduct-security@apple.com  Apple--macOS  This issue was addressed with additional entitlement checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44295 product-security@apple.comproduct-security@apple.com  Apple--visionOS  This issue was addressed through improved state management. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, Safari 18.1. An attacker may be able to misuse a trust relationship to download malicious content. 2024-10-28 8.8 CVE-2024-44259 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  Apple--visionOS  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.7 CVE-2024-44277 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7991 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7992 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8588 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8589 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8590 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8591 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8592 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in ASMKERN230A.dll through Autodesk AutoCAD can force a Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8593 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8594 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8595 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force an Out-of-Bound Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8596 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8597 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8598 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8599 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8600 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8896 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9489 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9826 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9827 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9996 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9997 psirt@autodesk.com  Autodesk--AutoCAD  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8587 psirt@autodesk.com  Automattic--Newspack Blocks  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8. 2024-11-01 8.5 CVE-2024-37423 audit@patchstack.com  Azexo--Marketing Automation by AZEXO  Incorrect Privilege Assignment vulnerability in Azexo Marketing Automation by AZEXO allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-30 8.8 CVE-2024-50506 audit@patchstack.com  azexo--Marketing Automation by AZEXO  Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-29 9.9 CVE-2024-50480 audit@patchstack.com  buynowdepot -- advanced_online_ordering_and_delivery_platform  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuyNowDepot Advanced Online Ordering and Delivery Platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through 2.0.0. 2024-10-28 9.8 CVE-2024-50497 audit@patchstack.com  Carl Alberto--Simple Custom Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through 1.2. 2024-10-29 7.1 CVE-2024-49647 audit@patchstack.com  CHANGING Information Technology--IDExpert  IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server. 2024-11-01 7.2 CVE-2024-10653 twcert@cert.org.twtwcert@cert.org.tw  Chetan Khandla--Woocommerce Product Design  Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-29 10 CVE-2024-50482 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 8.6 CVE-2024-50509 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 7.5 CVE-2024-50508 audit@patchstack.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /track-result.php. The manipulation of the argument Consignment leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10607 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10608 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability, which was classified as critical, has been found in code-projects E-Health Care System 1.0. Affected by this issue is some unknown functionality of the file /Admin/adminlogin.php. The manipulation of the argument email/admin_pswd as part of String leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "email" to be affected. But it must be assumed that parameter "admin_pswd" is affected as well. 2024-11-03 7.3 CVE-2024-10739 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file /Users/registration.php. The manipulation of the argument f_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-03 7.3 CVE-2024-10741 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Restaurant Order System  A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10733 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Simple Car Rental System  A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10702 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Wazifa System  A vulnerability was found in code-projects Wazifa System 1.0. It has been classified as critical. This affects an unknown part of the file /controllers/logincontrol.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10699 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- hospital_appointment_system  A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-28 9.8 CVE-2024-10449 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- online_institute_management_system  A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 9.8 CVE-2024-10509 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10556 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file birdsupdate.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10561 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 7.3 CVE-2024-10507 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10736 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10737 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  CozyThemes--Cozy Blocks  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.0.15. 2024-10-28 7.4 CVE-2024-50441 audit@patchstack.com  cure53--DOMPurify  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. 2024-10-31 9.1 CVE-2024-48910 security-advisories@github.comsecurity-advisories@github.com  D3TN--D3TN  Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block 2024-10-28 7.5 CVE-2024-10455 cve@gitlab.com  Daniel Schmitzer--DS.DownloadList  Deserialization of Untrusted Data vulnerability in Daniel Schmitzer DS.DownloadList allows Object Injection.This issue affects DS.DownloadList: from n/a through 1.3. 2024-10-30 9.8 CVE-2024-50507 audit@patchstack.com  David DONISA--WP donimedia carousel  Unrestricted Upload of File with Dangerous Type vulnerability in David DONISA WP donimedia carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through 1.0.1. 2024-10-30 9.9 CVE-2024-50511 audit@patchstack.com  Delta Electronics--InfraSuite Device Master  Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication. 2024-10-30 9.8 CVE-2024-10456 ics-cert@hq.dhs.gov  Deryck Oate--User Toolkit  Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through 1.2.3. 2024-10-30 9.8 CVE-2024-50503 audit@patchstack.com  Devsoft Baltic O--SurveyJS: Drag & Drop WordPress Form Builder  Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÃœ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136. 2024-10-29 9.9 CVE-2024-50427 audit@patchstack.com  Eclipse Foundation--mosquitto  In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients. 2024-10-30 9.1 CVE-2024-10525 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  Eclipse Foundation--mosquitto  In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. 2024-10-30 7.5 CVE-2024-3935 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  esafenet -- cdg  A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delFile/delDifferCourseList of the file /com/esafenet/servlet/ajax/PublicDocInfoAjax.java. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2024-10-31 9.8 CVE-2024-10595 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  gaizhenbiao -- chuanhuchatgpt  A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions

Read more »

Booking.com Phishers May Leave You With Reservations
A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its booking.com credentials stolen. We'll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world's most visited travel website.

Read more »

Change Healthcare Breach Hits 100M Americans
Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information.

Read more »

The Global Surveillance Free-for-All in Mobile Ad Data
Not long ago, the ability to remotely track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a powerful surveillance tool that should only be in the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows that anyone can now access this capability, thanks to a proliferation of commercial services that hoover up the digital exhaust emitted by widely-used mobile apps and websites.

Read more »

Black Friday Deal: Apple’s M2 11-inch iPad Airs for $100 off MSRP at Amazon
Amazon is offering a $100 discount on 11-inch iPad Airs as part of their Black Friday sales. Shipping is free: - 11" 128GB M2 WiFi iPad Air: $499, $100 off - 11" 256GB M2 WiFi iPad Air: $599, $100 off - 11" 512GB M2 WiFi iPad Air: $799, $100 off - 11" 1TB M2 WiFi iPad Air: $999, $100 off - 11" 128GB M2 WiFi + 5G iPad Air: $649, $100 off - 11" 256GB M2 WiFi + 5G iPad Air: $749, $100 off - 11" 512GB M2 WiFi + 5G iPad Air: $949, $100 off - 11" 1TB M2 WiFi + 5G iPad Air: $1149, $100 off These are the cheapest Black Friday prices available for 11-inch M2-powered iPad Airs. For the latest prices & sales, keep an eye on our iPad Air Price Tracker, updated daily.

Read more »

Apple AirPods Pro 2 with USB-C now on Black Friday sale for $159, $90 off MSRP
Amazon has Apple AirPods Pro 2 with USB-C in stock and on Black Friday sale for $159.99 including free shipping. Their price is $90 (36%) off MSRP, and it's currently the lowest Black Friday price available for new AirPods Pro 2. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily.

Read more »

Apple AirPods Pro 2 with USB-C now on Black Friday sale for $159, $90 off MSRP
Amazon has Apple AirPods Pro 2 with USB-C in stock and on Black Friday sale for $159.99 including free shipping. Their price is $90 (36%) off MSRP, and it's currently the lowest Black Friday price available for new AirPods Pro 2. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily.

Read more »

Apple AirPods Pro 2 with USB-C now on Black Friday sale for $159, $90 off MSRP
Amazon has Apple AirPods Pro 2 with USB-C in stock and on Black Friday sale for $159.99 including free shipping. Their price is $90 (36%) off MSRP, and it's currently the lowest Black Friday price available for new AirPods Pro 2. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily.

Read more »

Apple AirPods Pro 2 with USB-C now on Black Friday sale for $159, $90 off MSRP
Amazon has Apple AirPods Pro 2 with USB-C in stock and on Black Friday sale for $159.99 including free shipping. Their price is $90 (36%) off MSRP, and it's currently the lowest Black Friday price available for new AirPods Pro 2. For the latest prices & deals, see our Apple AirPods Price Tracker, updated daily.

Read more »

Amazon has new M4 Mac minis available starting at only $499 for Black Friday
Amazon has the new M4 and M4 Pro Mac minis now on sale for up to $140 off Apple's MSRP, starting at only $499, as part of their Black Friday sales. Shipping is free. Their prices are the lowest currently available for these popular new minis: - Mac mini M4 (16GB/256GB): $499, $100 off MSRP - Mac mini M4 (16GB/512GB): $744, $54 off MSRP - Mac mini M4 (24GB/512GB): $889, $110 off MSRP - Mac mini M4 Pro (24GB/512GB): $1269, $140 off MSRP Prices for all but the 16GB/512GB mini include clippable coupons available on Amazon's site. Be sure to select Amazon as the retailer to see these coupons, rather than a third-party seller. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

Amazon has new M4 Mac minis available starting at only $499 for Black Friday
Amazon has the new M4 and M4 Pro Mac minis now on sale for up to $140 off Apple's MSRP, starting at only $499, as part of their Black Friday sales. Shipping is free. Their prices are the lowest currently available for these popular new minis: - Mac mini M4 (16GB/256GB): $499, $100 off MSRP - Mac mini M4 (16GB/512GB): $744, $54 off MSRP - Mac mini M4 (24GB/512GB): $889, $110 off MSRP - Mac mini M4 Pro (24GB/512GB): $1269, $140 off MSRP Prices for all but the 16GB/512GB mini include clippable coupons available on Amazon's site. Be sure to select Amazon as the retailer to see these coupons, rather than a third-party seller. For the latest prices and sales, keep an eye on our Mac mini Price Tracker, updated daily.

Read more »

27-inch 5K Apple Studio Displays on Black Friday sale for $300 off MSRP
Amazon has Apple Studio Displays on Black Friday sale for $300 off MSRP. Shipping is free: - Studio Display (Standard glass): $1299.99, $300 off MSRP - Studio Display (Nano glass): $1599.99, $300 off MSRP Their prices are among the lowest available for Studio Displays among the retailers we track. For the latest prices and sales, see our Studio Display Price Tracker, updated daily.

Read more »

Amazon’s Black Friday iPad prices are now live, save $70 on 10th-generation models starting at $279
Amazon has Apple's 10th-generation iPads now on Black Friday sale for $70 off MSRP. Shipping is free: - 10" 10th-generation 64GB WiFi iPads: $279, $70 off MSRP - 10" 10th-generation 256GB WiFi iPads: $429, $70 off MSRP - 10" 10th-generation 64GB WiFi + Cellular iPads: $429, $70 off MSRP - 10" 10th-generation 256GB WiFi + Cellular iPads: $579, $70 off MSRP Amazon's prices are the lowest Black Friday iPads prices currently available for 10th-generation models. For the latest prices & deals, keep an eye on our iPad Price Tracker, updated daily.

Read more »

Black Friday Deal: Apple AirPods Max headphones with USB-C on sale for $499, save $50
Amazon has Apple AirPods Max headphones with USB-C in stock and on Black Friday sale for $50 off MSRP, $499. Sale price is valid for all colors, and shipping is free: - AirPods Max USB-C: $499.99, $50 off MSRP Amazon's price is among the lowest available for these new Max headphones. See our AirPods Price Tracker for the latest prices and deals from Apple and its retailers.

Read more »

Black Friday Deal at Amazon: 13-inch M2 MacBook Air with 16GB of RAM for $749, $250 off MSRP
Amazon has Apple 13" MacBook Airs with M2 CPUs and 16GB of RAM now on Black Friday sale for $250 off MSRP, only $749. Their prices are the lowest currently available for these newly upgraded 13" M2 MacBook Airs. Discount applies to all colors, and shipping is free: - 13" M2 MacBook Air (16GB RAM/256GB SSD): $749, $250 off MSRP For the latest sales & prices, see our 13" MacBook Air Price Tracker.

Read more »

Apple Watch SE models on Black Friday sale at Amazon starting at only $169
Amazon has Apple Watch SE models now on Black Friday sale for $80 off MSRP, each including free shipping. Their prices are the lowest currently available for SE Watches: - 40mm Apple Watch SE GPS: $169, save $80 - 44mm Apple Watch SE GPS: $199, save $80 - 40mm Apple Watch SE GPS + Cellular: $219, save $80 - 44mm Apple Watch SE GPS + Cellular: $249, save $80 Note that their sale prices may be restricted to certain band colors (see their site for details), and stock is likely to come and go. For the latest prices & sales, keep an eye on our Apple Watch Price Tracker, updated daily.

Read more »