The Best Black Friday iPad Deals
Black Friday is here, and today you can find great prices on numerous iPads, including the 9th generation iPad, 10th generation iPad, iPad Air, and iPad mini. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Best iPad Deals 9th Gen iPad (64GB Wi-Fi) - $199.99 ($129 off) 10th Gen iPad (64GB Wi-Fi) - $249.99 with on-page coupon ($99 off) 11-inch M2 iPad Air (128GB Wi-Fi) - $499.00 ($100 off) 11-inch M4 iPad Pro (256GB Wi-Fi) - $849.00 ($150 off) 9th Gen iPad We've been tracking a great all-time low discount on the ninth generation iPad since the beginning of the month, and that discount is still around for Black Friday. You can get the 64GB Wi-Fi iPad for $199.99, down from $329.00. At this price, the iPad is a perfect entry-level tablet for a kid or family member who doesn't need the tablet for work-intensive projects. $129 OFF9th Gen iPad (64GB Wi-Fi) for $199.99 $129 OFF9th Gen iPad (256GB Wi-Fi) for $349.99 10th Gen iPad Apple's 64GB Wi-Fi iPad from 2022 is being discounted to the all-time low price of $249.99 right now on Amazon, from $349.00. This upgraded model comes with a larger 10.9-inch Liquid Retina display, A14 Bionic chip for a performance boost, Wi-Fi 6, and more. $99 OFF10.9-inch iPad (64GB Wi-Fi) for $249.99M2 iPad Air For the latest iPad Air models, Best Buy has a few all-time low prices, including the 128GB Wi-Fi 11-inch iPad Air for $499.00 ($100 off) and the 128GB Wi-Fi 13-inch iPad Air for $699.00 ($100 off). There are a few cellular discounts as well on select M2 iPad Air tablets. 11-inch iPad Air 128GB Wi-Fi - $499.00 ($100 off) 256GB Wi-Fi - $599.00 ($100 off) 512GB Wi-Fi - $799.00 ($100 off) 1TB Wi-Fi - $999.00 ($100 off) 13-inch iPad Air 128GB Wi-Fi - $699.00 ($100 off) 256GB Wi-Fi - $799.00 ($100 off) 512GB Wi-Fi - $999.00 ($100 off) 1TB Wi-Fi - $1,199.00 ($100 off) M4 iPad Pro Best Buy has huge discounts across the entire M4 iPad Pro lineup, with as much as $200 off these devices for Black Friday. You'll find both 11-inch and 13-inch models on sale at Best Buy, and some deals will require a My Best Buy Plus or Total membership. 11-Inch iPad Pro - Wi-Fi 256GB Wi-Fi - $849.00 ($150 off) [Best Buy members only] 512GB Wi-Fi - $1,049.00 ($150 off) [Best Buy members only] 1TB Wi-Fi - $1,399.00 ($200 off) [Best Buy members only] 1TB Wi-Fi with Nano-Texture Glass - $1,499.00 ($200 off) [Best Buy members only] 2TB Wi-Fi - $1,799.00 ($200 off) [Best Buy members only] 2TB Wi-Fi with Nano-Texture Glass - $1,899.00 ($200 off) [Best Buy members only] 11-Inch iPad Pro - Cellular 256GB Cellular - $1,049.00 ($150 off) [Best Buy members only] 512GB Cellular - $1,249.00 ($150 off) [Best Buy members only] 1TB Cellular - $1,599.00 ($200 off) [Best Buy members only] 1TB Cellular with Nano-Texture Glass - $1,699.00 ($200 off) [Best Buy members only] 2TB Cellular - $1,999.00 ($200 off) [Best Buy members only] 13-Inch iPad Pro - Wi-Fi 256GB Wi-Fi - $1,099.00 ($200 off) 512GB Wi-Fi - $1,299.00 ($200 off) 1TB Wi-Fi - $1,699.00 ($200 off) 1TB Wi-Fi with Nano-Texture Glass - $1,799.00 ($200 off) 2TB Wi-Fi - $2,099.00 ($200 off) 2TB Wi-Fi with Nano-Texture Glass - $2,199.00 ($200 off) 13-Inch iPad Pro - Cellular 256GB Cellular - $1,299.00 ($200 off) 512GB Cellular - $1,499.00 ($200 off) 1TB Cellular - $1,899.00 ($200 off) 1TB Cellular with Nano-Texture Glass - $1,999.00 ($200 off) 2TB Cellular - $2,299.00 ($200 off) Accessories Magic Keyboard for 11-inch iPad Pro - $249.99 ($49 off) Magic Keyboard for 13-inch iPad Pro - $274.99 ($75 off) We've begun tracking all of the season's best deals in our dedicated Black Friday Roundup, so be sure to bookmark the page and visit it throughout the season as you do your online shopping. Our roundup mainly focuses on Apple products and related tech accessories. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundups: Apple Black Friday, Apple DealsRelated Forum: Community DiscussionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

5 Best Black Friday AirPods Deals
It's Black Friday and the best time of the year to buy a pair of AirPods. In 2024, this includes an all-time low price on the popular AirPods Pro 2, as well as low prices on the new AirPods 4. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Best AirPods Deals AirPods Pro 2 for $153.99 at Amazon ($95 off) AirPods Max (USB-C) for $499.99 at Amazon ($49 off) Starting with the overall best Black Friday AirPods deal: you can get the AirPods Pro 2 for $153.99 today on Amazon, down from $249.00. This is an all-time low price. $95 OFFAirPods Pro 2 for $153.99 If you're looking for the newest models, Amazon has solid prices on both models of the AirPods 4. You can get the AirPods 4 (without ANC) for $119.00 and the AirPods 4 (with ANC) for $164.99 at Amazon. $10 OFFAirPods 4 for $119.00 $15 OFFAirPods 4 (ANC) for $164.99 Finally, Amazon has both AirPods Max models on sale this week. You can get the Lightning model for $399.00 ($150 off) and the USB-C model for $499.99 ($49 off). $49 OFFAirPods Max (USB-C) for $499.99 $150 OFFAirPods Max (Lightning) for $399.00 We're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundups: Apple Black Friday, Apple DealsRelated Forum: Community DiscussionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Increases Trade-In Values for iPad Models
Apple today increased trade-in values for iPad models in the United States, including the iPad Pro, iPad Air, iPad, and iPad mini. Most adjustments were slight: iPad trade-in values increased by up to $35, with pre-owned iPad Pro models gaining the most value. The latest trade-in values are listed below: iPad Pro: Up to $555 (vs. $520) iPad Air: Up to $275 (vs. $270) iPad: Up to $190 (vs. $185) iPad mini: Up to $215 (vs. $210) The full list of trade-in values, including those for Macs, iPhones, and Android smartphones, can be found on Apple's trade-in website.Tag: Apple Trade-InThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Orders M5 Chips From TSMC Ahead of Late 2025 Production
Apple has ordered M5 chips from TSMC as the company begins production development of its next-generation processor for future devices, claims a new Korean-language report by The Elec. The M5 series is expected to feature an enhanced ARM architecture and will reportedly be manufactured using TSMC's advanced 3-nanometer process technology. Apple's decision to forgo TSMC's more advanced 2nm process for the M5 chip is believed to be primarily due to cost considerations. Despite this, the M5 will feature significant advancements over the M4, notably through the adoption of TSMC's System on Integrated Chip (SoIC) technology. This 3D chip-stacking approach enhances thermal management and reduces electrical leakage compared to traditional 2D designs. Apple is said to have expanded its cooperation with TSMC on the next-generation hybrid SoIC package, which also combines thermoplastic carbon fiber composite molding technology. The package reportedly entered a small trial production phase in July. Apple's forthcoming M5 chip is anticipated to bring significant enhancements in performance and efficiency across various devices. Production could begin as early as the second half of 2025, with the first M5-equipped devices potentially launching by the end of next year or early 2026. Assuming Apple maintains its typical upgrade cycle for its custom silicon, here are the devices we're expecting to benefit first: iPad Pro: M5 models could debut in the devices in late 2025 or early-to-mid 2026. MacBook Pro: Models featuring M5 series chips are anticipated in late 2025. MacBook Air: M5 variants will likely arrive in early 2026. Apple Vision Pro: An updated version of the headset incorporating the M5 chip is expected between the fall of 2025 and spring of 2026.References to what are believed to be Apple's M5 chip have already been discovered in official Apple code. According to one report, thanks to its dual-use SoIC design, Apple also plans to deploy the M5 chip within its AI server infrastructure to bolster AI capabilities across both consumer devices and cloud services. Today's report reinforces Apple's continued reliance on TSMC as its exclusive chip manufacturing partner. The Taiwanese foundry has been crucial to Apple's successful transition away from Intel processors beginning in 2020, with the company unable to produce its custom chips without TSMC's advanced manufacturing capabilities.Tags: M5, The Elec, TSMCThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple's Shopping Event Underway: Up to $200 Gift Card With Select Products
Apple's annual four-day Black Friday through Cyber Monday shopping event went live today in many countries, including the U.S., Canada, Australia, France, Germany, Italy, Spain, the U.K., and others. During the event, which lasts until December 2, customers can get an Apple gift card with the purchase of an eligible product. In the UK, for instance, Apple is including gift cards worth between £20 and £160 with the purchase of an eligible iPhone, iPad, Mac, Apple Watch, Apple TV, HomePod, AirPods, Beats headphones and speakers, and select accessories. The gift card values for the U.S. are as follows: $25 Apple Gift Card: iPhone SE AirPods 4 AirPods 4 With Active Noise Cancellation Apple TV 4K Apple Pencil Pro Apple Pencil 2 Beats Solo Buds Beats Flex Beats Pill Magic Keyboards and Folios for iPads $50 Apple Gift Card: iPhone 14 iPhone 14 Plus iPad 10 Apple Watch SE AirPods Pro 2 HomePod Beats Studio Pro Beats Solo 4 Wireless Beats Fit Pro Beats Studio Buds+ $75 Apple Gift Card: iPhone 15 iPhone 15 Plus iPad Air AirPods Max $100 Apple Gift Card: iPad Pro

Read more »

tvOS 18.2 No Longer Expected to Include More Apple TV+ Screen Savers
The upcoming tvOS 18.2 update adds a rotation of Snoopy screen savers to 2021 and newer Apple TV models, but it seems that an additional "TV and Movies" category of screen savers has been canceled, or at least postponed. These screen savers were expected to be based on various Apple TV+ series and movies. As spotted by the Dutch blog iCulture, Apple removed all references to the "TV and Movies" screen savers on its website in mid-November, including a preview of a new screen saver based on the Apple TV+ series "Foundation." Apple also updated fine print on its website, although only in the U.S. for now. Apple often takes longer to update its regional websites for other countries. The previous fine print: Snoopy and TV and Movies screen savers coming late 2024. The current fine print: Snoopy screen saver coming late 2024.Snoopy is technically Apple TV+ content now, but it looks like additional Apple TV+ screen savers will not be coming any time soon. We expect tvOS 18.2 to be released to the public in December. The rotating Snoopy screen saver is already available in the third beta version of the update. Other screen saver categories on the Apple TV include Aerials and Memories, along with a Portraits option with clocks added in tvOS 18.0.Related Roundup: Apple TVBuyer's Guide: Apple TV (Don't Buy)Related Forum: Apple TV and Home TheaterThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

The Best 50+ Black Friday Apple Deals on AirPods, iPads, MacBooks, and More
Black Friday 2024 is here, and as always this is the best time of the year to shop for great deals on just about everything. Right now, this includes big savings on popular Apple products like AirPods, Apple Watch, MacBook Air, iPad, and more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Specifically, in this article we're sharing all of the Apple products that currently have all-time low prices, or discounts that are at least very close to their record-low prices. Beyond Apple, we're also taking a look at notable accessories for Apple products as well as some of the season's best gifts, including deals at Anker and Samsung. Every deal shared below is available to purchase right now. Table of Contents You can use the links below to jump directly to the section you're shopping for today. AirPods iPad Mac Apple Watch Accessories More Black Friday Sales AirPods AirPods Pro 2 Amazon has the AirPods Pro 2 at $153.99 for Black Friday, down from $249.00. This is a new all-time low price on the AirPods Pro 2. $95 OFFAirPods Pro 2 for $153.99AirPods 4 Starting with AirPods, you'll find Amazon has the base model AirPods 4 for $119.00 and the AirPods 4 with ANC for $164.99. While the base model is at a second-best price, the model with ANC has hit a new all-time low on Amazon at $15 off. $10 OFFAirPods 4 for $119.00 $15 OFFAirPods 4 with ANC for $164.99AirPods Max (USB-C) You can get the new AirPods Max with USB-C for $499.99 on Amazon this week, down from $549.00. This price is just a few dollars higher compared to the previous record low price. $49 OFFAirPods Max (USB-C) for $499.99 AirPods Max (Lightning) The older AirPods Max with Lightning are on sale for $399.00 on Amazon this week, down from $549.00. You'll find all five colors on sale at this price. $150 OFFAirPods Max (Lightning) for $399.00iPad 9th Gen iPad You can get the 64GB Wi-Fi 9th generation iPad for $199.99 in both colors at Best Buy, down from $329.00. This is a match of the record low price on this version of the 2021 tablet. $129 OFF9th Gen iPad (64GB Wi-Fi) for $199.99 $129 OFF9th Gen iPad (256GB Wi-Fi) for $349.9910th Gen iPad Moving to the newer models, Amazon has the 64GB Wi-Fi 10th generation iPad for $249.99 with an on-page coupon, down from $349.00. You can also get the 256GB Wi-Fi iPad for $409.00 at Amazon, down from $499.00. Both of these represent all-time low prices on each tablet. Note: You won't see the deal price until checkout. $99 OFF10th Gen iPad (64GB Wi-Fi) for $249.99 $90 OFF10th Gen iPad (256GB Wi-Fi) for $409.00M2 iPad Air Best Buy today has a big selection of discounts on Apple's M2 iPad Air, with savings of about $100 across nearly every model. 11-inch iPad Air 128GB Wi-Fi - $499.00 ($100 off) 256GB Wi-Fi - $599.00 ($100 off) 512GB Wi-Fi - $799.00 ($100 off) 1TB Wi-Fi - $999.00 ($100 off) 13-inch iPad Air 128GB Wi-Fi - $699.00 ($100 off) 256GB Wi-Fi - $799.00 ($100 off) 512GB Wi-Fi - $999.00 ($100 off) 1TB Wi-Fi - $1,199.00 ($100 off)M4 iPad Pro Best Buy has huge discounts across the entire M4 iPad Pro lineup, with as much as $200 off these devices for Black Friday. You'll find both 11-inch and 13-inch models on sale at Best Buy, and some deals will require a My Best Buy Plus or Total membership. 11-Inch iPad Pro - Wi-Fi 256GB Wi-Fi - $849.00 ($150 off) [Best Buy members only] 512GB Wi-Fi - $1,049.00 ($150 off) [Best Buy members only] 1TB Wi-Fi - $1,399.00 ($200 off) [Best Buy members only] 1TB Wi-Fi with Nano-Texture Glass - $1,499.00 ($200 off) [Best Buy members only] 2TB Wi-Fi - $1,799.00 ($200 off) [Best Buy members only] 2TB Wi-Fi with Nano-Texture Glass - $1,899.00 ($200 off) [Best Buy members only] 11-Inch iPad Pro - Cellular 256GB Cellular - $1,049.00 ($150 off) [Best Buy members only] 512GB Cellular - $1,249.00 ($150 off) [Best Buy members only] 1TB Cellular - $1,599.00 ($200 off) [Best Buy members only] 1TB Cellular with Nano-Texture Glass - $1,699.00 ($200 off) [Best Buy members only] 2TB Cellular - $1,999.00 ($200 off) [Best Buy members only] 13-Inch iPad Pro - Wi-Fi 256GB Wi-Fi - $1,099.00 ($200 off) 512GB Wi-Fi - $1,299.00 ($200 off) 1TB Wi-Fi - $1,699.00 ($200 off) 1TB Wi-Fi with Nano-Texture Glass - $1,799.00 ($200 off) 2TB Wi-Fi - $2,099.00 ($200 off) 2TB Wi-Fi with Nano-Texture Glass - $2,199.00 ($200 off) 13-Inch iPad Pro - Cellular 256GB Cellular - $1,299.00 ($200 off) 512GB Cellular - $1,499.00 ($200 off) 1TB Cellular - $1,899.00 ($200 off) 1TB Cellular with Nano-Texture Glass - $1,999.00 ($200 off) 2TB Cellular - $2,299.00 ($200 off)Mac M4 iMac The cheapest M4 iMac available is the 8-core/16GB RAM/256GB 24-inch iMac at $1,149.99, down from $1,299.00. Similar to the other models available on sale, you'll find multiple colors at this record low price, with varying delivery estimates between each option. 8-core/16GB RAM/256GB - $1,149.00 with on-page coupon, down from $1,299.00 10-core/16GB RAM/256GB - $1,349.00 with on-page coupon, down from $1,499.00 10-core/16GB RAM/512GB - $1,549.00 with on-page coupon, down from $1,699.00 10-core/24GB RAM/512GB - $1,749.00 with on-page coupon, down from $1,899.00 MacBook Air There are a few big discounts on both the M2 and M3 MacBook Air this season, starting at just $749.00 for the entry level 16GB RAM/256GB 13-inch M2 MacBook Air, down from $999.00. The majority of MacBook Air deals will be found at Amazon in the lists below. 13-inch M2 MacBook Air 16GB RAM/256GB - $749.00 ($250 off) [matched at Best Buy] 13-inch M3 MacBook Air 16GB RAM/256GB - $844.00 ($255 off) 8GB RAM/512GB - $999.00 ($300 off) 16GB RAM/512GB - $1,049.00 ($250 off) 24GB RAM/512GB - $1,249.00 ($250 off) 15-inch M3 MacBook Air 16GB RAM/256GB - $1,044.00 ($255 off) 8GB RAM/512GB - $1,199.00 ($300 off) 16GB RAM/512GB - $1,234.00 ($265 off) 24GB RAM/512GB - $1,424.00 ($275 off) M4 MacBook Pro M4 MacBook Pro deals are in abundance on both Amazon and Best Buy this Black Friday season, with nearly every model receiving as much as $300 off. Across the board, every deal listed below is a match for the all-time low price on each model. 14-inch MacBook Pro M4 16GB RAM/512GB - $1,399.00 ($200 off) [matched at Best Buy] M4 16GB RAM/1TB - $1,599.00 ($200 off) [matched at Best Buy] M4 10-core/24GB RAM/1TB - $1,799.00 ($200 off) [matched at Best Buy] M4 Pro 12-core/24GB RAM/512GB - $1,749.00 ($250 off) M4 Pro 14-core/24GB RAM/1TB - $2,099.00 ($300 off) [matched at Best Buy] M4 Max 14-core/36GB RAM/1TB - $2,899.00 ($300 off) [matched at Best Buy] 16-inch MacBook Pro M4 Pro 24GB RAM/512GB - $2,199.00 ($300 off) [matched at Best Buy] M4 Pro 48GB RAM/512GB - $2,599.00 ($300 off) [matched at Best Buy] M4 Max 36GB RAM/1TB - $3,199.00 ($300 off) [matched at Best Buy] M4 Max 48GB RAM/1TB - $3,699.00 ($300 off) [matched at Best Buy] Apple Watch Apple Watch Series 10 Apple Watch Series 10 has hit new all-time low prices for both 42mm and 46mm GPS models, with $70 off available for both on Amazon. $70 OFFApple Watch Series 10 (42mm GPS) for $329.00 $70 OFFApple Watch Series 10 (46mm GPS) for $359.00 Apple Watch SE Apple's 40mm GPS Apple Watch SE is available for $149.00 today on Amazon, down from $249.00. This is a new record low price on the wearable. This deal is available in all three aluminum color options, and only Amazon has the discount. $100 OFFApple Watch SE (40mm GPS) for $149.00 $100 OFFApple Watch SE (44mm GPS) for $179.00 You can also get the 44mm GPS Apple Watch SE on sale right now, available for $179.00 on Amazon, down from $279.00. This is another all-time low price on the Apple Watch SE. Apple Watch Ultra 2 Continuing the trend of new record low prices for Black Friday, Amazon has the Black Apple Watch Ultra 2 for $719.00 in multiple band styles and sizes, down from $799.00. $80 OFFApple Watch Ultra 2 (Black) for $719.00 Accessories AirTag The year's best prices on AirTag are available right now at Amazon, including $72.99 for the 4-Pack. $26 OFFAirTag 4-Pack for $72.99 Studio Display Big discounts on the Apple Studio Display have returned for Black Friday 2024, and you can get the model with Standard Glass at just $1,299.99, down from $1,599.00. $299 OFFStudio Display (Standard Glass) for $1,299.99 $299 OFFStudio Display (Nano-Texture Glass) for $1,599.99 Magic Keyboard Moving to the new 2024 Magic Keyboards, you can get the 11-inch model in Black for $249.99 >, down from $299.00. This is a new all-time low price on this version of the accessory, and it beats the previous deal price by about $10. Amazon also has the 13-inch M4 iPad Pro Magic Keyboard on sale, available for $274.99 in White, down from $349.00. This is another record low price on the Magic Keyboard. $49 OFF11-inch M4 iPad Pro Magic Keyboard for $249.99 $74 OFF13-inch M4 iPad Pro Magic Keyboard for $274.99 Apple Pencil Amazon has the Apple Pencil 2 for the all-time low price of $79.99 for Black Friday, and the Apple Pencil 1 with USB-C adapter at a record-low price of $59.00. $49 OFFApple Pencil 2 for $79.99 $40 OFFApple Pencil 1 for $59.00 More Black Friday Sales Streaming Services Anker Beats Sonos Samsung Adobe We're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundups: Apple Black Friday, Apple DealsRelated Forum: Community DiscussionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Get the 10th Gen iPad for Just $249.99 for Black Friday
Black Friday deals are rolling in today, and one of the all-around best is on Apple's 10th generation iPad. You can get the entry-level 64GB Wi-Fi model for $249.99 with an on-page coupon, which is $99 off the original price and an all-time low price. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. This sale is available in the Blue and Silver colors, while Pink and Yellow are currently sitting at solid second-best prices of $259.00. If you want the all-time low price, remember you'll have to clip the on-page coupon worth $9.01 in order to see the final sale price at checkout. Note: You won't see the deal price until checkout. $99 OFF10th Gen iPad (64GB Wi-Fi) for $249.99 $89 OFF10th Gen iPad (256GB Wi-Fi) for $409.99 Amazon also has the 256GB Wi-Fi model for the record low price of $409.99 in three colors, down from $499.00. If you're shopping for the cellular tablets, both Amazon and Best Buy are providing the year's best prices on these tablets. Apple's 10th generation iPad might not be the most powerful of the lineup, but the A14 Bionic chip is more than powerful enough for daily Internet browsing, streaming content, and checking email. If you want to save even more money, and you're okay with an older iPad, the 9th gen model is just $199.99 for Black Friday. You can find all the Apple Black Friday Deals currently available in our dedicated post. For everything else, we're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Black Friday Accessory Sales Include Apple Pencil Pro for $94.99, AirTag 4-Pack for $72.99, and More
Black Friday is tomorrow, and big discounts are in full swing across the Internet and in select retail locations. In this article, we're focusing on Apple accessories like the Apple Pencil, AirTag, iPhone 16 cases, MagSafe chargers, and more. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Apple Pencil In regards to the Apple Pencil Pro, Amazon today has the accessory for $94.99, down from $129.00. This is the first time in a few weeks that we're seeing any discount on the accessory, and it's an overall second-best price. Amazon also has a new low price on the Apple Pencil 2, available for $79.99, down from $129.00. $34 OFFApple Pencil Pro for $94.99 $49 OFFApple Pencil 2 for $79.99AirTag If you're shopping for AirTag, Amazon has the 4-pack at a solid price of $72.99 for Black Friday, down from $99.00. This is just about $3 higher compared to the all-time low price. $26 OFFAirTag 4-Pack for $72.99 iPad Pro Magic Keyboards Moving to the new 2024 iPad Pro Magic Keyboards, you can get the 11-inch model in Black for $249.99, down from $299.00. This is a new all-time low price on this version of the accessory, and it beats the previous deal price by about $10. Amazon also has the 13-inch M4 iPad Pro Magic Keyboard on sale, available for $274.99 in White, down from $349.00. This is another record low price on the Magic Keyboard. $49 OFF11-inch M4 iPad Pro Magic Keyboard for $249.99 $74 OFF13-inch M4 iPad Pro Magic Keyboard for $274.99 MagSafe Charger Amazon has the 1-meter MagSafe Charger for $29.00 and 2-meter model for $34.99, both $10 off and all-time low prices. $10 OFF1-meter MagSafe Charger for $29.00 $14 OFF2-meter MagSafe Charger for $34.99 The new MagSafe Chargers provide overall faster charging speeds with compatible iPhone models. When paired with a 30W power adapter, iPhone 16 models can charge at up to 25W wirelessly over MagSafe, which is 10W faster than a regular non-MagSafe Qi2 wireless charger. iPhone 16 Cases Lastly, Amazon has quite a few discounts on Apple's official MagSafe cases for the iPhone 16 and iPhone 16 Pro. You can find every case listed below by model, and many are seeing multiple colors hitting record low prices. iPhone 16 Clear Case - $37.00, down from $49.00 Silicone Case - $22.00, down from $49.00 iPhone 16 Plus Clear Case - $34.00, down from $49.00 Silicone Case - $22.00, down from $49.00 iPhone 16 Pro Clear Case - $34.00, down from $49.00 Silicone Case - $34.00, down from $49.00 iPhone 16 Pro Max Clear Case - $37.00, down from $49.00 Silicone Case - $37.00, down from $49.00 You can find all the Apple Black Friday Deals currently available in our dedicated post. For everything else, we're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Apple Store Will Go Down Soon, But Don't Get Too Excited
Today and into tomorrow, Apple's online store is going down for a few hours on a rolling country-by-country basis. However, while that sometimes signals that new products are incoming, do not get your hopes up this time around. Apple takes its online store down for a few hours ahead of Black Friday every year to tease/prepare for its annual gift card offer with the purchase of select products. As of writing, the store already went down and came back online in countries such as Australia and New Zealand, and the gift card offer is now live there. No other surprises. Every year around this time, we receive many emails from readers alerting us about the store going down, so hopefully this helps to clear up the situation ahead of it going down across Europe, the U.S., and Canada soon. In case you missed the earlier announcement, Apple is offering a free gift card with the purchase of an eligible product in select countries, from November 29 through December 2. In the U.S., the gift card values range between $25 and $200. Black Friday is one of the few occasions per year when Apple directly offers deals on its products, but better deals are often available through resellers like Amazon, so make sure to check out our Black Friday deals coverage for the latest discounts on iPads, Macs, AirPods, Apple Watches, accessories, and more.Tags: Apple Store, Black FridayRelated Forum: Community DiscussionThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Here is Apple's Annual Holiday Season Ad
Apple today shared its annual holiday season ad. The video is titled "Heartstrings" and highlights the new hearing aid feature on AirPods Pro 2. "For so many of us, sound and how we hear shape how we connect to the world around us," said Apple, in the video description. "Yet, people with hearing loss wait an average of 10 years before getting their hearing tested and fitted for hearing aids. Leaving millions unaware they're living with hearing loss and without the assistance they need." "Now with the world's first end-to-end hearing health experience, you have access to a Hearing Test that provides scientifically validated results within minutes and the ability to activate a clinical-grade Hearing Aid feature on your AirPods Pro 2 — right from home," added Apple.Tag: Apple AdsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iOS 18.1 and Beyond: Siri's Apple Intelligence Features
With Apple Intelligence, Apple is aiming to make Siri smarter than ever before. The personal assistant is going to be able to learn more about you, do more in apps, and hand over the reins to a smarter virtual assistant when needed. Some new ‌Siri‌ features are available now, while some won't be coming until 2025. This guide highlights everything that's new with ‌Siri‌ thanks to ‌Apple Intelligence‌. Updated Siri Design ‌Siri‌ has a refreshed design on devices that support ‌Apple Intelligence‌. Rather than the small wavelength that used to show when activating ‌Siri‌, there's now a pink/purple/blue/orange variegated glow that wraps around the entire iPhone, with the colors shifting as ‌Siri‌ listens to a command. Better Language Understanding ‌Siri‌ can better understand conversational language and requests, so if you stumble over your words or change your mind mid-sentence, ‌Siri‌ can still follow what you're saying. ‌Siri‌ is also able to maintain context between requests, so you can refer to something in a previous request, and ‌Siri‌ will understand what you're talking about. So if you use ‌Siri‌ to create a calendar event, you can then just ask "What will the weather be like there?" and ‌Siri‌ knows where "there" is. Improved Voice ‌Siri‌ has a new, more natural sounding voice. Type to Siri There is a built-in Type to ‌Siri‌ feature so you don't need to speak to ‌Siri‌ to interact with the personal assistant. To use it, double tap on the bottom of the ‌iPhone‌ or iPad to bring up a text bar, and then from there, just type in your request. Type to ‌Siri‌ can be used in the same way as speaking to ‌Siri‌, and ‌Siri‌ is able to provide information without speaking aloud. It is a useful feature for public situations where you're not able to speak and do not want to have ‌Siri‌ speaking back to you. iOS 18.1: How to Type to Siri Siri on the Mac While this guide focuses on the ‌iPhone‌ and the ‌iPad‌, the new, smarter ‌Siri‌ is also available on the Mac. Type to ‌Siri‌ can be enabled in the Settings app, and it can be assigned to a shortcut, such as pressing the Command button twice. Apple Product Knowledge Apple taught ‌Siri‌ about all of its products, so if you want to know how to use a feature or how to complete a task, you can ask ‌Siri‌ for help. ‌Siri‌ can provide step-by-step directions on using ‌iPhone‌, ‌iPad‌, and Mac features. ChatGPT Integration (iOS 18.2) In iOS 18.2, ChatGPT integration is available with ‌Siri‌. If a user asks something that ‌Siri‌ is not capable of handling, ChatGPT can provide a response instead, so long as the user gives permission. ‌Siri‌ can tap into ChatGPT, and then relay ChatGPT's response with no need to switch apps or use other tools. The ‌Siri‌ ChatGPT integration can essentially be used to do anything you can do with the ChatGPT app or ChatGPT on the web, it's simply an easier way to get to ChatGPT. Object Identification For anything on your screen, such as an image, you can ask ‌Siri‌ a question about it. If you have a photo of a plant, for example, asking "What is this?" will prompt ‌Siri‌ to send a screenshot over to ChatGPT, and ChatGPT will attempt to provide context. This works with images on the web, your photos, the something you're viewing through the Camera app, text, and more. ChatGPT can be used to describe a scene, which is useful for people who might have issues with sight. Opening the Camera app, activating ‌Siri‌, and asking "What is this?" will provide a detailed description of whatever is in front of you. The option to send images to ChatGPT from screenshots is distinct from the ‌Siri‌ onscreen awareness feature that Apple plans to implement in the future. Info From Documents For emails, documents, PDFs, and more, ChatGPT can provide a summary. When you ask "Can you summarize this?" ‌Siri‌ will send a screenshot or the entire document, which includes full PDFs. It's a useful feature for getting a quick overview of the content of a long document. For long PDFs or documents, you'll want to tap on the arrows to make sure the full document is sent to ChatGPT rather than just a screenshot. Rather than asking for a summary, you can instead ask a specific question about a document. If you're looking at an insurance policy, you can ask "What are the limits of this policy?" or "What are the exclusions?" to get more tailored information. Checking Spelling and Grammar If you've written an email, rather than selecting it and using Writing Tools to check it for spelling and grammar errors, you can ask ‌Siri‌ to take a look, and ‌Siri‌ will send a screenshot to ChatGPT. "Can you look this over for errors?" works as a command for this feature. ChatGPT can also be used for rewriting and refining what you've written, but note that this is not the same as Apple's own Writing Tools. Generating Text and Images ChatGPT can generate text from scratch based on prompts that it is given. You can, for example, ask ‌Siri‌ to ask ChatGPT to write a poem or compose a polite letter to a friend, and ChatGPT will create something from scratch. Some sample requests you can use: Write me a poem about Apple Create a song about Google Help me write a letter to my friend Write three paragraphs about orange cats Write me a social media post about Thanksgiving Rewrite this to be more concise Create a bedtime story about a dragon If you have ChatGPT write something for you, you can tap on the copy icon to copy it to the clipboard to paste it into Notes, Messages, a document, or an email. You can also create images. Using the Dall-E 3 engine, ChatGPT can make realistic AI-generated images, something that can't be done with ‌Apple Intelligence‌. For image requests, it's easiest to tell ‌Siri‌ to "Tell ChatGPT to make an image of [thing you want an image of]," because if you just ask ‌Siri‌ to make an image or generate an image, it will often bring up web images. Answering Questions One of the best use cases for ChatGPT through ‌Siri‌ is getting answers for queries that are just a bit too complex for ‌Siri‌. Questions that ‌Siri‌ can't handle will be handed over to ChatGPT with your permission, but you can also force ‌Siri‌ to use ChatGPT instead of the internal ‌Siri‌ engine by amending questions with "Ask ChatGPT." For example, a question about what battery an Xbox controller uses will source Wikipedia and not ChatGPT, but specifically "Ask ChatGPT what battery an Xbox controller uses" will prompt ‌Siri‌ to present the question to ChatGPT. ChatGPT's answers can sometimes be more informative. Asking ‌Siri‌ how to replace eggs in a recipe just gives you alternatives, but ChatGPT's answer for the same question provides the amount of an ingredient you might want to add to equate to an egg. Some example queries that ‌Siri‌ will automatically consult ChatGPT on: What are five types of edible mushrooms in North Carolina? What should I pack for a beach trip in winter? What are must see places in Paris? What should I do this weekend? I want a recipe for banana bread Give me instructions on cutting a mango When is avocado season? Suggest good songs for a quiet Friday night What's a good indoor activity to do when it's raining? Other Things You Can Ask ChatGPT To Do Write code Debug code Get help with homework Do calculations, translations, conversions, and more Generate gift ideas Come up with names for businesses, pets, characters, and more Create trivia questions or riddles Plan trips Create meal plans Get recipes for ingredients you have Generate jokes Suggest movies, TV shows, and books based on specific parameters Summarize TV shows and movies Generate drawing/writing prompts While ‌Siri‌ can do all of these things with ChatGPT's help, the lack of continuity with the ‌Siri‌ version of ChatGPT makes it difficult to complete tasks that are not one-off requests. Creating a meal plan, for example, works better with the actual ChatGPT interface because you can have more of a conversation rather than relying on a single request. ChatGPT Settings and Privacy ChatGPT integration has to be turned on, and after that, each request requires user permission. There is an option to turn off the extra permission by toggling off the "Confirm ChatGPT Requests" option. The toggle can be accessed by opening up the Settings app, choosing ‌Apple Intelligence‌, and then tapping on ChatGPT. With the feature disabled, ‌Siri‌ will not ask each time before sending information to ChatGPT. ‌Siri‌ will, however, always ask permission before sending a file to ChatGPT even with the confirm requests feature turned off. As for privacy, no login is required to use ChatGPT, and neither Apple nor OpenAI log your requests. But if you sign in with a paid account, ChatGPT can keep a copy of requests. ChatGPT - Free vs. Paid ChatGPT integration includes a limited number of requests that use ChatGPT-4o, the latest version of ChatGPT, for free. After those are used up, ChatGPT integration uses 4o Mini, which is less advanced and takes up less resources. ChatGPT Plus subscribers get more ChatGPT-4o requests. ChatGPT Plus is priced at $20 per month, and ‌iPhone‌ users who don't already have ChatGPT Plus can sign up right from the ‌Apple Intelligence‌ section of the Settings app. Apple users essentially have access to ChatGPT's basic plan, so requests that use advanced capabilities reset every 24 hours. With this plan, two images per day can be generated. ChatGPT vs. Apple Intelligence There is overlap between what's possible with ‌Apple Intelligence‌ and what you can do with ChatGPT integration, but there are some distinctions. ‌Apple Intelligence‌ has Writing Tools for rewriting and editing what you've already written, but ChatGPT can write content from scratch. Image Playground, Image Wand, and Genmoji allow you to generate images, but ‌Apple Intelligence‌ won't generate realistic looking images. Instead, styles are limited to those that look animated or sketched. ChatGPT will generate lifelike images, though. ‌Apple Intelligence‌ can be used to summarize documents, but only when you select text and select the Summarize option from Writing Tools. ‌Apple Intelligence‌ can't answer more specific questions about PDFs and documents, so ChatGPT does have an edge for that kind of query. ChatGPT Limitations When you ask ChatGPT a question through ‌Siri‌, you need to make sure to read the answer right away because it doesn't stay on the screen long. Apple does not keep a record of it, either. If you're logged into ChatGPT, there is a history in your OpenAI account, but if you're not logged in, there's no way to save information that you've received from ChatGPT, and there's no log. Other Chatbots Apple has only added ChatGPT integration right now, but support for Google Gemini is planned in the future. Siri Apple Intelligence Features Coming Next Year There are several ‌Siri‌ features that are still in development, with Apple planning to add these capabilities to ‌Siri‌ next year. Timing isn't concrete yet, but rumors suggest we'll see them in iOS 18.4 in the spring. Personal Context ‌Siri‌ will be able to keep track of your emails, messages, files, photos, and more, learning more about you to help you complete tasks and keep track of what you've been sent. Show me the files Eric sent me last week. Find the email where Eric mentioned ice skating. Find the books that Eric recommended to me. Where's the recipe that Eric sent me? What's my passport number? Onscreen Awareness ‌Siri‌ will be able to tell what's on your screen and complete actions involving whatever you're looking at. If someone texts you an address, for example, you can tell ‌Siri‌ to add it to their contact card. Or if you're looking at a photo and want to send it to someone, you can ask ‌Siri‌ to do it for you. Deeper App Integration ‌Siri‌ will be able to do more in and across apps, performing actions and completing tasks that are just not possible with the personal assistant right now. We don't have a full picture of what ‌Siri‌ will be capable of, but Apple has provided a few examples of what to expect. Moving files from one app to another. Editing a photo and then sending it to someone. Get directions home and share the ETA with Eric. Send the email I drafted to Eric. The Next Siri Phase After all of the ‌Siri‌ ‌Apple Intelligence‌ features have been implemented in iOS 18, Apple plans to unveil the next-generation ‌Siri‌, which will rely on large language models. An LLM version of ‌Siri‌ is already in development, and it will be able to better compete with chatbots like ChatGPT. LLM ‌Siri‌ will be able to hold ongoing conversations, and it will be more like speaking with a human. Large language model integration will let ‌Siri‌ perform more complex tasks, and in the future, ‌Siri‌ likely won't need to rely on ChatGPT. The updated version of ‌Siri‌ will replace the current version of ‌Siri‌ in the future. Apple is expected to announce LLM ‌Siri‌ in 2025 alongside the introduction of iOS 19, but the update likely won't launch until spring 2026. Apple Intelligence Privacy ‌Apple Intelligence‌ was designed with privacy in mind, and many requests are handled on-device. All personal context learning, for example, is done with on-device intelligence and nothing leaves your ‌iPhone‌ or ‌iPad‌. For requests that need the processing power of a cloud server, Apple is using Private Cloud Compute on Apple silicon machines to handle complex tasks while preserving user privacy. Apple promises that data is not stored and is used only for user requests. Apple Intelligence Compatible Devices ‌Apple Intelligence‌ is available on the iPhone 15 Pro, the ‌iPhone 15‌ Pro Max, all iPhone 16 models, the iPad mini with A17 Pro chip, all iPads with an Apple silicon chip, and all Macs with an Apple silicon chip. Read More We've shared detailed guides on ‌Genmoji‌ and ‌Image Playground‌ already, plus we have an overall guide on the full set of ‌Apple Intelligence‌ features and a guide for the general features coming in iOS 18.2. Genmoji in iOS 18.2 Image Playground in iOS 18.2 Apple Intelligence Image Wand: All the New Features in iOS 18.2 Everything You Need to Know About Apple Intelligence Everything New in the iOS 18.2 Beta Release Date iOS 18.2 and iPadOS 18.2 with ‌Image Wand‌ integration will be coming in December, with Apple likely planning for a December 9 software release.Related Roundups: iOS 18, iPadOS 18Related Forums: iOS 18, iPadOS 18This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Video Review: A Month With the iPad Mini 7
It's been just over a month since Apple released the iPad mini 7, refreshing its smallest tablet with a new Apple Intelligence-capable A17 Pro chip. MacRumors videographer Dan Barbera has been using the ‌iPad mini 7‌ as a replacement for the iPad Pro for the last several weeks, and he has some thoughts to share on Apple's latest iPad. Subscribe to the MacRumors YouTube channel for more videos. For a travel companion alongside a MacBook Pro or a MacBook Air, the 8.3-inch iPad mini is the ideal size. It fits well into a bag, but in a pinch, it also tucks into a coat pocket. On a flight, it's a good size for content consumption like watching movies or TV shows, but it's a hard to get work done on such a small screen. Apple doesn't make a small keyboard for the ‌iPad mini‌, so unless you have a third-party accessory like a Bluetooth keyboard, typing needs to be done with the on-display keyboard. Adding a keyboard does help the situation, but you're still working with a smaller-sized display. For playing games, using social media apps, checking email, and browsing the web, the ‌iPad mini‌ is perfect. The A17 Pro chip means that it's ideal for any mobile game you want to play, and even though the small screen might be a downside, it's powerful enough for Final Cut Pro. The A17 Pro supports Apple Intelligence, plus there's 8GB RAM, so you get all of the latest AI features. With support for the Apple Pencil Pro, note taking, drawing, and sketching are great on the ‌iPad mini 7‌. The ‌iPad mini‌ is essentially almost as powerful as Apple's other, larger iPads, and it is just as capable, so there's little compromise other than screen size when choosing it. It's a great travel companion and daily use tablet, but it might be frustrating if you need something to use to get work done.Related Roundup: iPad miniBuyer's Guide: iPad Mini (Buy Now)Related Forum: iPadThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iPhone 17 Pro Already Rumored to Have These 8 New Features
While the iPhone 17 Pro and iPhone 17 Pro Max are not expected to launch for 10 more months, there are already plenty of rumors about the devices. Below, we recap key changes rumored for the iPhone 17 Pro models so far: Aluminum frame: iPhone 17 Pro models are rumored to have an aluminum frame, whereas the iPhone 15 Pro and iPhone 16 Pro models have a titanium frame, and the iPhone X through iPhone 14 Pro have a stainless steel frame. The back of the devices will supposedly have a new "part-aluminum, part-glass" design. Rectangular camera bump: On a related note, the devices are expected to have a "larger rectangular camera bump" made of aluminum. A19 Pro chip: iPhone 17 Pro models are expected to use Apple's next-generation A19 Pro chip, which will reportedly be manufactured with TSMC's newer third-generation 3nm process. Like usual, expect modest year-over-year performance gains and power efficiency improvements compared to the current iPhones. Apple-designed Wi-Fi 7 chip: At least one iPhone 17 model is rumored to get a Wi-Fi 7 chip designed by Apple rather than Broadcom. 24-megapixel front camera: All four iPhone 17 models are said to feature an upgraded 24-megapixel front-facing camera, whereas all iPhone 16 models are equipped with a 12-megapixel front-facing camera. 48-megapixel rear Telephoto camera: An upgraded 48-megapixel Telephoto camera is rumored for the iPhone 17 Pro models, up from the 12-megapixel Telephoto camera on iPhone 16 Pro models. 12GB of RAM: An increased 12GB of RAM was initially rumored exclusively for the iPhone 17 Pro Max, but later the iPhone 17 Pro as well. This upgrade should help to improve the performance of Apple Intelligence and multitasking. All four iPhone 16 models have 8GB of RAM. A smaller Dynamic Island for iPhone 17 Pro Max: A change rumored exclusively for the iPhone 17 Pro Max is a "much narrowed Dynamic Island," as a result of Apple adopting a "metalens" for the Face ID system.Bookmark our iPhone 17 roundup to stay up to date with more rumors over the coming months.Related Roundup: iPhone 17This article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

AirPods Pro 2 Get Massive $95 Discount for Black Friday, Available For Just $153.99
Black Friday is just two days away, and Amazon has one of the best deals of the year available to purchase right now. You can get the AirPods Pro 2 (USB-C) for just $153.99, down from $249.00. Note: MacRumors is an affiliate partner with Amazon. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. This sale beats the previous all-time low price by nearly $40 and is overall one of the best deals we're tracking for Black Friday 2024. The AirPods Pro 2 were updated in 2023 with USB-C, and also feature Active Noise Cancellation, Apple's H2 chip, and Spatial Audio. $95 OFFAirPods Pro 2 for $153.99 You can find all the Apple Black Friday Deals currently available in our dedicated post. For everything else, we're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Is the HomePod Mini a Good Gift Still? Here's What to Consider
At $99 in the U.S., the HomePod mini is a more affordable gift option for Apple enthusiasts. However, the speaker was released just over four years ago, so you may be wondering if it is still worth purchasing or if you should hold off. Below, we outline three things to take into consideration. First, there have been rumors about a HomePod mini 2, but none of them are recent. The firmest rumor came from Apple analyst Ming-Chi Kuo. Back in February 2023, he said mass shipments of a new HomePod mini would begin in the second half of 2024. However, heading into the final month of the year, it is unclear if that production has actually started or if it will soon. There has been no talk about a HomePod mini 2 being imminent, so a launch seems unlikely until 2025 at the earliest, barring a surprise announcement. Kuo did not reveal any new features planned for the next HomePod mini, but potential upgrades could include a newer chip for improved audio, a second-generation Ultra Wideband chip for a lower-latency Handoff experience, and new color options. The current HomePod mini is equipped with an S5 chip and a U1 chip. While the HomePod mini has received no major hardware upgrades since it was released in November 2020, Apple has refreshed its color options a few times. The speaker was released in Blue, Orange, and Yellow in November 2021, and Space Gray was replaced with a virtually-identical Midnight finish in July of this year. The second thing to take into consideration is that Apple reportedly plans to release an all-new smart home hub as early as March 2025. The hub is expected to feature around a 6-inch display that can be attached to a tabletop base with a speaker, so the device could essentially be a more useful alternative to the HomePod mini. It has been predicted that the hub could be priced in the $199 to $299 range, so an Apple gift card that someone could use towards that device next year is another idea to consider. Third, Siri is widely considered to be an inferior digital assistant compared to the likes of Amazon's Alexa and Google's Assistant. It's something to keep in mind depending on how much your giftee plans to use voice commands. If you do go ahead with gifting a HomePod mini this year, that is a fine choice too. The speaker is a bit outdated now, but it remains an adequate speaker for its price, and it will continue to serve its purpose for several years.Related Roundup: HomePod miniBuyer's Guide: HomePod Mini (Caution)Related Forum: HomePod, HomeKit, CarPlay, Home & Auto TechnologyThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Here's How the Apple Card Savings Account's Interest Rate Compares to Major Competitors
In the U.S., the Apple Card offers a high-yield savings account option, allowing you to earn far more interest on your money compared to the average bank's basic savings account. Apple's account offers an APY of 4.1% as of writing, and while that is a competitive rate, it is not the absolute best offer available at this time. The chart below compares the Apple Card saving account's rate to some other popular high-yield savings accounts in the U.S., as of writing. Provider Maximum APY* Ally 3.85% Discover 3.9% American Express 3.9% Capital One 3.9% Citizens Bank 3.9% Apple Card Savings 4.1% Marcus by Goldman Sachs 4.1% Barclays 4.1% Synchrony 4.1% PNC Bank 4.15% SoFi 4.2% Betterment 4.25% Wealthfront 4.25% UFB Direct 4.31% Fierce 4.5% CIT Bank 4.55% (on $5,000+) * Advertised APYs as of November 27, 2024, excluding promotional rates and affiliate bonuses. Minimum balance requirements and other conditions vary per account. APYs can change at any time, so we cannot guarantee the accuracy of the rates listed above. Apple launched its savings account in April 2023, in partnership with Goldman Sachs. The account can be opened and managed in the Wallet app on the iPhone, and it has no fees, no minimum deposits, and no minimum balance requirements. You must have an Apple Card, be a U.S. resident, and be at least 18 years old to open an account. The account allows Apple Card holders to earn interest on their Daily Cash cashback balance, and on funds deposited via a linked bank account or an Apple Cash balance. The maximum balance allowed is now $1 million, up from $250,000. When the account first became available, Apple and Goldman Sachs offered an APY of 4.15%, but the rate has fluctuated in line with U.S. Federal Reserve benchmark rate changes. The rate increased three times, reaching a peak of 4.5% in early 2024, but it has since been cut three times and has stood at 4.1% since early October. Apple has yet to change the rate after the Federal Reserve's latest rate cut in early November. To open a savings account in the Wallet app, tap on your Apple Card, tap on the circle with three dots at the top of the screen, tap Daily Cash, and select Set Up Savings. Goldman Sachs reportedly plans to end its consumer lending partnership with Apple, but it is unclear if this will have any impact on Apple Card holders. JPMorgan, owner of Chase Bank, reportedly could take over as Apple's financial partner.Tag: Apple CardThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Black Friday Streaming Deals Include Big Savings on Disney+, Hulu, Paramount+, and Peacock
We've been focusing on deals on physical products over the past few weeks, but Black Friday is also a great time of year to purchase a streaming membership. Some of the biggest services have great discounts for new and select returning members this week, including Disney+, Hulu, Paramount+, and Peacock. Note: MacRumors is an affiliate partner with some of these vendors. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. Disney+ and Hulu Starting with the Disney+ and Hulu bundle, you can get Hulu (with ads) and Disney+ (with ads) for $2.99 per month for an entire year, down from the regular $10.99 per month price. This offer is valid for new and eligible returning Hulu/Disney+ subscribers. 72% OFF PER MONTHDisney+ and Hulu Bundle for $2.99/month As usual, this offer will revert to the regular $10.99 per month price (or then-current regular monthly price) at the end of your first year. Shoppers have until 11:59 p.m. PST on December 2 to take advantage of this offer. Additionally, if you just want Hulu (with ads), you can get it for $0.99 per month for a year, down from $9.99 per month. Paramount+ You can get either Paramount+ Essential or Paramount+ with Showtime for $2.99 per month for your first two months this Black Friday. Paramount+ Essential is typically priced at $7.99 per month, while Paramount+ with Showtime is typically priced at $12.99 per month. UP TO 76% OFFParamount+ for $2.99/month Shoppers should remember that this deal is only for the first two months of your Paramount+ subscription, and after that period it will return to its regular pricing structure. Paramount+ is only focusing on monthly plans this Black Friday, and there are no deals on annual plans. Peacock Peacock has one of the best all-around streaming deals this week. You can get a full year of Peacock (premium annual plan) for $19.99, down from $79.99. You can also opt to pay $1.99 per month for six months. This plan includes ads. 75% OFFPeacock for $19.99/year This sale will run through December 2, and is available to new and select returning customers. You can find all the Apple Black Friday Deals currently available in our dedicated post. For everything else, we're keeping track of all of the season's best Apple-related deals in our Black Friday roundup, so be sure to check back throughout the month for an updated list of all the most notable discounts you'll find for Black Friday 2024. Deals Newsletter Interested in hearing more about top deals as we head into the holidays? Sign up for our Deals Newsletter and we'll keep you updated so you don't miss the biggest deals of the season! Related Roundup: Apple DealsThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Do More Single-Handedly With Double Tap on Apple Watch
Apple Watch Series 9, Series 10, and Apple Watch Ultra 2 models include a multi-functional Double Tap gesture that you might not know about or haven't yet got around to trying. Here's everything Double Tap can do, and how you can make the most of it on your Apple Watch. Double Tap is a gesture-based feature for Apple Watch models that lets you control watch functions by tapping your thumb and index finger together twice. The feature aims to make it easier to navigate the Apple Watch when you have only one hand free, like when you're walking a dog, carrying groceries, or holding a cup of coffee. What Double Tap Can Do Double Tap's functionality is pretty simple. You raise your watch to wake, and then you double tap your thumb and index finger together to control what's happening on the screen of your watch. By default, Double Tap selects the primary button in whatever app you're in. So for example, if you get a call, you can double tap to answer, and use it to hang up when you're done. Likewise, if you're watching/listening to media, you can pause it and resume it (or skip). You can also use the gesture from your Apple Watch face to navigate through your Smart Stack, widget by widget. Some other use cases: If you've set a timer, double-tapping will pause it. Performing the gesture again will resume the countdown, and when the timer goes off, a double-tap will stop it. Similarly, you can use it to do other everyday things like snooze alarms, trigger the Camera Remote app's shutter button, and dismiss notifications. As you might expect, the gesture is also set up to assume your other hand is preoccupied. If you receive a text, for instance, a double tap lets you reply with a voice message, while another double tap sends the message. Here's a rundown of everything you can do with Double Tap: Open the Smart Stack from the watch face, and then Double Tap again to scroll through widgets one by one. Answer phone or FaceTime calls. Hang up phone or FaceTime calls. When you get an iMessage, Double Tap to view it, and then Double Tap again if you need to scroll. Reply to a Message using dictation and then send it with Double Tap. Act on notifications - Apple says a Double Tap on an incoming notification will activate the primary action, such as snoozing a reminder or replying to a message. Pause, resume, and end a timer. Stop and resume the stopwatch. Snooze an alarm. Play and pause music, podcasts, or audiobooks (or skip a track, depending on settings). Change to the Elevation view in the Compass app. Start or stop automatic Workout reminders when a workout is detected. Take a photo with the Camera Remote. Record a voice memo in the Voice Memo app. Change Flashlight modes. In the Apple Watch Settings app, under Gestures, you can opt to change the playback option from play/pause to skip, and the Smart Stack option from Advance (swaps through the widgets) to Select (opens a widget's associated app). If you have Apple Vision Pro, you'll also find an option to ignore double tap gestures when you're wearing the headset. How to Set Up Double Tap Double Tap is disabled by default, so you will need to enable it manually for it to work. This can be done from your wrist or in the Watch app on iPhone, and both menus include options to customize Media Playback and Smart Stack functionality. Note that to enable Double Tap, setup involves giving watchOS permission to disable some Accessibility options, including Assistive Touch, Zoom with Hand Gestures, VoiceOver with Hand Gestures, and Quick Actions. On Apple Watch: Open the Settings app. Tap Gestures. Tap Double Tap, then toggle on the switch next to Double Tap on the next screen. If prompted, tap Turn off Accessibility Features at the bottom of the on-screen alert. Choose your preferred setting for "Playback" (Play/Pause or Skip) and "Smart Stack" (Advance or Select). On iPhone: Open the Watch app. With the "My Watch" tab selected, tap Gestures. Tap Double Tap, then toggle on the switch next to Double Tap on the next screen. If prompted, tap Turn off Accessibility Features in the on-screen alert. Choose your preferred setting for "Playback" (Play/Pause or Skip) and "Smart Stack" (Advance or Select). Apple says Double Tap is enabled by the S9 chip's faster Neural Engine, which is why the feature is only available on the Series 9 and later and the Ultra 2. Apple said it developed an algorithm that detects the "unique signature" of tiny wrist movements and changes in blood flow when the index finger and thumb are tapped together. How to Use Hand Gestures to Control Your Apple Watch If you own an earlier Apple Watch model that doesn't support Double Tap, you can always try a similar but more limited accessibility feature called AssistiveTouch, which is available on the Apple Watch Series 4 and newer.Tag: Double TapThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

iPhone Sales Stall Despite Global Smartphone Market Recovery
Apple experienced minimal iPhone growth in 2024 despite a significant rebound in the global smartphone market, according to new data published by IDC. Worldwide smartphone shipments increased 6.2% to reach 1.24 billion units, but iPhone shipments grew by just 0.4% during the same period. The tepid performance underlines Apple's challenges in key markets like China, where domestic rivals are gaining ground through aggressive pricing and technological innovation. Chinese manufacturers like Xiaomi and Huawei are investing heavily in hardware and software development as well as custom processor designs, with Huawei recently launching its new Mate 70 phone featuring its own home-grown chips. Elsewhere, Android device makers collectively drove the market's recovery, achieving 7.6% growth mostly through strong performance in emerging markets across Asia Pacific, Latin America, the Middle East, and Africa. These manufacturers appear to have succeeded by offering more affordable devices, with an average selling price of $295 compared to Apple's $1,000-plus premium iPhone positioning. Despite the slower growth, Apple maintained its position as the industry's profit leader through its premium pricing strategy. According to IDC, the Apple's prospects may improve in 2025, with a forecast of 3.1% growth for iOS devices compared to 1.7% for Android smartphones. Overall, the broader smartphone market's recovery was driven by pent-up demand for device upgrades in regions with lower smartphone penetration. However, IDC analysts noted that even heavily marketed features like generative AI have failed to significantly impact consumer demand or drive early upgrades, which doesn't bode well for the impact of Apple Intelligence on iPhone sales going into 2025.Tag: IDCThis article, "" first appeared on MacRumors.comDiscuss this article in our forums

Read more »

Introducing Copilot Actions, new agents, and tools to empower IT teams
Microsoft 365 Copilot is becoming a daily habit for people around the world—already, nearly 70% of Fortune 500 companies are using it. Dow anticipates that Copilot will save it millions of dollars on shipping operations in the first year; at Bank of Queensland Group, 70% of users are saving two and a half to five hours per week; Eaton is speeding up internal documentation processes by 83%; and Accenture is going big, rolling out Copilot to 100,000 employees. The post appeared first on Microsoft 365 Blog.

Read more »

Price and tax updates for apps, In-App Purchases, and subscriptions
The App Store is designed to make it easy to sell your digital goods and services globally, with support for 44 currencies across 175 storefronts.From time to time, we may need to adjust prices or your proceeds due to changes in tax regulations or foreign exchange rates. These adjustments are made using publicly available exchange rate information from financial data providers to help make sure prices for apps and In-App Purchases stay consistent across all storefronts. Tax updates as of October:Your proceeds from the sale of eligible apps and In‑App Purchases have been increased in: Nepal: Apple no longer remits Nepal value-added tax (VAT) for local developers and proceeds were increased accordingly. Kazakhstan: Apple no longer remits Kazakstan VAT for local developers and proceeds were increased accordingly. Madeira: Decrease of the Madeira VAT rate from 5% to 4% for news publications, magazines and other periodicals, books, and audiobooks. Exhibit B of the Paid Applications Agreement has been updated to indicate that Apple will not remit VAT in Nepal and Kazakhstan for local developers.Learn more about your proceedsView payments and proceedsDownload financial reportsPrice updates as of December 2: Pricing for apps and In-App Purchases will be updated for the Japan and Türkiye storefronts if you haven’t selected one of these as the base for your app or In‑App Purchases. If you’ve selected the Japan or Türkiye storefront as the base for your app or In-App Purchase, prices won’t change. On other storefronts, prices will be updated to maintain equalization with your chosen base price.Prices won’t change in any region if your In‑App Purchase is an auto‑renewable subscription and won’t change on the storefronts where you manually manage prices instead of using the automated equalized prices.The Pricing and Availability section of Apps has been updated in App Store Connect to display these upcoming price changes. As always, you can change the prices of your apps, In‑App Purchases, and auto‑renewable subscriptions at any time.Learn more about managing your pricesView or edit upcoming price changesEdit your app’s base country or regionPricing and availability start times by country or regionSet a price for an In-App Purchase

Read more »

The latest on AI at work: November 2024
For Microsoft and our customers, work is changing at the speed of AI. To help you stay ahead, we’ll share monthly highlights of new Microsoft Copilot innovations, plus the latest from our customers on how they’re getting the most value from Copilot. The post appeared first on Microsoft 365 Blog.

Read more »

Hacker in Snowflake Extortions May Be a U.S. Soldier
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect -- a prolific hacker known as Kiberphant0m -- remains at large and continues to publicly extort victims. However, this person's identity may not remain a secret for long: A careful review of Kiberphant0m's daily chats across multiple cybercrime personas suggests they are a U.S. Army soldier who is or was recently stationed in South Korea.

Read more »

Feds Charge Five Men in ‘Scattered Spider’ Roundup
Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio.

Read more »

Fintech Giant Finastra Investigating Data Breach
The financial technology firm Finastra is investigating the alleged large-scale theft of information from its internal file transfer platform, KrebsOnSecurity has learned. Finastra, which provides software and services to 45 of the world's top 50 banks, notified customers of a potential breach after a cybercriminal began selling more than 400 gigabytes of data purportedly stolen from the company. 

Read more »

Vulnerability Summary for the Week of November 11, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info 1000 Projects--Beauty Parlour Management System  A vulnerability was found in 1000 Projects Beauty Parlour Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 7.3 CVE-2024-11100 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical has been found in 1000 Projects Beauty Parlour Management System 1.0. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11257 1000 Projects--Beauty Parlour Management System  A vulnerability classified as critical was found in 1000 Projects Beauty Parlour Management System 1.0. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11258 1000 Projects--Portfolio Management System MCA  A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11256 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47441 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47442 adobe -- after_effects  After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47443 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-45114 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47450 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47451 adobe -- illustrator  Illustrator versions 28.7.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47452 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49507 adobe -- indesign  InDesign Desktop versions ID18.5.2, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49508 adobe -- indesign  InDesign Desktop versions ID18.5.3, ID19.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49509 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47426 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47427 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47428 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47429 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47430 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47431 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47432 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47433 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-47434 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49515 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49516 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49517 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49518 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49519 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49520 adobe -- substance_3d_painter  Substance3D - Painter versions 10.1.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49525 Adobe--Adobe Commerce  Adobe Commerce versions 3.2.5 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to a security feature bypass. A low privileged attacker could exploit this vulnerability to send crafted requests from the vulnerable server to internal systems, which could result in the bypassing of security measures such as firewalls. Exploitation of this issue does not require user interaction. 2024-11-12 7.7 CVE-2024-49521 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49526 Adobe--Animate  Animate versions 23.0.7, 24.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49528 Adobe--Photoshop Desktop  Photoshop Desktop versions 24.7.3, 25.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-11-12 7.8 CVE-2024-49514 adonesevangelista -- agri-trading_online_shopping_system  A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout. 2024-11-14 7.5 CVE-2024-50968 algolplus--Advanced Order Export For WooCommerce  The Advanced Order Export For WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.5.5 via deserialization of untrusted input during Order export when the "Try to convert serialized values" option is enabled. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). 2024-11-13 8.1 CVE-2024-10828 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21974 amd -- ryzen_ai_software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 7.8 CVE-2024-21975 AMD--AMD Cloud Manageability Service Software  Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21939 AMD--AMD Management Console  Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21957 AMD--AMD Management Plug-In for SCCM  Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21938 AMD--AMD Provisioning Console (APC) Software  Incorrect default permissions in the AMD Provisioning Console installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21958 AMD--AMD Ryzen AI Software  Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution. 2024-11-12 8.8 CVE-2024-21976 AMD--AMD Ryzen Master Monitoring SDK  Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21945 AMD--AMD Ryzen Master Utility for Overclocking Control  Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21946 AMD--AMD Software: PRO Edition  Incorrect default permissions in the AMD HIP SDK installation directory could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution. 2024-11-12 7.3 CVE-2024-21937 AMI--AptioV  APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode. 2024-11-12 7.2 CVE-2024-42442 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 9 CVE-2024-51490 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51484 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51485 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL?-?Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.4 CVE-2024-51486 ampache -- ampache  Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attacks, potentially enabling them to change website features that should only be managed by administrators through malicious requests. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. 2024-11-11 8.1 CVE-2024-51487 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the map_id parameter. 2024-11-13 7.2 CVE-2024-50971 angeljudesuarez -- construction_management_system  A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrow_id parameter. 2024-11-13 7.2 CVE-2024-50972 angeljudesuarez -- tailoring_management_system  A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "inccat" to be affected. But it must be assumed "desc", "date", and "amount" are affected as well. 2024-11-11 9.8 CVE-2024-11074 anisha -- job_recruitment  A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11076 anisha -- job_recruitment  A vulnerability, which was classified as critical, was found in code-projects Job Recruitment 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-11 9.8 CVE-2024-11077 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment 1.0 and classified as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 9.8 CVE-2024-11099 anisha -- job_recruitment  A vulnerability was found in code-projects Job Recruitment up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file admin.php. The manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-12 8.8 CVE-2024-11127 Anthony Carbon--WDES Responsive Mobile Menu  Deserialization of Untrusted Data vulnerability in Anthony Carbon WDES Responsive Mobile Menu allows Object Injection.This issue affects WDES Responsive Mobile Menu: from n/a through 5.3.18. 2024-11-16 9.8 CVE-2024-52414 Apache Software Foundation--Apache Airflow  Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets. 2024-11-15 7.5 CVE-2024-45784 Apache Software Foundation--Apache CloudStack  Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack 4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that can register templates, can use them to deploy malicious instances on KVM-based environments and exploit this to gain access to the host filesystems that could result in the compromise of resource integrity and confidentiality, data loss, denial of service, and availability of KVM-based infrastructure managed by CloudStack. Users are recommended to upgrade to Apache CloudStack 4.18.2.5 or 4.19.1.3, or later, which addresses this issue. Additionally, all user-registered KVM-compatible templates can be scanned and checked that they are flat files that should not be using any additional or unnecessary features. For example, operators can run the following command on their file-based primary storage(s) and inspect the output. An empty output for the disk being validated means it has no references to the host filesystems; on the other hand, if the output for the disk being validated is not empty, it might indicate a compromised disk. However, bear in mind that (i) volumes created from templates will have references for the templates at first and (ii) volumes can be consolidated while migrating, losing their references to the templates. Therefore, the command execution for the primary storages can show both false positives and false negatives. for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info. If the output is not empty, that might indicate a compromised disk; check it carefully."; qemu-img info -U $file | grep file: ; printf "nn"; doneFor checking the whole template/volume features of each disk, operators can run the following command: for file in $(find /path/to/storage/ -type f -regex [a-f0-9-]*.*); do echo "Retrieving file [$file] info."; qemu-img info -U $file; printf "nn"; done 2024-11-12 8.5 CVE-2024-50386 Apache Software Foundation--Apache Traffic Server  Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, from 10.0.0 through 10.0.1. Users are recommended to upgrade to version 9.2.6 or 10.0.2, which fixes the issue. 2024-11-14 9.1 CVE-2024-50306 Apache Software Foundation--Apache Traffic Server  Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-38479 Apache Software Foundation--Apache Traffic Server  Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users are recommended to upgrade to version 9.2.6, which fixes the issue, or 10.0.2, which does not have the issue. 2024-11-14 7.5 CVE-2024-50305 Arttia Creative--Datasets Manager by Arttia Creative  Unrestricted Upload of File with Dangerous Type vulnerability in Arttia Creative Datasets Manager by Arttia Creative.This issue affects Datasets Manager by Arttia Creative: from n/a through 1.5. 2024-11-14 10 CVE-2024-52375 Autodesk--Installer  A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to insecure privilege management. 2024-11-15 7.2 CVE-2024-9500 Avigilon--VideoIQ iCVR HD camera  Avigilon - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-45253 axelkeller--GPX Viewer  The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-13 8.8 CVE-2024-10629 ays-pro--Chartify WordPress Chart Plugin  The Chartify - WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other "safe" file types can be uploaded and included. 2024-11-14 9.8 CVE-2024-10571 Baxter--Life2000 Ventilation System  The software tools used by service personnel to test & calibrate the ventilator do not support user authentication. An attacker with access to the Service PC where the tools are installed could obtain diagnostic information through the test tool or manipulate the ventilator's settings and embedded software via the calibration tool, without having to authenticate to either tool. This could result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 10 CVE-2024-48966 Baxter--Life2000 Ventilation System  The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings that result in unauthorized disclosure of information and/or have unintended impacts on device performance. 2024-11-14 10 CVE-2024-48967 Baxter--Life2000 Ventilation System  The ventilator's microcontroller lacks memory protection. An attacker could connect to the internal JTAG interface and read or write to flash memory using an off-the-shelf debugging tool, which could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48970 Baxter--Life2000 Ventilation System  The Clinician Password and Serial Number Clinician Password are hard-coded into the ventilator in plaintext form. This could allow an attacker to obtain the password off the ventilator and use it to gain unauthorized access to the device, with clinician privileges. 2024-11-14 9.3 CVE-2024-48971 Baxter--Life2000 Ventilation System  The debug port on the ventilator's serial interface is enabled by default. This could allow an attacker to send and receive messages over the debug port (which are unencrypted; see 3.2.1) that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-48973 Baxter--Life2000 Ventilation System  The ventilator does not perform proper file integrity checks when adopting firmware updates. This makes it possible for an attacker to force unauthorized changes to the device's configuration settings and/or compromise device functionality by pushing a compromised/illegitimate firmware file. This could disrupt the function of the device and/or cause unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-48974 Baxter--Life2000 Ventilation System  There is no limit on the number of failed login attempts permitted with the Clinician Password or the Serial Number Clinician Password. An attacker could execute a brute-force attack to gain unauthorized access to the ventilator, and then make changes to device settings that could disrupt the function of the device and/or result in unauthorized information disclosure. 2024-11-14 9.3 CVE-2024-9832 Baxter--Life2000 Ventilation System  Improper data protection on the ventilator's serial interface could allow an attacker to send and receive messages that result in unauthorized disclosure of information and/or have unintended impacts on device settings and performance. 2024-11-14 9.3 CVE-2024-9834 BdThemes--Instant Image Generator  Unrestricted Upload of File with Dangerous Type vulnerability in BdThemes Instant Image Generator allows Upload a Web Shell to a Web Server.This issue affects Instant Image Generator: from n/a through 1.5.4. 2024-11-14 10 CVE-2024-52377 Bigfive--CF7 Reply Manager  Unrestricted Upload of File with Dangerous Type vulnerability in Bigfive CF7 Reply Manager.This issue affects CF7 Reply Manager: from n/a through 1.2.3. 2024-11-16 9.9 CVE-2024-52404 Bikram Joshi--B-Banner Slider  Unrestricted Upload of File with Dangerous Type vulnerability in Bikram Joshi B-Banner Slider allows Upload a Web Shell to a Web Server.This issue affects B-Banner Slider: from n/a through 1.1. 2024-11-16 9.9 CVE-2024-52405 BlackBerry--SecuSUITE  A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege. 2024-11-12 7.3 CVE-2024-51721 Boa web server--Boa web server 0.94.14rc21  Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 2024-11-14 7.5 CVE-2024-47916 Bosch Rexroth AG--IndraDrive FWA-INDRV*-MP*  A vulnerability in the PROFINET stack implementation of the IndraDrive (all versions) of Bosch Rexroth allows an attacker to cause a denial of service, rendering the device unresponsive by sending arbitrary UDP messages. 2024-11-13 7.5 CVE-2024-48989 Ciprian Popescu--W3P SEO  Cross-Site Request Forgery (CSRF) vulnerability in Ciprian Popescu W3P SEO allows Stored XSS.This issue affects W3P SEO: from n/a before 1.8.6. 2024-11-14 7.1 CVE-2024-51684 Cisco--Cisco BroadWorks  A vulnerability in the local interface of Cisco BroadWorks Network Server could allow an unauthenticated, remote attacker to exhaust system resources, causing a denial of service (DoS) condition.This vulnerability exists because rate limiting does not occur for certain incoming TCP connections. An attacker could exploit this vulnerability by sending a high rate of TCP connections to the server. A successful exploit could allow the attacker to cause TCP connection resources to grow rapidly until the Cisco BroadWorks Network Server becomes unusable.Note: To recover from this vulnerability, either Cisco BroadWorks Network Server software must be restarted or the Cisco BroadWorks Network Server node must be rebooted. For more information, see the section of this advisory.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.6 CVE-2023-20125 Cisco--Cisco Cyber Vision  A vulnerability in the Modbus preprocessor of the Snort detection engine could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device.This vulnerability is due to an integer overflow while processing Modbus traffic. An attacker could exploit this vulnerability by sending crafted Modbus traffic through an affected device. A successful exploit could allow the attacker to cause the Snort process to hang, causing traffic inspection to stop.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.5 CVE-2022-20685 Cisco--Cisco Industrial Network Director  A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device.This vulnerability is due to improper input validation when uploading a Device Pack. An attacker could exploit this vulnerability by altering the request that is sent when uploading a Device Pack. A successful exploit could allow the attacker to execute arbitrary commands as NT AUTHORITYSYSTEM on the underlying operating system of an affected device.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 9.9 CVE-2023-20036 Cisco--Cisco IOS XR Software  A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack.The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this vulnerability by injecting commands during the execution of this process. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privilege level of ConfD, which is commonly root. 2024-11-15 8.8 CVE-2022-20655 Cisco--Cisco Modeling Labs  A vulnerability in the external authentication mechanism of Cisco Modeling Labs could allow an unauthenticated, remote attacker to access the web interface with administrative privileges.This vulnerability is due to the improper handling of certain messages that are returned by the associated external authentication server. An attacker could exploit this vulnerability by logging in to the web interface of an affected server. Under certain conditions, the authentication mechanism would be bypassed and the attacker would be logged in as an administrator. A successful exploit could allow the attacker to obtain administrative privileges on the web interface of an affected server, including the ability to access and modify every simulation and all user-created data. To exploit this vulnerability, the attacker would need valid user credentials that are stored on the associated external authentication server.Cisco has released software updates that address this vulnerability. There are workarounds that address this vulnerability. 2024-11-15 9.1 CVE-2023-20154 Cisco--Cisco Redundancy Configuration Manager  A vulnerability in Cisco RCM for Cisco StarOS Software could allow an unauthenticated, remote attacker to perform remote code execution on the application with root-level privileges in the context of the configured container.This vulnerability exists because the debug mode is incorrectly enabled for specific services. An attacker could exploit this vulnerability by connecting to the device and navigating to the service with debug mode enabled. A successful exploit could allow the attacker to execute arbitrary commands as the root user.The attacker would need to perform detailed reconnaissance to allow for unauthenticated access. The vulnerability can also be exploited by an authenticated attacker.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 8.1 CVE-2022-20649 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data.  The vulnerability is due to a lack of validation of the SSL server certificate that an affected device receives when it establishes a connection to a Cisco Unified Communications Manager device. An attacker could exploit this vulnerability by using a man-in-the-middle technique to intercept the traffic between the devices, and then using a self-signed certificate to impersonate the endpoint. A successful exploit could allow the attacker to view the intercepted traffic in clear text or alter the contents of the traffic.Note: Cisco Expressway-E is not affected by this vulnerability.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. 2024-11-15 7.4 CVE-2022-20814 Cisco--Cisco TelePresence Video Communication Server (VCS) Expressway  A vulnerability in the REST API of Cisco Expressway Series and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the REST API to follow a crafted link. A successful exploit could allow the attacker to cause the affected system to reload.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.  2024-11-15 7.4 CVE-2022-20853 Citrix Session Recording--Citrix Session Recording  Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user on the same intranet as the session recording server 2024-11-12 8.8 CVE-2024-8069 Clarisse K.--Writer Helper  Unrestricted Upload of File with Dangerous Type vulnerability in Clarisse K. Writer Helper allows Upload a Web Shell to a Web Server.This issue affects Writer Helper: from n/a through 3.1.6. 2024-11-16 9.9 CVE-2024-52399 cli--cli  The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote codespaces through an SSH server running within the devcontainer, which is generally provided through the [default devcontainer image]( https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-... https://docs.github.com/en/codespaces/setting-up-your-project-for-codespaces/adding-a-dev-container-configuration/introduction-to-dev-containers#using-the-default-dev-container-configuration) . GitHub CLI [retrieves SSH connection details]( https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/inv... https://github.com/cli/cli/blob/30066b0042d0c5928d959e288144300cb28196c9/internal/codespaces/rpc/invoker.go#L230-L244 ), such as remote username, which is used in [executing `ssh` commands]( https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L2... https://github.com/cli/cli/blob/e356c69a6f0125cfaac782c35acf77314f18908d/pkg/cmd/codespace/ssh.go#L263 ) for `gh codespace ssh` or `gh codespace logs` commands. This exploit occurs when a malicious third-party devcontainer contains a modified SSH server that injects `ssh` arguments within the SSH connection details. `gh codespace ssh` and `gh codespace logs` commands could execute arbitrary code on the user's workstation if the remote username contains something like `-oProxyCommand="echo hacked" #`. The `-oProxyCommand` flag causes `ssh` to execute the provided command while `#` shell comment causes any other `ssh` arguments to be ignored. In `2.62.0`, the remote username information is being validated before being used. 2024-11-14 8 CVE-2024-52308 cmorillas1--External Database Based Actions  The External Database Based Actions plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.1. This is due to a missing capability check in the 'edba_admin_handle' function. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to update the plugin settings and log in as any existing user on the site, such as an administrator. 2024-11-15 7.5 CVE-2024-10311 cmsMinds--Boat Rental Plugin for WordPress  Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through 1.0.1. 2024-11-14 10 CVE-2024-52376 code-projects--Job Recruitment  A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-15 7.3 CVE-2024-11241 codeSavory--BasePress Migration Tools  Unrestricted Upload of File with Dangerous Type vulnerability in codeSavory BasePress Migration Tools allows Upload a Web Shell to a Web Server.This issue affects BasePress Migration Tools: from n/a through 1.0.0. 2024-11-16 9.9 CVE-2024-52407 craftcms--cms  Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5. 2024-11-13 8.4 CVE-2024-52291 craftcms--cms  Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. This is fixed in 5.4.9 and 4.12.8. 2024-11-13 7.7 CVE-2024-52292 craftcms--cms  Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePath could lead to Remote Code Execution on the server via twig SSTI. This is a sequel to CVE-2023-40035. This vulnerability is fixed in 4.12.2 and 5.4.3. 2024-11-13 7.2 CVE-2024-52293 creativeinteractivemedia--Real3D Flipbook Lite 3D FlipBook, PDF Viewer, PDF Embedder  The 3D FlipBook, PDF Viewer, PDF Embedder - Real 3D FlipBook WordPress Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. 2024-11-16 8.8 CVE-2024-9849 cyberlord92--Login using WordPress Users ( WP as SAML IDP )  The Login using WordPress Users ( WP as SAML IDP ) plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.15.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. 2024-11-16 7.2 CVE-2024-9887 Dang Ngoc Binh--Audio Record  Unrestricted Upload of File with Dangerous Type vulnerability in Dang Ngoc Binh Audio Record allows Upload a Web Shell to a Web Server.This issue affects Audio Record: from n/a through 1.0. 2024-11-11 10 CVE-2024-51792 Davor Zeljkovic--Convert Docx2post  Unrestricted Upload of File with Dangerous Type vulnerability in Davor Zeljkovic Convert Docx2post allows Upload a Web Shell to a Web Server.This issue affects Convert Docx2post: from n/a through 1.4. 2024-11-16 9.1 CVE-2024-52397 decidim--decidim  Decidim is a participatory democracy framework. The meeting embeds feature used in the online or hybrid meetings is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.28.3 and 0.29.0. 2024-11-13 7.7 CVE-2024-45594 decidim-ice--decidim-module-decidim_awesome  An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidim_awesome-module 0.9.0) allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands. 2024-11-12 9 CVE-2024-43415 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution. 2024-11-12 7.8 CVE-2024-49557 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. 2024-11-12 7.8 CVE-2024-49558 dell -- smartfabric_os10  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. 2024-11-12 7.8 CVE-2024-49560 Dell--SmartFabric OS10 Software  Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution 2024-11-12 7.8 CVE-2024-48837 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in CEtherIPTagItem can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39354 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetParameter can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-39605 Delta Electronics--DIAScreen  If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer overflow in BACnetObjectInfo can be exploited, allowing the attacker to remotely execute arbitrary code. 2024-11-11 7.8 CVE-2024-47131 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an Incorrect Use of Privileged APIs vulnerability, allowing unauthenticated remote attackers to modify any user's password by leveraging the API, thereby granting access to Web, SSH, and Telnet services using that user's account. 2024-11-11 9.8 CVE-2024-11068 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11062 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11063 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11064 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through a specific functionality provided by SSH and Telnet. 2024-11-11 7.2 CVE-2024-11065 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject and execute arbitrary system commands through the specific web page. 2024-11-11 7.2 CVE-2024-11066 dlink -- dsl6740c_firmware  The D-Link DSL6740C modem has a Path Traversal Vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files. Additionally, since the device's default password is a combination of the MAC address, attackers can obtain the MAC address through this vulnerability and attempt to log in to the device using the default password. 2024-11-11 7.5 CVE-2024-11067 DMC--Airin Blog  Deserialization of Untrusted Data vulnerability in DMC Airin Blog allows Object Injection.This issue affects Airin Blog: from n/a through 1.6.1. 2024-11-16 9.8 CVE-2024-52413 DonnellC--Global Gateway e4 | Payeezy Gateway  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway.This issue affects Global Gateway e4 | Payeezy Gateway: from n/a through 2.0. 2024-11-14 8.6 CVE-2024-52371 DoThatTask--Do That Task  Unrestricted Upload of File with Dangerous Type vulnerability in DoThatTask Do That Task allows Upload a Web Shell to a Web Server.This issue affects Do That Task: from n/a through 1.5.5. 2024-11-14 10 CVE-2024-52374 dotnetzip.semverd_project -- dotnetzip.semverd  Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer. 2024-11-13 9.8 CVE-2024-48510 Elastic--Kibana  A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. A successful attack requires a malicious user to have a combination of both specific Elasticsearch indices privileges https://www.elastic.co/guide/en/elasticsearch/reference/current/defining-roles.html#roles-indices-priv  and Kibana privileges https://www.elastic.co/guide/en/fleet/current/fleet-roles-and-privileges.html  assigned to them. The following Elasticsearch indices permissions are required * write privilege on the system indices .kibana_ingest** The allow_restricted_indices flag is set to true Any of the following Kibana privileges are additionally required * Under Fleet the All privilege is granted* Under Integration the Read or All privilege is granted* Access to the fleet-setup privilege is gained through the Fleet Server's service account token 2024-11-14 9.1 CVE-2024-37285 Eugen Bobrowski--Debug Tool  Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Upload a Web Shell to a Web Server.This issue affects Debug Tool: from n/a through 2.2. 2024-11-16 10 CVE-2024-52416 Flowcraft UX Design Studio--Advanced Personalization  Deserialization of Untrusted Data vulnerability in Flowcraft UX Design Studio Advanced Personalization allows Object Injection.This issue affects Advanced Personalization: from n/a through 1.1.2. 2024-11-16 9.8 CVE-2024-52411 fortinet -- forticlient  A privilege context switching error vulnerability [CWE-270] in FortiClient Windows version 7.2.4 and below, version 7.0.12 and below, 6.4 all versions may allow an authenticated user to escalate their privileges via lua auto patch scripts. 2024-11-12 8.8 CVE-2024-36513 fortinet -- forticlient  A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering. 2024-11-12 7.8 CVE-2024-36507 Fortinet--FortiClientWindows  A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe messages. 2024-11-13 7.8 CVE-2024-47574 Fortinet--FortiManager  A client-side enforcement of server-side security in Fortinet FortiAnalyzer-BigDataat least version 7.4.0 and 7.2.0 through 7.2.6 and 7.0.1 through 7.0.6 and 6.4.5 through 6.4.7 and 6.2.5, FortiManager version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14, FortiAnalyzer version 7.4.0 through 7.4.1 and 7.2.0 through 7.2.4 and 7.0.0 through 7.0.11 and 6.4.0 through 6.4.14 allows attacker to improper access control via crafted requests. 2024-11-12 7.5 CVE-2024-23666 Fortinet--FortiOS  A session fixation in Fortinet FortiOS version 7.4.0 through 7.4.3 and 7.2.0 through 7.2.7 and 7.0.0 through 7.0.13 allows attacker to execute unauthorized code or commands via phishing SAML authentication link. 2024-11-12 7.5 CVE-2023-50176 FraudLabs Pro--FraudLabs Pro SMS Verification  Cross-Site Request Forgery (CSRF) vulnerability in FraudLabs Pro FraudLabs Pro SMS Verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through 1.10.1. 2024-11-14 7.1 CVE-2024-51688 FreeBSD--FreeBSD  The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment variable name used by fetch(1) to pass the filename to the library was incorrect, in effect ignoring the option. Fetch would still connect to a host presenting a certificate included in the revocation file passed to the --crl option. 2024-11-12 7.5 CVE-2024-45289 GeekRMX--Twitter @Anywhere Plus  Cross-Site Request Forgery (CSRF) vulnerability in GeekRMX Twitter @Anywhere Plus allows Stored XSS.This issue affects Twitter @Anywhere Plus: from n/a through 2.0. 2024-11-14 7.1 CVE-2024-51659 GentleSource--Appointmind  Cross-Site Request Forgery (CSRF) vulnerability in GentleSource Appointmind allows Stored XSS.This issue affects Appointmind: from n/a through 4.0.0. 2024-11-14 7.1 CVE-2024-51679 GeoVision--GV-VS12  Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. Moreover, this vulnerability has already been exploited by attackers, and we have received related reports. 2024-11-15 9.8 CVE-2024-11120 GitLab--GitLab  An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations. 2024-11-14 8.5 CVE-2024-9693 glpi-project--glpi  GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17. 2024-11-15 8.1 CVE-2024-40638 gogs--gogs/gogs  A remote command execution vulnerability exists in gogs/gogs versions

Read more »

An Interview With the Target & Home Depot Hacker
In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he is broke and seeking publicity for several new money making schemes.

Read more »

Microsoft Patch Tuesday, November 2024 Edition
Microsoft today released updates to plug at least 89 security holes in its Windows operating systems and other software. November's patch batch includes fixes for two zero-day vulnerabilities that are already being exploited by attackers, as well as two other flaws that were publicly disclosed prior to today.

Read more »

FBI: Spike in Hacked Police Emails, Fake Subpoenas
The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies.

Read more »

Canadian Man Arrested in Snowflake Data Extortions
A 26-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service Snowflake. On October 30, Canadian authorities arrested Alexander Moucka, a.k.a. Connor Riley Moucka of Kitchener, Ontario, on a provisional arrest warrant from the United States. Bloomberg first reported Moucka's alleged ties to the Snowflake hacks on Monday. At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories used by some of the world’s largest corporations.

Read more »

Vulnerability Summary for the Week of October 28, 2024
High Vulnerabilities PrimaryVendor -- Product Description Published CVSS Score Source Info Patch Info acnoo -- flutter_api  Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through 1.0.5. 2024-10-28 9.8 CVE-2024-50486 audit@patchstack.com  adirectory--aDirectory  Unrestricted Upload of File with Dangerous Type vulnerability in adirectory aDirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through 1.3. 2024-10-29 10 CVE-2024-50420 audit@patchstack.com  Ajar Productions--Ajar in5 Embed  Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through 3.1.3. 2024-10-29 10 CVE-2024-50473 audit@patchstack.com  Amin Omer--Sudan Payment Gateway for WooCommerce  Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2. 2024-10-29 10 CVE-2024-50494 audit@patchstack.com  amu02aftab--Enable Shortcodes inside Widgets,Comments and Experts  The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. 2024-10-30 7.3 CVE-2024-9846 security@wordfence.comsecurity@wordfence.comsecurity@wordfence.com  Andy Moyle--Church Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Andy Moyle Church Admin allows Reflected XSS.This issue affects Church Admin: from n/a before 5.0.0. 2024-10-28 7.1 CVE-2024-50438 audit@patchstack.com  Apache Software Foundation--Apache Lucene.Net.Replicator  Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. 2024-10-31 8 CVE-2024-43383 security@apache.org  apple -- ipados  A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox. 2024-10-28 9.6 CVE-2024-40867 product-security@apple.com  apple -- ipados  The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, iOS 17.7 and iPadOS 17.7, macOS Sonoma 14.7, visionOS 2, iOS 18 and iPadOS 18. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44126 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, macOS Sonoma 14.7.1, iOS 18.1 and iPadOS 18.1. Processing a maliciously crafted file may lead to heap corruption. 2024-10-28 7.8 CVE-2024-44218 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A logic issue was addressed with improved file handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44252 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A path handling issue was addressed with improved logic. This issue is fixed in visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, tvOS 18.1. A malicious app may be able to run arbitrary shortcuts without user consent. 2024-10-28 7.8 CVE-2024-44255 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, tvOS 18.1. Restoring a maliciously crafted backup file may lead to modification of protected system files. 2024-10-28 7.1 CVE-2024-44258 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- ipados  A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, watchOS 11.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.8 CVE-2024-44285 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1. An application may be able to break out of its sandbox. 2024-10-28 8.8 CVE-2024-44122 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  apple -- macos  A logic issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A sandboxed process may be able to circumvent sandbox restrictions. 2024-10-28 8.6 CVE-2024-44270 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44156 product-security@apple.comproduct-security@apple.com  apple -- macos  A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to bypass Privacy preferences. 2024-10-28 7.1 CVE-2024-44159 product-security@apple.comproduct-security@apple.com  apple -- macos  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library. 2024-10-28 7.5 CVE-2024-44203 product-security@apple.com  apple -- macos  This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. An app may be able to bypass certain Privacy preferences. 2024-10-28 7.5 CVE-2024-44208 product-security@apple.com  apple -- macos  A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to read sensitive location information. 2024-10-28 7.5 CVE-2024-44289 product-security@apple.comproduct-security@apple.com  apple -- xcode  This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data. 2024-10-28 7.5 CVE-2024-44228 product-security@apple.com  Apple--iOS and iPadOS  A permissions issue was addressed by removing vulnerable code and adding additional checks. This issue is fixed in iOS 18 and iPadOS 18. Password autofill may fill in passwords after failing authentication. 2024-10-28 9.1 CVE-2024-44217 product-security@apple.com  Apple--macOS  The issue was addressed with improved input sanitization. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to break out of its sandbox. 2024-10-28 9.3 CVE-2024-44256 product-security@apple.comproduct-security@apple.com  Apple--macOS  A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.5 CVE-2024-44196 product-security@apple.comproduct-security@apple.com  Apple--macOS  A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44280 product-security@apple.comproduct-security@apple.com  Apple--macOS  This issue was addressed with additional entitlement checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. An app may be able to modify protected parts of the file system. 2024-10-28 7.7 CVE-2024-44295 product-security@apple.comproduct-security@apple.com  Apple--visionOS  This issue was addressed through improved state management. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, Safari 18.1. An attacker may be able to misuse a trust relationship to download malicious content. 2024-10-28 8.8 CVE-2024-44259 product-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.comproduct-security@apple.com  Apple--visionOS  The issue was addressed with improved memory handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, visionOS 2.1, tvOS 18.1. An app may be able to cause unexpected system termination or corrupt kernel memory. 2024-10-28 7.7 CVE-2024-44277 product-security@apple.comproduct-security@apple.comproduct-security@apple.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force an Out-of-Bounds Write. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7991 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file, when parsed through Autodesk AutoCAD and certain AutoCAD-based products, can force a Stack-based Buffer Overflow. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-7992 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8588 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8589 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8590 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Heap-Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8591 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in AcTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8592 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in ASMKERN230A.dll through Autodesk AutoCAD can force a Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8593 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Heap-Based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8594 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8595 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted MODEL file when parsed in libodxdll.dll through Autodesk AutoCAD can force an Out-of-Bound Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8596 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ASMDATAX230A.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8597 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8598 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted STP file when parsed in ACTranslators.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8599 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8600 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8896 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in ACAD.exe through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9489 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted 3DM file when parsed in atf_api.dll through Autodesk AutoCAD can force a Use-After-Free vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9826 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted CATPART file when parsed in CC5Dll.dll through Autodesk AutoCAD can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9827 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9996 psirt@autodesk.com  autodesk -- autocad  A maliciously crafted DWG file when parsed in acdb25.dll through Autodesk AutoCAD can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-9997 psirt@autodesk.com  Autodesk--AutoCAD  A maliciously crafted SLDPRT file when parsed in odxsw_dll.dll through Autodesk AutoCAD can force a Heap Based Buffer Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute arbitrary code in the context of the current process. 2024-10-29 7.8 CVE-2024-8587 psirt@autodesk.com  Automattic--Newspack Blocks  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic Newspack Blocks allows Path Traversal.This issue affects Newspack Blocks: from n/a through 3.0.8. 2024-11-01 8.5 CVE-2024-37423 audit@patchstack.com  Azexo--Marketing Automation by AZEXO  Incorrect Privilege Assignment vulnerability in Azexo Marketing Automation by AZEXO allows Privilege Escalation.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-30 8.8 CVE-2024-50506 audit@patchstack.com  azexo--Marketing Automation by AZEXO  Unrestricted Upload of File with Dangerous Type vulnerability in azexo Marketing Automation by AZEXO allows Upload a Web Shell to a Web Server.This issue affects Marketing Automation by AZEXO: from n/a through 1.27.80. 2024-10-29 9.9 CVE-2024-50480 audit@patchstack.com  buynowdepot -- advanced_online_ordering_and_delivery_platform  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuyNowDepot Advanced Online Ordering and Delivery Platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through 2.0.0. 2024-10-28 9.8 CVE-2024-50497 audit@patchstack.com  Carl Alberto--Simple Custom Admin  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Carl Alberto Simple Custom Admin allows Reflected XSS.This issue affects Simple Custom Admin: from n/a through 1.2. 2024-10-29 7.1 CVE-2024-49647 audit@patchstack.com  CHANGING Information Technology--IDExpert  IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with administrative privileges to inject and execute OS commands on the server. 2024-11-01 7.2 CVE-2024-10653 twcert@cert.org.twtwcert@cert.org.tw  Chetan Khandla--Woocommerce Product Design  Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-29 10 CVE-2024-50482 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 8.6 CVE-2024-50509 audit@patchstack.com  Chetan Khandla--Woocommerce Product Design  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chetan Khandla Woocommerce Product Design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through 1.0.0. 2024-10-30 7.5 CVE-2024-50508 audit@patchstack.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /track-result.php. The manipulation of the argument Consignment leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10607 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Courier Management System  A vulnerability was found in code-projects Courier Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /login.php. The manipulation of the argument txtusername leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-01 7.3 CVE-2024-10608 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability, which was classified as critical, has been found in code-projects E-Health Care System 1.0. Affected by this issue is some unknown functionality of the file /Admin/adminlogin.php. The manipulation of the argument email/admin_pswd as part of String leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The initial researcher advisory only mentions the parameter "email" to be affected. But it must be assumed that parameter "admin_pswd" is affected as well. 2024-11-03 7.3 CVE-2024-10739 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--E-Health Care System  A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code of the file /Users/registration.php. The manipulation of the argument f_name leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. 2024-11-03 7.3 CVE-2024-10741 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Restaurant Order System  A vulnerability was found in code-projects Restaurant Order System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument uid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10733 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Simple Car Rental System  A vulnerability classified as critical has been found in code-projects Simple Car Rental System 1.0. Affected is an unknown function of the file /signup.php. The manipulation of the argument fname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10702 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  code-projects--Wazifa System  A vulnerability was found in code-projects Wazifa System 1.0. It has been classified as critical. This affects an unknown part of the file /controllers/logincontrol.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-02 7.3 CVE-2024-10699 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- hospital_appointment_system  A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-28 9.8 CVE-2024-10449 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- online_institute_management_system  A vulnerability, which was classified as critical, has been found in Codezips Online Institute Management System 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 9.8 CVE-2024-10509 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability, which was classified as critical, was found in Codezips Pet Shop Management System 1.0. Affected is an unknown function of the file birdsadd.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10556 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  codezips -- pet_shop_management_system  A vulnerability was found in Codezips Pet Shop Management System 1.0. It has been classified as critical. This affects an unknown part of the file birdsupdate.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. 2024-10-31 9.8 CVE-2024-10561 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical was found in Codezips Free Exam Hall Seating Management System 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-10-30 7.3 CVE-2024-10507 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability was found in Codezips Free Exam Hall Seating Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10736 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  Codezips--Free Exam Hall Seating Management System  A vulnerability classified as critical has been found in Codezips Free Exam Hall Seating Management System 1.0. Affected is an unknown function of the file /teacher.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. 2024-11-03 7.3 CVE-2024-10737 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  CozyThemes--Cozy Blocks  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.0.15. 2024-10-28 7.4 CVE-2024-50441 audit@patchstack.com  cure53--DOMPurify  DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. 2024-10-31 9.1 CVE-2024-48910 security-advisories@github.comsecurity-advisories@github.com  D3TN--D3TN  Reachable Assertion in BPv7 parser in µD3TN v0.14.0 allows attacker to disrupt service via malformed Extension Block 2024-10-28 7.5 CVE-2024-10455 cve@gitlab.com  Daniel Schmitzer--DS.DownloadList  Deserialization of Untrusted Data vulnerability in Daniel Schmitzer DS.DownloadList allows Object Injection.This issue affects DS.DownloadList: from n/a through 1.3. 2024-10-30 9.8 CVE-2024-50507 audit@patchstack.com  David DONISA--WP donimedia carousel  Unrestricted Upload of File with Dangerous Type vulnerability in David DONISA WP donimedia carousel allows Upload a Web Shell to a Web Server.This issue affects WP donimedia carousel: from n/a through 1.0.1. 2024-10-30 9.9 CVE-2024-50511 audit@patchstack.com  Delta Electronics--InfraSuite Device Master  Delta Electronics InfraSuite Device Master versions prior to 1.0.12 are affected by a deserialization vulnerability that targets the Device-Gateway, which could allow deserialization of arbitrary .NET objects prior to authentication. 2024-10-30 9.8 CVE-2024-10456 ics-cert@hq.dhs.gov  Deryck Oate--User Toolkit  Authentication Bypass Using an Alternate Path or Channel vulnerability in Deryck Oñate User Toolkit allows Authentication Bypass.This issue affects User Toolkit: from n/a through 1.2.3. 2024-10-30 9.8 CVE-2024-50503 audit@patchstack.com  Devsoft Baltic O--SurveyJS: Drag & Drop WordPress Form Builder  Unrestricted Upload of File with Dangerous Type vulnerability in Devsoft Baltic OÃœ SurveyJS: Drag & Drop WordPress Form Builder.This issue affects SurveyJS: Drag & Drop WordPress Form Builder: from n/a through 1.9.136. 2024-10-29 9.9 CVE-2024-50427 audit@patchstack.com  Eclipse Foundation--mosquitto  In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients. 2024-10-30 9.1 CVE-2024-10525 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  Eclipse Foundation--mosquitto  In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. 2024-10-30 7.5 CVE-2024-3935 emo@eclipse.orgemo@eclipse.orgemo@eclipse.org  esafenet -- cdg  A vulnerability was found in ESAFENET CDG 5. It has been declared as critical. Affected by this vulnerability is the function delFile/delDifferCourseList of the file /com/esafenet/servlet/ajax/PublicDocInfoAjax.java. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. 2024-10-31 9.8 CVE-2024-10595 cna@vuldb.comcna@vuldb.comcna@vuldb.comcna@vuldb.com  gaizhenbiao -- chuanhuchatgpt  A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions

Read more »

Booking.com Phishers May Leave You With Reservations
A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its booking.com credentials stolen. We'll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world's most visited travel website.

Read more »

Change Healthcare Breach Hits 100M Americans
Change Healthcare says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information.

Read more »

SMS Delivery Receipt Delays to Multiple Networks in Multiple Countries in Europe
Nov 29, 04:57 PSTInvestigating - We are experiencing SMS delivery receipt delays when sending messages to multiple networks in multiple countries in Europe. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to Mobilis Network in Algeria
Nov 29, 04:55 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Mobilis network in Algeria. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Failures to Multiple Networks in Mexico
Nov 29, 02:59 PSTInvestigating - We are experiencing SMS delivery failures when sending messages to multiple networks in Mexico. Our engineers are working with our carrier partner to resolve the issue. We expect to provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to DigiMobil Network (Movistar) in Spain
Nov 29, 02:10 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to DigiMobil network (Movistar) in Spain. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to MTS Network in Russia
Nov 29, 01:44 PSTInvestigating - We are experiencing MMS/SMS delivery delays when sending messages to MTS network in Russia. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to Bouygues Telecom Network in France
Nov 29, 01:24 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Bouygues Telecom network in France. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to Eritel Network in Eritrea
Nov 29, 01:21 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Eritel network in Eritrea. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Report Delays To Tele2 Network in Sweden
Nov 29, 01:15 PSTInvestigating - We are experiencing delays in receiving message delivery reports when sending to Tele2 network in Sweden. Our engineers are working with our carrier partner to resolve the issue. We expect to provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to Globe Network in Philippines
Nov 29, 00:50 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Globe network in Philippines. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to Oman Mobile Networks in Oman
Nov 28, 19:59 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Oman Mobile Networks in Oman. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

Black Friday Cyber Monday – Alert
Nov 28, 18:59 PSTInvestigating - Due to increased traffic demand on mobile communication networks, we are expecting potential congestion for US carrier networks during the Black Friday and Cyber Monday period. Customers may experience intermittent SMS and MMS delivery delays. Please refer to our Black Friday / Cyber Monday FAQ page for more information at https://support.twilio.com/hc/en-us/articles/4411075931163-Advisory-Potential-Message-Delays-During-Black-Friday-Cyber-Monday-and-Elections-2024

Read more »

SMS Delivery Delays To Telecel Network In Burkina Faso
Nov 28, 18:28 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to Telecel Network In Burkina Faso. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays to MTS Network In Kazakhstan
Nov 28, 18:25 PSTInvestigating - We are experiencing SMS delivery delays when sending messages to MTS Network In Kazakhstan. Our engineers are working with our carrier partner to resolve the issue. We will provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Report Delays and SMS Failure to FEBO Network in Belgium
Nov 28, 18:08 PSTInvestigating - We are experiencing delays in receiving message delivery reports and SMS failure to FEBO Network in Belgium. Our engineers are working with our carrier partner to resolve the issue. We expect to provide another update in 1 hour or as soon as more information becomes available.

Read more »

SMS Delivery Delays To Digi and Celcom Networks in Malaysia
Nov 28, 17:57 PSTInvestigating - We are experiencing SMS delivery delays to Digi and Celcom Networks in Malaysia. Our engineers are working with our carrier partner to resolve the issue. We will provide an update in 1 hour or as soon as more information becomes available.

Read more »

Apple MacBook Pro M4 Laptops at Best Buy From $1,399 + free shipping
These Black Friday doorbuster deals take up to $400 off these new MacBook Pro models, only released earlier this month. 20 builds are on sale in total. Buy Now at Best Buy

Read more »

Apple Store Black Friday Deals: Up to $200 Gift Card w/ purchase + free shipping
Through December 2, you’ll get an Apple Gift Card worth up to $200 with select purchases. MacBooks get the biggest gift cards, as you’d expect, but offers start with $25 gift cards on various iPad accessories. Some highlights: Up to $200 Apple Gift Card w/ MacBook Air M3 13″ or 15″, or M2 13″Up to […]

Read more »

Apple Store Black Friday Deals: Up to $200 Gift Card w/ purchase + free shipping
Through December 2, you’ll get an Apple Gift Card worth up to $200 with select purchases. MacBooks get the biggest gift cards, as you’d expect, but offers start with $25 gift cards on various iPad accessories. Some highlights: Up to $200 Apple Gift Card w/ MacBook Air M3 13″ or 15″, or M2 13″Up to […]

Read more »

Tablet and E-Reader Deals at Best Buy: Up to 50% off + free shipping
Save on tablets from Samsung, Lenovo, Apple, and more. We’ve pictured the Lenovo Tab M9 9″ 32GB Android Tablet for $80 ($60 off). Shop Now at Best Buy

Read more »

Apple MacBooks & iMac Doorbuster Deals at Best Buy: Up to $500 off + free shipping
These Black Friday doorbuster deals drop MacBook Air laptops as low as $749, iMacs as low as $1,199, and MacBooks Pro as low as $1,399. Plus, My Best Buy Total members can save an extra $50 on select models. (My Best Buy Total is a paid membership, which costs $180 annually.) Shop Now at Best Buy

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Blue – G1973LL/A – $1,329.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Blue – G1973LL/A $1,329.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 16GB unified memory 512GB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 10-Core GPU – Purple – G19Q1LL/A – $1,829.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 10-Core GPU - Purple – G19Q1LL/A $1,829.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 8GB unified memory 2TB SSD¹ Magic Keyboard with Touch ID⁵ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Two USB 3 ports (up to 10Gb/s) Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Silver – G1955LL/A – $1,329.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Silver – G1955LL/A $1,329.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 24GB unified memory 256GB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Green – G1960LL/A – $1,179.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Green – G1960LL/A $1,179.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 8GB unified memory 512GB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Blue – G1970LL/A – $1,179.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Blue – G1970LL/A $1,179.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 8GB unified memory 512GB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Black Friday iPad Deals at Best Buy from $200 + free shipping
Bag savings of as much as $1,000 off in total. Plus, be sure to look out for the extra savings for My Best Buy Plus members (it’s $50 for an annual subscription.) We’ve pictured this 9th-Gen. Apple iPad 10.2″ 64GB WiFi Tablet (2021) for $199.99 ($130 off.) Buy Now at Best Buy

Read more »

Apple Store Engravings: Free w/ Airpods, iPads, more + free shipping
Buy an iPad, AirPods, AirTag, Apple Pencil Pro, or 2nd-Gen. Apple Pencil at the Apple Store, and you can add an engraving for free. (Choose "add engraving" while configuring your purchase, and you'll be able to pick from emoji, letters, and numbers up to 50.) Shop Now at Apple

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Pink – G1983LL/A – $1,329.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Pink – G1983LL/A $1,329.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 16GB unified memory 512GB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 10-Core GPU – Pink – G19N5LL/A – $1,669.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 10-Core GPU - Pink – G19N5LL/A $1,669.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 24GB unified memory 512GB SSD¹ Magic Keyboard with Touch ID⁵ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Two USB 3 ports (up to 10Gb/s) Product page on the Apple Store…

Read more »

Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU – Blue – G1971LL/A – $1,329.00
Refurbished 24-inch iMac Apple M3 Chip with 8-Core CPU and 8-Core GPU - Blue – G1971LL/A $1,329.00 Originally released October 2023 24-inch 4.5K Retina display;² 4480-by-2520 resolution at 218 pixels per inch with support for 1 billion colors 8GB unified memory 1TB SSD¹ 1080p FaceTime HD camera Two Thunderbolt 4 (USB-C) ports Product page on the Apple Store…

Read more »

Seasonal Cashier – *Apple* Blossom Mall – JCPenney (United States)
Seasonal Cashier - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple

Read more »

Operations Associate – *Apple* Blossom Mall – JCPenney (United States)
Operations Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple

Read more »

Omnichannel Associate – *Apple* Blossom Mall – JCPenney (United States)
Omnichannel Associate - Apple Blossom Mall Location:Winchester, VA, United States (https://jobs.jcp.com/jobs/location/191170/winchester-va-united-states) - Apple

Read more »

*Apple* / Mac Administrator – JAMF Pro – Amentum (United States)
Amentum is seeking an ** Apple / Mac Administrator - JAMF Pro** to provide support with the Apple Ecosystem to include hardware and software to join our team and

Read more »

*Apple* Engineering Architect – NANA Regional Corporation (United States)
Cloud Lake Technology is looking for an Apple Engineering Architect/Team Lead to support a Department of Homeland Security (DHS) prime contract that provides

Read more »

Anesthesia Technician – *Apple* Hill Surgery Center – Full Time – Days – WellSpan Health (United States)
Anesthesia Technician - Apple Hill Surgery Center - Full Time - Days Location: WellSpan Medical Group, York, PA Schedule: Full Time Full Time (80 hours/Biweekly)

Read more »

Account Manager – Commercial Roofing – Apple Roofing (United States)
…in the greater Kansas City, MO area to service designated territory and clients. Apple Roofing is a leading name in the roofing industry, recognized for providing

Read more »

Environmental Services Technician – *Apple* Hill – Evening/Night – WellSpan Health (United States)
Environmental Services Technician - Apple Hill - Evening/Night Location: WellSpan Health, York, PA Schedule: Part Time Part Time (40 hours Biweekly) Monday - Friday

Read more »

Pharmacy Technician Retail – *Apple* Hill – Part Time – Day/Evening – WellSpan Health (United States)
Pharmacy Technician Retail - Apple Hill - Part Time - Day/Evening Location: WellSpan Health, York, PA Schedule: Part Time Schedule: Part Time 20-hours per week

Read more »

Bi-lingual (Spanish) Level 1 *Apple* Support Specialist – CompuCom (United States)
…right people. Our client is currently seeking a qualified Bi-lingual (Spanish) Level 1 Apple Support Specialist to join their team. This role can be hybrid / remote

Read more »

Retail Assistant Department Manager, *Apple* Tech Shop – Barnes & Noble Education (United States)
…combination of education, certification and experience will be considered. + A+ and/or Apple certified or able to achieve certification within 60 days required. +

Read more »

Pharmacist (Retail) – *Apple* Hill – Part Time – Day/Evening – WellSpan Health (United States)
Pharmacist (Retail) - Apple Hill - Part Time - Day/Evening Location: WellSpan Health, York, PA Schedule: Part Time Schedule: Part-time 20-hours per week Day/Evening

Read more »

Lead Teacher – Glenda Drive/ *Apple* ValleyTeacher – Learning Care Group (United States)
Lead Teacher - Glenda Drive/ Apple ValleyTeacher Share by Email Share on LinkedIn Share on X

Read more »

*Apple* Tier 2 Operations Support Specialist – AIG (United States)
Apple Tier 2 Operations Support Specialist Status: Full-Time Location Jeffersonville, In Who we are American International Group, Inc. (AIG) is a leading global

Read more »

Supply Planner III- *Apple* – DISH Network (United States)
…large. **Job Duties and Responsibilities** We are seeking a Supply Planner III for Apple products to join our Retail Wireless Product Team. This critical role is

Read more »