Feed aggregator

Apache released a patch for a critical severity vulnerability in its OFBiz software. The bug is an arbitrary code execution flaw, allowing threat actors to run any code on either Windows, or Linux servers.

Apache OFBiz (short for Open For Business) is an open-source enterprise resource planning (ERP) system that provides a suite of applications designed to automate and manage a wide range of business processes. It offers a comprehensive platform for businesses to handle operations such as customer relationship management (CRM), supply chain management, inventory management, accounting, e-commerce, and more.

According to cybersecurity researchers Rapid7, the bug stems from a forced browsing weakness that exposes restricted paths to unauthenticated direct request attacks. "An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server," the researchers explained.

Mitigations and fixes

The vulnerability is now tracked as CVE-2024-45195, and carries a severity score of 7.5 (high). All versions prior to 18.12.16 were vulnerable, and in the latest version, Apache addressed the issue by adding authorization checks. Users are advised to apply the patch without hesitation.

The researchers further explained that this is not the first vulnerability, or the first patch, to address the very same kind of flaw. Last year, Apache released three patches for three flaws that all had the same root cause: CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856.

That being said, CVE-2024-45195 is a patch bypass for the three older ones.

“All of them are caused by a controller-view map fragmentation issue that enables attackers to execute code or SQL queries and achieve remote code execution without authentication,” the researcher concluded.

Earlier this month, the US Cybersecurity and Infrastructure Security Agency (CISA) warned that one of the three flaws - CVE-2024-32113, was being exploited in attacks, and added it to the Known Exploited Vulnerabilities (KEV) catalog.

Via BleepingComputer

More from TechRadar Pro

• Apache HugeGraph users told to patch immediately to stay safe from this dangerous bug
• Here's a list of the best firewalls around today
• These are the best endpoint security tools right now

Apache released a patch for a critical severity vulnerability in its OFBiz software. The bug is an arbitrary code execution flaw, allowing threat actors to run any code on either Windows, or Linux servers.

Apache OFBiz (short for Open For Business) is an open-source enterprise resource planning (ERP) system that provides a suite of applications designed to automate and manage a wide range of business processes. It offers a comprehensive platform for businesses to handle operations such as customer relationship management (CRM), supply chain management, inventory management, accounting, e-commerce, and more.

According to cybersecurity researchers Rapid7, the bug stems from a forced browsing weakness that exposes restricted paths to unauthenticated direct request attacks. "An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server," the researchers explained.

Mitigations and fixes

The vulnerability is now tracked as CVE-2024-45195, and carries a severity score of 7.5 (high). All versions prior to 18.12.16 were vulnerable, and in the latest version, Apache addressed the issue by adding authorization checks. Users are advised to apply the patch without hesitation.

The researchers further explained that this is not the first vulnerability, or the first patch, to address the very same kind of flaw. Last year, Apache released three patches for three flaws that all had the same root cause: CVE-2024-32113, CVE-2024-36104, and CVE-2024-38856.

That being said, CVE-2024-45195 is a patch bypass for the three older ones.

“All of them are caused by a controller-view map fragmentation issue that enables attackers to execute code or SQL queries and achieve remote code execution without authentication,” the researcher concluded.

Earlier this month, the US Cybersecurity and Infrastructure Security Agency (CISA) warned that one of the three flaws - CVE-2024-32113, was being exploited in attacks, and added it to the Known Exploited Vulnerabilities (KEV) catalog.

Via BleepingComputer

More from TechRadar Pro

• Apache HugeGraph users told to patch immediately to stay safe from this dangerous bug
• Here's a list of the best firewalls around today
• These are the best endpoint security tools right now

Controlling an iPhone from another room is an impressive technical feat, but is it really practical? We run down the real-world situations for when it's genuinely helpful to remotely mirror your phone from your computer.

After eight years of development, Sony pulled the plug on Concord today after just two weeks. Fans loved it, but seemingly not enough. Is the future of the industry blockbuster-or-bust?

A 125-year-old theory explains why humans want luxury items even more when the prices go up. Blame social media—and ubiquitous counterfeits—for making it even worse.

Distraction Control, which removes annoying elements from web pages, is coming to the iPhone’s default browser with the release of iOS 18.

Beyerdynamic is legendary in headphone circles: I bought my beloved mixing headphones, the DT 770 Pro, after reading our review and being recommended them by stacks of serious studio pros. So I'm quite excited by the news that Beyerdynamic has not one but two new flagship products coming out: one pair of true wireless earbuds and one pair of high-end headphones.

The over-ears are the Aventho 300, which take their place as Beyerdynamic's new flagship headphones. And the in-ears are the Amiron 300. Both products will go on sale this fall.

Here's what you need to know. 

Beyerdynamic Aventho 300 and Amiron 300: key features and price

(Image credit: Beyerdynamic)

Let's start with the over-ears. The Aventho 300 are made with high-grade swivel and foldable aluminum yokes, ultra-light materials and an ergonomic design made for long-wearing comfort. That's important: one of the things I like about my own Beyerdynamics is that I forget they're there.  And thanks to the 50-hour battery life you could be wearing these for a very long time indeed.

Feature-wise there's Bluetooth 5.4 with AAC, LE Audio, aptX Adaptive and aptX Lossless, and you can also use them as cabled headphones. There's hybrid ANC for when you're out and about and Dolby Head Tracking for immersive audio, and the drivers are the STELLAR.45 drivers we previously saw in the Pro X range of open- and closed-back studio headphones. Those headphones have attracted rave reviews – Sound on Sound called them "outstanding" – so these new ones should be something quite special. 

The Amiron 300 are the latest version of Beyerdynamic's true wireless earbuds, and their 10mm dynamic drivers promise pristine audio that, according to the company, "sets the benchmark for true wireless earbuds". There are six microphones for the customizable, adaptive ANC, 10 hours of battery life plus another 28 from the Qi-compatible case, and a shape that's designed to be comfortable even if you're lying down or leaning against the window of an airplane. Bluetooth is 5.3 with multipoint pairing.

The new Aventho 300 over-ears are $399.99 (so around £300 or AU$593) and the Amiron 300 earbuds are $279.99 (which is roughly £212 or AU$415). Both will be available in the fourth quarter of 2024 from Beyerdynamic's e-shop and from Amazon – and we'll certainly be considering them as some of the best earbuds or best noise-cancelling headphones, once we can give you a full review. 

You may also like

• Beyerdynamic also just announced an open-back addition to its gaming headset lineup - the MMX 330 Pro
• In January Beyerdynamic re-released its 39-year-old headphones (again!) and I'd still buy them
• See also our pick of the best wired headphones

Yes, it means we’re moving into Demure Autumn or even PSL Time, but it also indicates seasons themselves are getting warped by meme culture.

Security researchers have found yet another critical vulnerability in the LiteSpeed Cache plugin for WordPress that allows threat actors to take over websites.

Four months after patching an unauthenticated cross-site scripting flaw, the popular optimization plugin was found vulnerable to a bug described as an “unauthenticated account takeover vulnerability”. In other words, an unauthenticated malicious visitor could abuse the hole to gain access to any logged-in user, including admin accounts. That, as you may presume, grants the attacker full access to the website to do with it as they please.

The bug is tracked as CVE-2024-44000, and carries a severity score of 7.5. Version 6.4.1, and all versions before, were said to be vulnerable. A patch has been deployed which brings LiteSpeed Cache to version 6.5.0.1, and users are advised to install it as soon as possible.

Low severity score

Describing how the flaw works, researchers from Patchstack said that LiteSpeed Cache has kept the debug.log file publicly exposed, allowing unauthenticated individuals to view sensitive information found inside. Besides login credentials, the file includes cookie information from HTTP response headers, and more.

The flaw was given a relatively low severity score since the debug feature must be enabled on WordPress, for the flaw to be abusable. It is disabled by default.

"This vulnerability highlights the critical importance of ensuring the security of performing a debug log process, what data should not be logged, and how the debug log file is managed," Patchstack explained.

LiteSpeed Cache is a plugin for the website builder WordPress promising faster page load times, better user experience, and improved Google Search Results Page positions. It is designed to improve website performance by reducing page load times, which it achieves by storing static versions of dynamic content. When a user requests a page, LSCache serves the cached version, minimizing the need for the server to regenerate the page repeatedly. This results in faster response times and reduced server load.

Via The Hacker News

More from TechRadar Pro

• Watch out — hackers can exploit this plugin to gain full control of your WordPress site
• Here's a list of the best firewalls around today
• These are the best endpoint security tools right now

Ohio Democrat Sherrod Brown hopes to keep his Senate seat in increasingly red Ohio by campaigning directly to rural voters. Democrats hope the key to victory is simply losing by less in areas where the GOP dominates.

(Image credit: Rebecca Kiger for NPR)

KitchenAid is famous for its candy-colored Artisan stand mixers (as featured on shows like The Great British Bake Off), but its latest model is something a bit different, with a matt green chassis and real wooden bowl rather than the usual stainless steel. The arboreal look is all finished off with soft brass accents, and small leafy details on the mixer's body.

It's a striking combination, with an equally striking price tag: the Design Series 4.7L Artisan stand mixer in Evergreen will cost home bakers £899 in the UK, or AU$1,149 in Australia (about $1,200).

To put that into context, the regular 4.8L tilt-head Artisan stand mixer (available in a range of soft pastel shades) usually costs $449.99 / £469 / AU$1,049, and is currently discounted to £375.20 / $379.99, AU$879 when bought directly from KitchenAid.

If wood isn't your thing, you might prefer the Design Series Blossom stand mixer from 2022, which had a thyme-green body and a hammered copper bowl with a food-safe interior. It's equally attractive, and currently discounted from £799 to £599.25 in the UK, and from AU$1,149 to AU$999 in Australia. It sells for $699.99 in the US, with $35 off if you sign up for a KitchenAid account.

The Design Series Blossom stand mixer has a hammered copper bowl and a food-safe interior (Image credit: KitchenAid) Shelling out for walnut?

The use of real walnut means each Evergreen mixer's bowl will be slightly different, and will need special care to keep it in good condition. You certainly can't toss it in the dishwasher like I've been doing with my stainless steel bowl for the last 11 years. Instead, KitchenAid advises regular treatment of the bowl with food-safe wood conditioners to keep it looking and working well.

It's supplied with a stainless steel whisk, dough hook and flex edge beater, and is compatible with other mixer attachments including pasta makers, vegetable shredders, meat grinders, and cookie presses.

You might also like

• Shhh - KitchenAid's new coffee makers can brew up to 40 hot and cold drinks, and they're whisper quiet
• Magimix vs KitchenAid: which food processor should you buy?
• Save with KitchenAid promo codes for September

KitchenAid is famous for its candy-colored Artisan stand mixers (as featured on shows like The Great British Bake Off), but its latest model is something a bit different, with a matt green chassis and real wooden bowl rather than the usual stainless steel. The arboreal look is all finished off with soft brass accents, and small leafy details on the mixer's body.

It's a striking combination, with an equally striking price tag: the Design Series 4.7L Artisan stand mixer in Evergreen will cost home bakers £899 in the UK, or AU$1,149 in Australia (about $1,200).

To put that into context, the regular 4.8L tilt-head Artisan stand mixer (available in a range of soft pastel shades) usually costs $449.99 / £469 / AU$1,049, and is currently discounted to £375.20 / $379.99, AU$879 when bought directly from KitchenAid.

If wood isn't your thing, you might prefer the Design Series Blossom stand mixer from 2022, which had a thyme-green body and a hammered copper bowl with a food-safe interior. It's equally attractive, and currently discounted from £799 to £599.25 in the UK, and from AU$1,149 to AU$999 in Australia. It sells for $699.99 in the US, with $35 off if you sign up for a KitchenAid account.

The Design Series Blossom stand mixer has a hammered copper bowl and a food-safe interior (Image credit: KitchenAid) Shelling out for walnut?

The use of real walnut means each Evergreen mixer's bowl will be slightly different, and will need special care to keep it in good condition. You certainly can't toss it in the dishwasher like I've been doing with my stainless steel bowl for the last 11 years. Instead, KitchenAid advises regular treatment of the bowl with food-safe wood conditioners to keep it looking and working well.

It's supplied with a stainless steel whisk, dough hook and flex edge beater, and is compatible with other mixer attachments including pasta makers, vegetable shredders, meat grinders, and cookie presses.

You might also like

• Shhh - KitchenAid's new coffee makers can brew up to 40 hot and cold drinks, and they're whisper quiet
• Magimix vs KitchenAid: which food processor should you buy?
• Save with KitchenAid promo codes for September

The Narwal Freo Z Ultra is a new robot vacuum that has been unveiled at IFA 2024. It's "designed to tackle complex home messes", and to do so, Narwal has packed in a whole load of AI features... and added a little fluffy tail. 

I'll start with the techy bits. The Freo Z Ultra uses AI to avoid obstacles, adapt its cleaning process to the type and amount of dirt there is on the floor, and to choose which temperature to mop at. All that intelligence requires some serious processing power, and Narwal says it's equivalent to an Xbox in that respect. It comes with two separate CPUs – a main one and another dedicated just to AI.

Today's best robot vacuums are increasingly clever, but the Freo Z Ultra has some features we've never seen before. For example, it's the first robovac on the market to feature two RGB cameras, rather than your standard 'one camera and a light' setup, enabling it to capture an 136-degree view at 1,600 x 1,200 resolution. That combines with dual AI chips to offer superior object identification (and avoidance, if necessary). 

(Image credit: Future)

Alongside those cutting-edge smarts is a more old-school addition: a baseboard cleaning tool, which is essentially a little fluffy tail that clips on to the side of the robovac and gently dusts your baseboards when it gets close to the edge of the room. It's an optional extra rather than being included as standard. I saw a demo and it's a super-simple but clever little innovation that adds an extra level of cleaning power. It also looks really cute.

Better identification

Back to the techy bit. Lots of high-end robovacs are designed to recognize common objects, but the Narwal's object-identification list is far longer than most, taking in over 120 common objects, from furniture legs to toys and even plastic bags. 

That means it can apply human-like cleaning decisions in response, delivering a more complete clean because it's not giving everything a wide berth by default. So if it identifies a chair leg, it knows to get as close to it as possible. In contrast, if the mess is a pet poop, it will navigate around it and absolutely not try to get as close as possible. For things like tissues and cables, it knows to retract the roller brush so it doesn't end up in a tangle. 

(Image credit: Future)

Better obstacle avoidance means you shouldn't have to tidy up before launching your robovac (good news, because the benefits of remote control are somewhat negated when your robovac ends up tangled in a rogue charging cable and in need of manual rescue 10 minutes into its cleaning routine). For the times when you do want to use it when you're home, it's designed to be even better at operating around people and pets, again thanks to AI.

There's even a mode you can use where the robot will see a pet in one area of your home, and delay cleaning that area until the pet has moved on. It'll then deep-clean that area to get rid of any extra hair or general messes your pet might have made on its travels.

Clean bandit

There are more human-like features in the Freo Z Ultra's approach to cleaning. For example, it knows if the mess is dry or wet, and chooses the best cleaning approach in response. For dry cleanup jobs, it can unleash up to 12,000 PA of suction (about the highest we've seen on any robovac).

In line with its aquatic name, Narwal has put more effort than most into the mopping side of things. Its rotating mops will applying downward pressure – up to 'an industry leading 12N' of it – to scrub off dirt. It'll also approach different floor types in different ways, so it'll add more water and apply more pressure when cleaning a ceramic tiled floor compared to a wooden one. 

If your hard floor is super dirty, it'll sense that, and extend mopping times in response. If that spillage is a heavy, dirty liquid, it'll just mop it and return to the dock to clean the mop pads afterwards. Alternatively, if it's clean enough to just need a light mop, it'll use less water too. 

Mopping temperature adjusts automatically between 45C and 75C, depending on the type of mess. So cooler water for dusty messes, hotter for greasy spillages. After cleaning, the temperature will rise to the maximum 75C anyway, to kill off bacteria (a process that Narwal refers to, accurately but unsettlingly, as 'pasteurization').

(Image credit: Future)

The smarter your home appliances get, the more security concerns start to seem like a real threat. To try and put people's minds at ease, Narwal's storage and computation chip operates entirely offline, with all information being stored within the robot itself (main CPU computation does use an internet connection, but is handled separately). 

The Narwal Freo Z Ultra is available to buy in the US for a list price of $1,499.99 (current early bird price $1,099.99) and Australia for AU$2,499 (current early bird price AU$2,099).

You might also like...

• 6 cool new robvac features coming your way
• Roborock's new robovac has suspension like a quad bike
• Is it worth getting a robot vacuum?

The Narwal Freo Z Ultra is a new robot vacuum that has been unveiled at IFA 2024. It's "designed to tackle complex home messes", and to do so, Narwal has packed in a whole load of AI features... and added a little fluffy tail. 

I'll start with the techy bits. The Freo Z Ultra uses AI to avoid obstacles, adapt its cleaning process to the type and amount of dirt there is on the floor, and to choose which temperature to mop at. All that intelligence requires some serious processing power, and Narwal says it's equivalent to an Xbox in that respect. It comes with two separate CPUs – a main one and another dedicated just to AI.

Today's best robot vacuums are increasingly clever, but the Freo Z Ultra has some features we've never seen before. For example, it's the first robovac on the market to feature two RGB cameras, rather than your standard 'one camera and a light' setup, enabling it to capture an 136-degree view at 1,600 x 1,200 resolution. That combines with dual AI chips to offer superior object identification (and avoidance, if necessary). 

(Image credit: Future)

Alongside those cutting-edge smarts is a more old-school addition: a baseboard cleaning tool, which is essentially a little fluffy tail that clips on to the side of the robovac and gently dusts your baseboards when it gets close to the edge of the room. It's an optional extra rather than being included as standard. I saw a demo and it's a super-simple but clever little innovation that adds an extra level of cleaning power. It also looks really cute.

Better identification

Back to the techy bit. Lots of high-end robovacs are designed to recognize common objects, but the Narwal's object-identification list is far longer than most, taking in over 120 common objects, from furniture legs to toys and even plastic bags. 

That means it can apply human-like cleaning decisions in response, delivering a more complete clean because it's not giving everything a wide berth by default. So if it identifies a chair leg, it knows to get as close to it as possible. In contrast, if the mess is a pet poop, it will navigate around it and absolutely not try to get as close as possible. For things like tissues and cables, it knows to retract the roller brush so it doesn't end up in a tangle. 

(Image credit: Future)

Better obstacle avoidance means you shouldn't have to tidy up before launching your robovac (good news, because the benefits of remote control are somewhat negated when your robovac ends up tangled in a rogue charging cable and in need of manual rescue 10 minutes into its cleaning routine). For the times when you do want to use it when you're home, it's designed to be even better at operating around people and pets, again thanks to AI.

There's even a mode you can use where the robot will see a pet in one area of your home, and delay cleaning that area until the pet has moved on. It'll then deep-clean that area to get rid of any extra hair or general messes your pet might have made on its travels.

Clean bandit

There are more human-like features in the Freo Z Ultra's approach to cleaning. For example, it knows if the mess is dry or wet, and chooses the best cleaning approach in response. For dry cleanup jobs, it can unleash up to 12,000 PA of suction (about the highest we've seen on any robovac).

In line with its aquatic name, Narwal has put more effort than most into the mopping side of things. Its rotating mops will applying downward pressure – up to 'an industry leading 12N' of it – to scrub off dirt. It'll also approach different floor types in different ways, so it'll add more water and apply more pressure when cleaning a ceramic tiled floor compared to a wooden one. 

If your hard floor is super dirty, it'll sense that, and extend mopping times in response. If that spillage is a heavy, dirty liquid, it'll just mop it and return to the dock to clean the mop pads afterwards. Alternatively, if it's clean enough to just need a light mop, it'll use less water too. 

Mopping temperature adjusts automatically between 45C and 75C, depending on the type of mess. So cooler water for dusty messes, hotter for greasy spillages. After cleaning, the temperature will rise to the maximum 75C anyway, to kill off bacteria (a process that Narwal refers to, accurately but unsettlingly, as 'pasteurization').

(Image credit: Future)

The smarter your home appliances get, the more security concerns start to seem like a real threat. To try and put people's minds at ease, Narwal's storage and computation chip operates entirely offline, with all information being stored within the robot itself (main CPU computation does use an internet connection, but is handled separately). 

The Narwal Freo Z Ultra is available to buy in the US for a list price of $1,499.99 (current early bird price $1,099.99) and Australia for AU$2,499 (current early bird price AU$2,099).

You might also like...

• 6 cool new robvac features coming your way
• Roborock's new robovac has suspension like a quad bike
• Is it worth getting a robot vacuum?

Video and audio of therapy sessions, transcripts, and other patient records were accidentally exposed in a publicly accessible database operated by the virtual medical company Confidant Health.

Motorola has already unveiled a couple of flip foldables this year – our Motorola Razr Plus 2024 review will get you up to speed on one of them – but it looks like another model is on the way, based on newly spotted regulatory filings.

A device known as the Motorola Razr 50s has shown up for HDR 10+ certification, as spotted by MySmartPrice, so at least we know one of the HDR (High Dynamic Range) formats that the new handset is going to support.

What we don't get are any more details about what this phone might bring with it. However, the 's' in the name suggests this might be an even more affordable version of the Motorola Razr 2024 (known as the Motorola Razr 50 outside the US).

The Motorola Razr 2024 (or Motorola Razr 50) retails for $699.99 / £799.99 (about AU$1,050, though you can't buy it in Australia at the moment), so we're hoping the new version manages to come in at a significantly more affordable price point.

Flip foldables for 2024

The Galaxy Z Flip 6 (Image credit: Philip Berne / Future)

You'd be forgiven for being a little confused by the current flip foldable offerings from Motorola: this year we've seen the tech manufacturer launch the Razr 2024 and the more advanced Razr Plus 2024, both sharing the same dimensions and 6.9-inch screen size.

If you're not in the US, you'll see those phones marketed as the Motorola Razr 50 and the Motorola Razr 50 Ultra. It's not clear exactly where the Razr 50s might fit in – last year we got two Moto flip phones, including the Motorola Razr 2023, with no 's' variant.

The main competitor here is of course the flip foldable made by Samsung, and our Samsung Galaxy Z Flip 6 review will tell you all you need to know about that particular device. It's a formidable competitor too, with not much to complain about.

Samsung's handset does retail for $1,099.99 / £1,049 / AU$1,799 and up however, so Motorola is already undercutting it on price – and may take that even further with the Razr 50s, which should be officially unveiled before too long.

You might also like

• These are the best foldable phones you can buy
• Samsung Galaxy Z Flip 6 vs Motorola Razr Plus 2024
• The Apple iPhone 16 is almost here

According to new research from ServiceNow, the UK job market could be set to undergo a major transformation with the creation of 610,000 new roles by 2028 thanks to advancements in AI.

The research, based on the analysis of data from various work markets via machine learning, explores the effects of artificial intelligence across different sectors.

ServiceNow reveals the technology’s impact on the technology, media and telecomms sectors, which will collectively account for an estimated 320,000 roles by 2029.

AI to have major effect on UK jobs market

Moreover, education (190,000) and healthcare (90,000) could be set for added roles.

Alarmingly, the study depicts artificial intelligence’s negative effects on the job market too, which many workers seemingly facing a threat from the technology. The retail sector could see the loss of 240,000 jobs by 2028, with manufacturing (90,000) and financial services (50,000) also losing out considerably.

Daniel Stirrett, Group VP & GM UK & Ireland, said: “Like other technologies before it, on one hand AI will disrupt the workforce, and on the other, create a net-positive gain in employment.”

Besides the creation of new jobs, ServiceNow’s report highlights the productivity benefits that existing workers could unlock. In the tech sector, the company estimates that the average system administrator could gain up to 12.6 hours weekly.

These emerging technologies will need implementation and maintenance, which is why a further 400,000 roles are expected to be created. Those looking to upskill in anticipation of new role creation should consider getting into computer and information system management, development, and data engineering.

On the whole, ServiceNow believes that the global workforce will mostly grow, except for ageing populations such as Germany and Japan. By tackling the perception that AI could be taking human jobs, the report reveals emerging markets and a shift in workforces, rather than eliminating workers entirely.

More from TechRadar Pro

• These are the best job sites and best recruitment platforms
• Prepare for the future with the best online learning platforms
• Businesses are willing to pay more to hire people with the right AI skills

Several benchmark refinance rates fell. If you're hoping to refinance your home, keep an eye out for lower rates.

A couple of major mortgage rates are decreasing. Here's what to know if you're in the market for a home loan.

Yoga mats need regular maintenance. Here's how to clean it the right way, without harsh chemicals.