mi ETSI’s Securing AI group becomes a Technical Committee to help ETSI to answer the EU AI Act By www.etsi.org Published On :: Tue, 17 Oct 2023 16:01:10 GMT Sophia Antipolis, 17 October 2023 As the second term of the Industry Specification Group Securing AI (ISG SAI) is scheduled to conclude in Q4 2023, and in line with ETSI's commitment to AI and SAI, the group has suggested the closure of ISG SAI, with its activity transferred to a new ETSI Technical Committee, TC SAI. Read More... Full Article
mi ETSI Mission Critical testing event reports a 95% success rate By www.etsi.org Published On :: Wed, 22 Nov 2023 09:34:28 GMT Sophia Antipolis, 22 November 2023 The Report of the eight MCX Plugtests™ event that took place from 9 October to 13 October 2023 at University of Malaga (UMA) is now available. The Report shows a success rate of 95% interoperability of the 3GPP mission critical services executed tests. Read More... Full Article
mi 3GPP Commits to Develop 6G Specifications By www.etsi.org Published On :: Wed, 06 Dec 2023 09:39:04 GMT As the project celebrates the 25th anniversary of the signing of the 3GPP Project Agreement, the 3GPP Organizational Partners have today issued the following joint press release. Sophia Antipolis, 4 December 2023 With its work on 3G, 4G and 5G specifications used by billions of communications services consumers globally, 3GPP stands ready to create the 6G future. Read More... Full Article
mi ETSI's Committee on Securing AI Decides on New Work By www.etsi.org Published On :: Thu, 07 Dec 2023 15:55:23 GMT Sophia Antipolis, 7 December 2023 In order to have the capability to directly contribute to standardization requests, which may include, but not limited to, the future AI Act, Cybersecurity Resilience Act and NIS2, it was decided to transfer the SAI Industry Specification Group into a Technical Committee. Read More... Full Article
mi ETSI Releases Ground-breaking Technical Report to mitigate technology-enabled Coercive Control By www.etsi.org Published On :: Fri, 12 Apr 2024 09:02:36 GMT Sophia Antipolis, 31 January 2024 The European Telecommunications Standards Institute (ETSI) has published a significant new technical report, "ETSI TR 103 936 V1.1.1 (2024-01): Cyber Security; Implementing Design Practices to Mitigate Consumer IoT-Enabled Coercive Control". This pioneering document addresses the increasingly important issue of safeguarding individuals from coercive control through the misuse of consumer Internet of Things (IoT) devices. Coercive control encompasses a range of abusive acts such as security breaches, privacy invasions, harassment, physical assault, and other patterns of behaviour that can limit autonomy or cause emotional harm to potential targets. Read More... Full Article
mi Aiming high: ETSI Conference on Non-Terrestrial Networks underlines critical role of NTN in realizing tomorrow’s global 6G vision By www.etsi.org Published On :: Tue, 16 Apr 2024 08:12:24 GMT Sophia Antipolis, 15 April 2024 This year’s first ETSI Conference on Non-Terrestrial Networks has stressed the importance of technical standardization in delivering a fully connected planet via NTN, a key element of tomorrow’s global 6G networks. Held from 3-4 April 2024 at ETSI’s Sophia Antipolis headquarters, the event was co-organized with the European Space Agency (ESA), the 6G Smart Networks and Services Industry Association (6G-IA) and the Smart Networks and Services Joint Undertaking (SNS JU). Titled ‘Non-Terrestrial Networks, a Native Component of 6G’, the 2-day conference attracted over 200 participants from 25 countries, including experts in standardization and research as well as industrial representation from the mobile, satellite and wider space industries. Delegates shared perspectives on NTN use cases, candidate technology solutions, current research status and standardization roadmaps. Day one sessions focused on the opportunities and challenges of integrating terrestrial and non-terrestrial networks within tomorrow’s global communications landscape. The second day afforded a deep dive into numerous cutting-edge NTN and 6G research & development initiatives in Europe and around the world. Read More... Full Article
mi A Galaxy Within: Single-Cell Genomics Open a New Frontier to Understanding the Brain By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Thu, 14 Nov 2024 20:00:00 -050011/14/2024 06:00:00PMLocation: montreal, Canada Full Article
mi Inspire & Network: McGill Alumni and International Student Mixer By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Fri, 22 Nov 2024 19:00:00 -050011/22/2024 05:00:00PMLocation: Montreal, Canada Full Article
mi MAA of Brome-Missisquoi Holiday Season Gathering By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Sat, 30 Nov 2024 20:00:00 -050011/30/2024 05:00:00PMLocation: Lac-Brome (Knowlton), Canada Full Article
mi San Francisco Bay Area Holiday Party - Don't Miss the Fun! By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Sun, 08 Dec 2024 18:30:00 -050012/08/2024 04:30:00PMLocation: San Mateo, U. S. A. Full Article
mi How Slavery Affected African American Families By nationalhumanitiescenter.org Published On :: Tue, 27 Jul 2010 14:11:14 -0400 New essay, "How Slavery Affected African American Families," by Heather Andrea Williams, associate professor of history at the University of North Carolina at Chapel Hill, added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
mi Notice of Coming into Force of National Instrument 93-101 Derivatives: Business Conduct By www.osc.ca Published On :: Thu, 26 Sep 2024 13:51:06 GMT National Instrument 93-101 Derivatives: Business Conduct (the Rule) will come into force on September 28, 2024 (the Effective Date), pursuant to section 143.4 of the Securities Act (Ontario). Full Article
mi Notice of Ministerial Approval of Amendments to OSC Rule 91-507 Trade Repositories and Derivatives Data Reporting and Consequential Amendments to OSC Rule 13-502 Fees By www.osc.ca Published On :: Thu, 10 Oct 2024 14:22:57 GMT The Minister of Finance has approved amendments to Ontario Securities Commission (OSC) Rule 91-507 Trade Repositories and Derivatives Data Reporting and consequential amendments to OSC Rule 13-502 Fees (collectively, the Amendments) pursuant to Full Article
mi OSC Staff Notice 11-737 (Revised) – Securities Advisory Committee – Vacancies By www.osc.ca Published On :: Thu, 17 Oct 2024 13:10:29 GMT The Securities Advisory Committee (“SAC”) is a committee of industry experts established by the Commission to advise it and its staff on a variety of matters including policy initiatives and capital markets trends. Full Article
mi Ontario Securities Commission – Coordinated Blanket Order 96-932 By www.osc.ca Published On :: Wed, 30 Oct 2024 18:21:33 GMT This document is only available as a PDF. Full Article
mi Manager, Administration & Corporate Services By phf.tbe.taleo.net Published On :: Fri, 10 Nov 2023 19:03:03 GMT Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as Manager of Administration & Corporate Services for a one-year, renewable appointment in the Finance and Administration Division. The Manager of Administration & Corporate Services AFR is responsible for the overall coordination of administrative matters between IFPRI's headquarters in Washington DC and the IFPRI regional and country/project offices in Africa. The position provides management and operational support to IFPRI regional and country/project offices in Africa including related administrative aspects of current and new corporate partnerships in Africa. This position is based in Dakar, Senegal. Essential Duties: Specific Duties include but are not limited to: Lead finance and administration functions of the Dakar office, providing operational support and oversight of day-to-day office activities. Provide management support and oversight of the financial and administrative operations of IFPRI Regional and country/project offices in Africa, including functions such as budgeting, contracts and grants, human resources, facilities and IT management. Work closely with key administrative departments at IFPRI headquarters for accounting, human resources, computer services and facilities/office services, in the development of and roll-out of IFPRI-wide policy and procedure changes, providing guidance and training as needed to regional and country offices to ensure that the quality of operational support meets IFPRI operations standards. Regular analysis of operations capacity of IFPRI offices in Africa, identifying and making recommendations regarding opportunities for improvement in IFPRI’s administrative operations and processes, and undertaking new initiatives as agreed. Build strong relationships with Country Office Heads and Country Administrative and Finance Managers, providing advice, guidance, and support in all areas of operations and ensuring compliance with IFPRI policies and procedures. Financial reporting oversight for IFPRI regional and country offices in Africa, and supervision and management of the Hub Finance and Administration unit team, ensuring compliance with IFPRI and donor standards, policies and procedures and processes. Participation in the formulation of annual budgets and capital plans for IFPRI offices in Africa. Provide management oversight to ensure that proper financial controls are in place and processes are compliant with correct accounting procedures, providing strategic direction in developing options for addressing any weaknesses. Monitor projects in African locations on an as required basis. Facilitate decision-making on human resource (HR) matters relating to IFPRI offices in Africa (policies and procedures, labor law compliance, staffing, recruitment, conflict resolution, etc.) Work to build the capacity of finance, administrative staff members throughout IFPRI offices in Africa through regular training sessions and mentoring support. Contribute to the internal and external audit preparations for IFPRI offices in Africa and provide support on the implementation of audit recommendations and actions. Required Qualifications: Bachelor’s degree plus twelve years of relevant professional experience or Master’s degree plus ten years of relevant experience. Minimum of four years management experience. Excellent verbal, written and interpersonal skills. Strong customer service skills. Ability to work effectively with all levels of organizations, including regional partners and donors. Ability to work autonomously, yet keep others informed. Ability to work in a multicultural setting. Excellent attention to details. Fluency in French is highly preferred. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time with little opportunity to move/stretch Employee will lift between 0-10 pounds Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
mi Administrative Coordinator By phf.tbe.taleo.net Published On :: Tue, 06 Aug 2024 13:25:08 GMT Job Summary : The Director General’s Office (DGO) of the International Food Policy Research Institute (IFPRI) seeks an Administrative Coordinator (AC) for one-year, non-exempt, renewable appointment. The Executive Assistant to Director General will be responsible for the AC’s work plan and performance evaluation, subject to the approval of the Director General. This position is based at IFPRI headquarters in Washington, D.C. Essential Duties The AC’s main duties and responsibilities include (a) providing administrative support to the Executive Assistant and other DGO staff (as needed), and (b) coordinating logistics for the following: Travel arrangement: Travel planner form, visa applications, request for itineraries, issuance of air and/or train tickets, cash advances/honoraria, and preparation of travel expense reports. Meetings: Coordinate arrangements for organizing special events, including lunches, meetings and conferences. This function will include room reservation, organizing meeting materials, presentation requirements, setting up teleconference and virtual calls, and catering. Visitors: Coordinating visits of high-level guests to IFPRI such as who else from staff will join the meeting, ordering of food for breakfast or lunch as necessary, office/hotel reservation, pick-up and return of office keys, computer connections, assigned office name tag/labeling, and arrangement for brown bag/seminar/presentation. DG’s contact database: Ensure that the database is current through regular maintenance/updating and accurate data entry of business cards from the DG’s travels. Office supplies: Maintain adequate supply of commonly used/requested items for the division’s use. Service Center assistance, which includes but not limited to the following: Photocopying/printing/scanning Letters/mails - for fax, pick-up and distribution, maintain an updated pigeonhole assignment for DGO staff. Orderliness and adequate supplies are available for printers, photo-copying machine and coffee service. Files: Create and maintain a complete, updated and functional filing system for DGO records and perform periodic filing of DG documents and archiving. Other duties and responsibilities that may be required from time to time. It is expected that the AC will: Handle multiple tasks and prioritizes work with minimal supervision. Pay attention to detail and follows through to closure. Be able to work in a fast-paced, multicultural environment, and follow established procedures. Perform other duties/assignments as necessary. Required Qualifications : Bachelor’s degree or associate’s degree plus three years of administrative work experience, or high school diploma plus four years of relevant experience. Excellent oral and written English language skills. Solid composition, grammar and proofreading skills with the ability to compose correspondence. Demonstrated experience handling confidential matters. Demonstrated expertise with financial information. Demonstrated proficiency with computers: Experience with MS Office, especially Microsoft Word, Outlook, Excel and PowerPoint required. Excellent typing skills required; 50-65 wpm preferred. Demonstrated ability to work productively within a multi-cultural team environment. Ability to handle multiple tasks and prioritize work responsibly with minimal supervision. Demonstrated ability to pay attention to detail and follow-through to closure. Demonstrated experience working in a fast-paced work environment. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range : The expected salary range for this job requisition is between $23.37 - $28.65/hour. In determining your salary, we will consider your experience and other job-related factors. Benefits : IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. IFPRI Washington D.C. has a hybrid work environment that allows staff members a minimum of two days (preference for 3 days) in-office work and the remaining two to three days remote work. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
mi Administrative Coordinator I By phf.tbe.taleo.net Published On :: Thu, 26 Sep 2024 16:00:49 GMT Job Summary: The Market, Trade, and Institutions Unit of the International Food Policy Research Institute (IFPRI) seeks an Administrative Coordinator I to provide administrative support. This is a one-year, non-exempt, renewable appointment and is located at IFPRI’s Headquarters in Washington, D.C. Essential Duties: Specific duties and responsibilities include but are not limited to: Document Support : Edit and/or transcribe reports, manuscripts, and other documents as needed, for the unit staff. Project Logistical Coordination : Draft and monitor contracts for collaborators and services. Accounting Support : Prepare travel and field expense reports. File & monitor project budgets, collaborator and donor-approved budget expenditures, and sub-contracts. Travel arrangement: Prepare hotel and travel requests for staff and visitors, assist in coordinating visa applications, request for itineraries, and issuance of air and/or train tickets, cash advances/honoraria, and preparation of travel expense reports. Coordinate with Travel Office & Accounting for processing travel requests. Meetings : Coordinate arrangements for organizing special events, including lunches, meetings, conferences, and other training events. This function will include room reservation, organizing meeting materials, presentation requirements, setting up teleconferences, catering, and taking/taping and/or transcribing minutes of meetings, as needed. Appointment schedule & Visitors’ Support : Manage appointment scheduling for Research fellows as requested and provide logistical support for visitors, to include office/hotel reservation, pick-up, and return of office keys, computer connections, assigned office name tag/labeling, and arrangement for brown bag/seminar/presentation. Contact Data Base Support : Maintain various administrative/unit database including Collaborator & Project main list, staff contact/emergency file, and other master files. Outposted Staff Administrative Support : Provide administrative support to outposted staff, as applicable. Mail Support : If requested, manage incoming & outgoing mail and monitor equipment inventory. Perform other duties as assigned. Required Qualifications: Bachelor's degree; or Associate's degree plus three years of relevant experience; or high school diploma plus four years of relevant experience. Excellent oral and written English language skills. Solid composition, grammar and proofreading skills with the ability to compose correspondence. Demonstrated experience handling confidential matters. Demonstrated expertise with financial information. Familiarity with monitoring/managing project budgets and contracts. Demonstrated proficiency with computers: Experience with MS Office, especially Microsoft Word, Outlook, Excel and PowerPoint required. Excellent typing skills required; 50-65 wpm preferred. Demonstrated ability to work productively within a multi-cultural team environment. Ability to handle multiple tasks and prioritize work responsibly with minimal supervision. Demonstrated ability to pay attention to detail and follow-through to closure. Demonstrated experience working in a fast-paced work environment. Preferred Qualifications: Proficiency in a second language of the U.N. system Physical Demand & Work environment: Employee will sit in an upright position for a long period of time with little opportunity to move/stretch. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range : The expected salary range for this job requisition is between $23.37 - $28.65/hour. In determining your salary, we will consider your experience and other job-related factors. Benefits : IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website . Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. IFPRI Washington D.C. has a hybrid work environment that allows staff members a minimum of two days (preference for 3 days) in-office work and the remaining two to three days remote work. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity Full Article
mi Director of Finance and Administration By phf.tbe.taleo.net Published On :: Tue, 08 Oct 2024 12:47:33 GMT Job Summary: The International Food Policy Research Institute (IFPRI), an international non-profit, research organization with over 600+ employees worldwide, seeks a Director of Finance and Administration to oversee the institute’s annual budget of USD 100+ million and lead the finance and administration services across the institute including Finance, IT Services, Travel and Facilities. The Director of Finance and Administration is a member of the Senior Management Team and reports to the Director General. The ideal candidate should be an excellent leader, people person, strategic communicator and relationship builder who can thrive in a complex, fast-changing environment. This is a three-year, full-time, exempt, renewable appointment and involves international travel, particularly to developing countries. This position could be based at IFPRI’s headquarters located in Washington, DC (preferred), Nairobi, Kenya or New Delhi, India. Essential Duties: Specific duties include but are not limited to: Provides information and advice to the IFPRI’s Board and senior management to ensure that the financial and physical resources of the institute are managed optimally and sustainably. Ensures that an effective framework is in place for informed decision making including the appropriate financial and risk management strategies, internal and external audits, compliance policies, corporate financial planning and reporting. Oversees the preparation and timely distribution of the Institute’s annual budget, long-term forecasts, including base case and downside scenario planning, and regular financial and management reports in accordance with internal, external and statutory obligations Directly supervises the senior corporate services managers (Finance, IT Services, Facilities, and Travel). Leads, manages and supports all managers in carrying out their duties by providing them with information, advice, general support and capacity building as needed. Monitors budget and expense trends; recommends and implements corrective actions as required. Reviews financial policies, procedure and practices; recommends improvements to financial processes and controls. Develops and implements systems that ensure the smooth operations of central administration. Work closely with the CGIAR Corporate Service Heads and at the One CGIAR System Office. Oversees all space and lease functions. Primarily responsible for IFPRI’s risk management system including oversight of IFPRI’s operations in Africa and Asia. Ensures that Finance and Corporate Service units in all IFPRI locations are appropriately staffed, well led and managed for performance. Ensure continuous improvement in the service delivery from these units. Required Qualifications: CPA/MBA or equivalent; minimum of fifteen years of relevant experience at the senior management level. Demonstrated leadership, management, and supervisory skills including the ability to recommend or make decisions, including difficult ones, in a complex, changing environment. Excellent planning and organizational skills, as well as attention to detail. Broad knowledge of finance and corporate service functions. Senior level experience in contract administration. Managerial experience in a non-profit, research, and/or international organization. Excellent written and verbal English communication skills. Demonstrated ability to work in multi-cultural settings and to build productive relationships with diverse internal and external stakeholders. Willingness and ability to travel internationally, particularly to developing countries (15-20%). Essential personal qualities: integrity, responsiveness and decisiveness. Preferred Qualifications: Knowledge of or experience with the CGIAR Understanding of US GAAP AND IFRS Experience in donor relations Proficiency in a second language of the U.N. system Physical Demand and Work Environment: Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary ranges for this job requisition are between $ 188,900 - $231,400. In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity. Full Article
mi Finance and Administrative Coordinator By phf.tbe.taleo.net Published On :: Fri, 11 Oct 2024 21:08:35 GMT Job Summary: The International Food Policy Research Institute (IFPRI) seeks a Finance & Administrative Coordinator for its Development Strategies and Governance Unit (DSG). This is a one-year, renewable appointment and is located at IFPRI’s South Asia Office in India. This position will work within the DSG department in providing support with travel organization, contract drafting & monitoring, revision of deliverables, financial reports, and invoices; workshops, edit narratives; close contracts and projects. Interested applicants must have work authorization to work in India. Essential Duties and Responsibilities Project Logistical Coordination : Provide logistical coordination for project activities, to include drafting and monitoring of project subcontracts, for complex Divisional projects. Monitor deadlines and coordinate the receipt of collaborator deliverables and submission of donor deliverables as requested. Accounting Support : Prepare travel and field expense reports. File & monitor project budgets, collaborator and donor-approved budget expenditures, and sub-contracts. Submit and monitor collaborator invoices upon submission/approval of deliverables. Monitor weekly unit payments and submit updates to vendors and/or PM/PL/ project coordinators. Follow-up and process invoices from centers that host Group staff. Assist, as needed, on provision of monthly General Ledgers (GLs)/Project Summary Report (PSRs) to PM/PLs. Submit/correct project-related expense adjustments (as needed) Contact Data Base Support: Maintain various administrative/unit database including Collaborator & Project main list, staff contact/emergency file, and other master files. Monitor SAC calendar to identify: Project end-dates and eventual closeout. Provide project budget burn rates to projects leaders upon request. Electronic filing of documents. Closeout collaborator and sub-contractor contracts after detailed verification that all deliverables have been received and all funds have been disbursed, filling in the checklist, obtaining the Project Leader signature, and importing the Close Out Form onto D4D. Timely preparation of periodic financial reports and invoices for a range of donors. Monitor billed and unbilled receivables for delinquent payments and billable cost. Data Entry in Tally and Finalization of accounts books as per Indian Accounting standards. Review monthly project status reports. Address internal and external inquiries regarding project financial matters. Assist with annual statutory audit. Other duties as assigned. Required Qualifications: Bachelor’s degree in accounting/finance plus two years of relevant experience or associate’s degree plus five years of relevant experience. Preference would be given to Intermediate/pursuing CA/CS/CWA. Knowledge of Tally is preferable. Demonstrated proficiency with computers: experience with MS Office, especially Microsoft Word, Outlook, Excel, and PowerPoint required. Strong analytical skills. Demonstrated ability to work productively within a multi-cultural team environment. Excellent oral and written communications skills. Demonstrated ability to pay diligence and follow-through to closure. Demonstrated experience working in a fast-paced work environment. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activity such as: preparing and analyzing data and figures; viewing computer terminal; extensive reading. Full Article
mi Policy Seminar | Debt Distress and the Right to Food in Africa By www.youtube.com Published On :: Thu, 3 Oct 2024 03:15:37 GMT Full Article
mi From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25 By www.tenable.com Published On :: Tue, 22 Oct 2024 11:11:11 -0400 Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.BackgroundIn January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.25 Significant CVEsCVE-1999-0211: SunOS Arbitrary Read/Write VulnerabilityArbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.CVE-2010-2568: Windows Shell Remote Code Execution VulnerabilityRemote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.CVE-2014-0160: OpenSSL Information Disclosure VulnerabilityHeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.CVE-2014-6271: GNU Bash Shellshock Remote Code Execution VulnerabilityShellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.CVE-2015-5119: Adobe Flash Player Use After FreeRemote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.CVE-2017-0144: Windows SMB Remote Code Execution VulnerabilityEternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.CVE-2019-0708: Remote Desktop Services Remote Code Execution VulnerabilityBlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution VulnerabilitySMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution VulnerabilityPath TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.CVE-2019-10149: Exim Remote Command Execution VulnerabilityRemote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.CVE-2020-1472: Netlogon Elevation of Privilege VulnerabilityZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass VulnerabilitySpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load VulnerabilityMeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.CVE-2021-36942: Windows LSA Spoofing VulnerabilityPetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code ExecutionFollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).CVE-2021-44228: Apache Log4j Remote Code Execution VulnerabilityLog4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution VulnerabilityPrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure VulnerabilityCitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection VulnerabilityRemote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”CVE-2024-3094: XZ Utils Embedded Malicious Code VulnerabilityEmbedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:CVE-1999-0211CVE-2010-2568CVE-2014-0160CVE-2014-6271CVE-2015-5119CVE-2017-11882CVE-2017-0144CVE-2017-5638CVE-2019-0708CVE-2020-0796CVE-2019-19781CVE-2019-10149CVE-2020-1472CVE-2017-5753CVE-2017-5754CVE-2021-36942CVE-2022-30190CVE-2021-44228CVE-2021-26855CVE-2021-34527CVE-2021-27101CVE-2023-34362CVE-2023-4966CVE-2023-2868CVE-2024-3094 Full Article
mi Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039) By www.tenable.com Published On :: Tue, 12 Nov 2024 14:02:10 -0500 4Critical82Important1Moderate0LowMicrosoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.Microsoft patched 87 CVEs in its November 2024 Patch Tuesday release, with four rated critical, 82 rated important and one rated moderate.This month’s update includes patches for:.NET and Visual StudioAirlift.microsoft.comAzure CycleCloudAzure Database for PostgreSQLLightGBMMicrosoft Exchange ServerMicrosoft Graphics ComponentMicrosoft Office ExcelMicrosoft Office WordMicrosoft PC ManagerMicrosoft Virtual Hard DriveMicrosoft Windows DNSRole: Windows Hyper-VSQL ServerTorchGeoVisual StudioVisual Studio CodeWindows Active Directory Certificate ServicesWindows CSC ServiceWindows DWM Core LibraryWindows Defender Application Control (WDAC)Windows KerberosWindows KernelWindows NT OS KernelWindows NTLMWindows Package Library ManagerWindows RegistryWindows SMBWindows SMBv3 Client/ServerWindows Secure Kernel ModeWindows Task SchedulerWindows Telephony ServiceWindows USB Video DriverWindows Update StackWindows VMSwitchWindows Win32 Kernel SubsystemRemote code execution (RCE) vulnerabilities accounted for 58.6% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29.9%.ImportantCVE-2024-43451 | NTLM Hash Disclosure Spoofing VulnerabilityCVE-2024-43451 is a NTLM hash spoofing vulnerability in Microsoft Windows. It was assigned a CVSSv3 score of 6.5 and is rated as important. An attacker could exploit this flaw by convincing a user to open a specially crafted file. Successful exploitation would lead to the unauthorized disclosure of a user’s NTLMv2 hash, which an attacker could then use to authenticate to the system as the user. According to Microsoft, CVE-2024-43451 was exploited in the wild as a zero-day. No further details about this vulnerability were available at the time this blog post was published.This is the second NTLM spoofing vulnerability disclosed in 2024. Microsoft patched CVE-2024-30081 in its July Patch Tuesday release.ImportantCVE-2024-49039 | Windows Task Scheduler Elevation of Privilege VulnerabilityCVE-2024-49039 is an EoP vulnerability in the Microsoft Windows Task Scheduler. It was assigned a CVSSv3 score of 8.8 and is rated as important. An attacker with local access to a vulnerable system could exploit this vulnerability by running a specially crafted application. Successful exploitation would allow an attacker to access resources that would otherwise be unavailable to them as well as execute code, such as remote procedure call (RPC) functions.According to Microsoft, CVE-2024-49039 was exploited in the wild as a zero-day. It was disclosed to Microsoft by an anonymous researcher along with Vlad Stolyarov and Bahare Sabouri of Google's Threat Analysis Group. At the time this blog post was published, no further details about in-the-wild exploitation were available.ImportantCVE-2024-49019 | Active Directory Certificate Services Elevation of Privilege VulnerabilityCVE-2024-49019 is an EoP vulnerability affecting Active Directory Certificate Services. It was assigned a CVSSv3 score of 7.8 and is rated as important. It was publicly disclosed prior to a patch being made available. According to Microsoft, successful exploitation would allow an attacker to gain administrator privileges. The advisory notes that “certificates created using a version 1 certificate template with Source of subject name set to ‘Supplied in the request’” are potentially impacted if the template has not been secured according to best practices. This vulnerability is assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index. Microsoft’s advisory also includes several mitigation steps for securing certificate templates which we highly recommend reviewing.ImportantCVE-2024-49040 | Microsoft Exchange Server Spoofing VulnerabilityCVE-2024-49040 is a spoofing vulnerability affecting Microsoft Exchange Server 2016 and 2019. It was assigned a CVSSv3 score of 7.5 and rated as important. According to Microsoft, this vulnerability was publicly disclosed prior to a patch being made available. After applying the update, administrators should review the support article Exchange Server non-RFC compliant P2 FROM header detection. The supplemental guide notes that as part of a “secure by default” approach, the Exchange Server update for November will flag suspicious emails which may contain “malicious patterns in the P2 FROM header.” While this feature can be disabled, Microsoft strongly recommends leaving it enabled to provide further protection from phishing attempts and malicious emails.CriticalCVE-2024-43639 | Windows Kerberos Remote Code Execution VulnerabilityCVE-2024-43639 is a critical RCE vulnerability affecting Windows Kerberos, an authentication protocol designed to verify user or host identities. It was assigned a CVSSv3 score of 9.8 and is rated as “Exploitation Less Likely.”To exploit this vulnerability, an unauthenticated attacker needs to leverage a cryptographic protocol vulnerability in order to achieve RCE. No further details were provided by Microsoft about this vulnerability at the time this blog was published.Important29 CVEs | SQL Server Native Client Remote Code Execution VulnerabilityThis month's release included 29 CVEs for RCEs affecting SQL Server Native Client. All of these CVEs received CVSSv3 scores of 8.8 and were rated as “Exploitation Less Likely.” Successful exploitation of these vulnerabilities can be achieved by convincing an authenticated user into connecting to a malicious SQL server database using an affected driver. A full list of the CVEs are included in the table below.CVEDescriptionCVSSv3CVE-2024-38255SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-43459SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-43462SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48993SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48994SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48995SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48996SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48997SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48998SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-48999SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49000SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49001SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49002SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49003SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49004SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49005SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49006SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49007SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49008SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49009SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49010SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49011SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49012SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49013SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49014SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49015SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49016SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49017SQL Server Native Client Remote Code Execution Vulnerability8.8CVE-2024-49018SQL Server Native Client Remote Code Execution Vulnerability8.8ImportantCVE-2024-43602 | Azure CycleCloud Remote Code Execution VulnerabilityCVE-2024-43602 is a RCE vulnerability in Microsoft’s Azure CycleCloud, a tool that helps in managing and orchestrating High Performance Computing (HPC) environments in Azure. This flaw received the highest CVSSv3 score of the month, a 9.9 and was rated as important. A user with basic permissions could exploit CVE-2024-43602 by sending specially crafted requests to a vulnerable AzureCloud CycleCloud cluster to modify its configuration. Successful exploitation would result in the user gaining root permissions, which could then be used to execute commands on any cluster in the Azure CycleCloud as well as steal admin credentials.Tenable SolutionsA list of all the plugins released for Microsoft’s November 2024 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.Get more informationMicrosoft's November 2024 Security UpdatesTenable plugins for Microsoft November 2024 Patch Tuesday Security UpdatesJoin Tenable's Security Response Team on the Tenable Community.Learn more about Tenable One, the Exposure Management Platform for the modern attack surface. Full Article
mi Social Media for Science Outreach – A Case Study: Chemicals Are Your Friends By www.nature.com Published On :: Wed, 22 May 2013 11:00:40 +0000 To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case Full Article Featured Guest Posts Outreach SpotOn NYC (#SoNYC) Uncategorized #reachingoutsci Social Media Case Study
mi OSC publishes gamification research and launches new trading simulation tool for Investor Education Month By www.osc.ca Published On :: Wed, 09 Oct 2024 12:31:40 GMT TORONTO – The Ontario Securities Commission (OSC) today released a new report that studied the impact of gamification on investors. Full Article
mi OSC seeks applications for the Registrant Advisory Committee By www.osc.ca Published On :: Thu, 10 Oct 2024 15:29:30 GMT TORONTO – The Ontario Securities Commission (OSC) is inviting applications for membership on its Registrant Advisory Committee (RAC or the Committee). Full Article
mi Capital Markets Tribunal seeks applications for the Securities Proceedings Advisory Committee By www.osc.ca Published On :: Tue, 22 Oct 2024 13:28:40 GMT TORONTO – The Capital Markets Tribunal is seeking applications for membership to the Securities Proceedings Advisory Committee (SPAC). Full Article
mi SpotOn London 2012 Storify: Fixing the fraud: how do we safeguard science from misconduct? By www.nature.com Published On :: Wed, 14 Nov 2012 12:00:49 +0000 #solo12fraud Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12fraud
mi Something is killing the children. Volume 3 / written by James Tynion IV ; illustrated by Werther Dell'Edera ; colored by Miquel Muerto ; lettered by AndWorld Design ; cover by Werther Dell'Edera with colors by Miquel Muerto. By library.gcpl.lib.oh.us Published On :: "As the House of Slaughter arrives to clean up the situation by any means necessary, Erica will find that the true threat to those around her isn't who— or what— she ever expected. And the cost of saving the day may be too high for anyone to pay … ." -- Description provided by publisher. Full Article
mi SpotOn London 2013: Thank you to this year’s livestreaming team! By www.nature.com Published On :: Wed, 06 Nov 2013 12:08:38 +0000 In true adherence to the age old phrase 'let them eat cake' and its traditional application to the under-funded and under-fed masses, for SpotOn London cakes were duly provided much to the enjoyment of the delegates. Since this act generated its own hashtag, it also deserves a Story... Full Article SpotOn London (#SoLo) #solo13
mi Study on countermeasures of Agriculture against Economic and Trade Frictions between China and USA [in Chinese] By www.ifpri.org Published On :: Sat, 12 Dec 2020 5:05:01 EST Full Article
mi Nutrition and economic development: Exploring Egypt's exceptionalism and the role of food subsidies [in Chinese] By www.ifpri.org Published On :: Wed, 31 Mar 2021 5:05:01 EDT Full Article
mi 2021 Global food policy report: Transforming food systems after COVID-19: Synopsis [in Chinese] By www.ifpri.org Published On :: Sat, 03 Apr 2021 5:05:01 EDT 2020年在诸多方面都让我们始料未及。新冠肺炎(COVID-19)疫情为全球带来了一场大规模的公共卫生灾难,各国均陷入了疫情及其相关应对政策带来的不同程度的经济困境,面临服务严重中断和人员流动严重受限的局面。无论是富裕国家还是贫穷国家,均未能幸免。在中低收入国家,许多弱势群体直接面临食物安全、医疗和营养方面的威胁。丧失生计、营养不良、教育中断和资源枯竭造成的长期影响可能性非常巨大,特别是对许多国家来说,距离新冠肺炎疫情的结束还遥遥无期。此外,疫情还凸显并加剧了我们食物系统的薄弱环节和不平等状况。一年过去了,全球因新冠肺炎疫情而进一步偏离了到2030年实现可持续发展目标(SDG)的进程。显然,食物系统可以在推动我们走上正轨方面发挥核心作用。要想实现可持续发展目标,就必须对食物系统进行转型,帮助我们更好地为下一次冲击做好准备,同时造福世界贫困人口和弱势群体以及我们的地球。 Full Article
mi Bulletin on food price dynamics, inflation and the food security situation in Sudan: November-December 2022 [in Arabic] By www.ifpri.org Published On :: Tue, 07 Feb 2023 5:05:01 EST موجز: Full Article
mi Quarterly bulletin on food price dynamics, inflation, and the food security situation in Sudan: 2021Q1- 2022Q4 [in Arabic] By www.ifpri.org Published On :: Fri, 14 Apr 2023 12:29:04 EDT وجز : Full Article
mi Monitoring indicators of economic activity in Sudan amidst ongoing conflict using satellite data [in Arabic] By www.ifpri.org Published On :: Sat, 10 Jun 2023 5:05:01 EDT استمرت المواجهة في السودان بين القوات المسلحة السودانية وقوات الدعم السريع لعدة أشهر قبل أن تتصاعد إلى نزاع مسلح في 15 أبريل 2023. بالإضافة ة إلى جانب الكارثة الإنسانية، عطل النزاع العديد من الخدمات العامة مثل الكهرباء والمياه والخدمات الصحية والخدمات المصرفية، بينما تعطل أيضا الوصول إلى الأسواق، مما أدى إلى ندرة كبيرة في السلع والخدمات. وقد دمر الصراع البنية التحتية الرئيسية، وقيد التجارة المحلية والدولية وعطل أنشطة الإنتاج وسلاسل الموردين. Full Article
mi The economy-wide impact of Sudan’s ongoing conflict: Implications on economic activity, agrifood system and poverty [in Arabic] By www.ifpri.org Published On :: Wed, 04 Oct 2023 5:05:01 EDT دخل النزاع المسلح بين القوات المسلحة السودانية وقوات الدعم السريع في السودان شهره السادس منذ اندلاعه في 15 أبريل 2023، دون أي مؤشرات على انتهائه قريبا. تسببت الحرب في كارثة إنسانية حادة، دمرت البنية التحتية الرئيسية، وقيدت أنشطة التجارة والإنتاج. علاوة على ذلك، أدى ذلك إلى تعطيل الوصول إلى المرافق العامة والخدمات المالية والأسواق، مما أدى إلى ندرة كبيرة في السلع والخدمات. في هذه الورقة، نستخدم إطار نمذجة مضاعف مصفوفة المحاسبة الاجتماعية لتقييم الآثار الاقتصادية على مستوى الاقتصاد لهذه الاضطرابات في النشاط الاقتصادي والموارد الإنتاجية وسبل العيش. Full Article
mi Political and economic drivers of Sudan's armed conflict: Implications for the agri-food system [in Arabic] By www.ifpri.org Published On :: Fri, 12 Jan 2024 5:05:01 EST Full Article
mi Mirror Image Sandra Brown. By library.gcpl.lib.oh.us Published On :: A master of romantic suspense, Sandra Brown spins an action-packed tale of mistaken identity, political intrigue, and assassination. The crash of a Dallas-bound jet wasn't just a tragedy for TV reporter Avery Daniels; it was an act of fate that handed her a golden opportunity to further her career, but made her the crucial player in a drama of violent passions and deadly desires. After plastic surgery transforms her face, Daniels is mistaken for a glamorous, selfish woman named Carole Rutledge-wife of the famous senatorial candidate Tate Rutledge who is a member of a powerful Texas dynasty. As she lay helpless in the hospital, Daniels made a shattering discovery: Someone close to Tate planned to assassinate him. Now, to save Tate's life, Avery must live another woman's life-and risk her own... Full Article
mi The Gods of Guilt Michael Connelly. By library.gcpl.lib.oh.us Published On :: Mickey Haller gets the text, "Call me ASAP - 187," and the California penal code for murder immediately gets his attention. Murder cases have the highest stakes and the biggest paydays, and they always mean Haller has to be at the top of his game. When Mickey learns that the victim was his own former client, a prostitute he thought he had rescued and put on the straight and narrow path, he knows he is on the hook for this one. He soon finds out that she was back in LA and back in the life. Far from saving her, Mickey may have been the one who put her in danger. Full Article
mi The 9th Girl Tami Hoag. By library.gcpl.lib.oh.us Published On :: Author Tami Hoag's fan-favorite Minneapolis investigators, Sam Kovac and Nikki Liska, hunt a serial killer in this haunting thriller. On a frigid New Year's Eve in Minneapolis, a young woman is found brutally murdered-the ninth so far this year in a string of grisly slayings. Homicide detectives Sam Kovac and Nikki Liska fear that it's the work of a serial killer they call Doc Holiday, a transient who has brought his gruesome game to a new and more terrifying level. But as Kovac and Liska uncover the truth, they find that the monsters in the ninth girl's life may live closer to home. And even as another young woman disappears, they have to ask the question: Which is the greater evil-the devil you know or the devil you don't? Full Article
mi The Minor Adjustment Beauty Salon Alexander McCall Smith. By library.gcpl.lib.oh.us Published On :: Modern ideas get tangled up with traditional ones in the latest intriguing installment in the beloved, best-selling No. 1 Ladies' Detective Agency series. Precious Ramotswe has taken on two puzzling cases. First she is approached by the lawyer Mma Sheba, who is the executor of a deceased farmer's estate. Mma Sheba has a feeling that the young man who has stepped forward may be falsely impersonating the farmer's nephew in order to claim his inheritance. Mma Ramotswe agrees to visit the farm and find out what she can about the self-professed nephew. Then the proprietor of the Minor Adjustment Beauty Salon comes to Mma Ramotswe for advice. The opening of her new salon has been shadowed by misfortune. Not only has she received a bad omen in the mail, but rumors are swirling that the salon is using dangerous products that burn people's skin. Could someone be trying to put the salon out of business? Meanwhile, at the office, Mma Ramotswe has noticed something different about Grace Makutsi lately. Though Mma Makutsi has mentioned nothing, it has become clear that she is pregnant . . . But in Botswana-a land where family has always been held above all else-this may be cause for controversy as well as celebration. With genuine warmth, sympathy, and wit, Alexander McCall Smith explores some tough questions about married life, parenthood, grief, and the importance of the traditions that shape and guide our lives. This is the fourteenth installment in the series. This ebook edition includes a Reading Group Guide. Full Article
mi A hiss before dying : a Mrs. Murphy mystery / Rita Mae Brown & Sneaky Pie Brown ; illustrated by Michael Gellatly. By library.gcpl.lib.oh.us Published On :: "Rita Mae Brown and her feline co-author Sneaky Pie Brown are back chasing mystery with their unique circle of Southern sleuths. And though the changing colors of fall are a beauty to behold, this year the scattered leaves hide a grim surprise. Autumn is in the air in the Blue Ridge Mountain community of Crozet, Virginia--and all the traditions of the changing seasons are under way. Mary Minor "Harry" Haristeen cleans her cupboards, her husband, Fair, prepares the horses for the shorter days ahead, and the clamorous barking of beagles signals the annual rabbit chase through the central Virginia hills. But the last thing the local beaglers and their hounds expect to flush out is a dead body. Disturbingly, it's the second corpse to turn up, after that of a missing truck driver too disfigured to identify. The deaths seem unrelated--until Harry picks up a trail of clues dating back to the state's post-Revolutionary past. The echoes of the Shot Heard Round the World pale in comparison to the dangerous shootout Harry narrowly escapes unscathed. Next time, it may be the killer who gets lucky. But not if Harry's furry friends Mrs. Murphy, Pewter, and Tucker can help it. Lending their sharp-nosed talents to the hunt, they'll help their mistress keep more lives from being lost--and right an injustice buried since the early days of America's independence. "As feline collaborators go, you couldn't ask for better than Sneaky Pie Brown."--The New York Times Book Review"-- Provided by publisher. Full Article
mi CSA Investor Alert: Investment scams imitating well-known financial brands By www.osc.ca Published On :: Mon, 31 May 2021 15:05:43 GMT Toronto – The Canadian Securities Administrators (CSA) is warning the public about scammers claiming to represent large, well-known financial companies. Recently, the CSA has noted an increase in the number of scams involving the use of professional looking electronic broch Full Article
mi Irrigation schemes in Ethiopia’s Awash River Basin: An examination of physical, knowledge, and governance infrastructures By essp.ifpri.info Published On :: Wed, 06 Nov 2024 09:06:37 +0000 Using a representative sample of irrigation schemes, the study documents the physical, knowledge, and governance infrastructures of irrigation schemes in Ethiopia’s most intensively used river basin, the Awash. The findings show that about 20 percent of the equipped area of irrigation schemes in the basin is not being irrigated, while the number of actual beneficiaries […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program Full Article News Publications
mi Hybrid Research and Policy Conference on “Livestock, Gender, and Agency Amid Conflict in Ethiopia” By essp.ifpri.info Published On :: Wed, 13 Nov 2024 04:55:41 +0000 The CGIAR Initiative on National Policies and Strategies (NPS) presents: 'Livestock, Gender, and Agency Amid Conflict in Ethiopia' 📅 Dec 11, 2024, ILRI Info Center, Addis Ababa. Join us as we discuss CGIAR NPS’s latest findings to guide policies that strengthen Ethiopia’s livestock sector. CGIAR International Food Policy Research Institute (IFPRI) International Livestock Research Institute (ILRI) Policy Studies Institute […] Source: IFPRI Ethiopia: Ethiopia Strategy Support Program Full Article Events Featured Post News
mi Dominican Republic: Agricultural R&D indicators factsheet [in Spanish] By www.ifpri.org Published On :: Wed, 08 Feb 2023 5:05:01 EST Full Article
mi Empoderamiento de la mujer rural en Guatemala, necesidades y oportunidades de medición: Posibles aplicaciones de una Métrica de Empoderamiento de las Mujeres para los Sistemas Estadísticos Nacionales (WEMNS) By www.ifpri.org Published On :: Tue, 12 Sep 2023 5:05:01 EDT La igualdad de género y el empoderamiento de las mujeres y niñas se ve reflejado en distintas prioridades de políticas a nivel global y local. El Objetivo de Desarrollo Sostenible 5 busca lograr la igualdad de género y empoderar a todas las mujeres y niñas. Full Article
mi Factores que impulsan la migración de la sierra a la selva en el Perú – Nota conceptual del estudio By www.ifpri.org Published On :: Fri, 08 Dec 2023 5:05:01 EST En el Perú, se estima que hay aproximadamente 6 millones de personas que migraron internamente en algún momento de su vida. Esto equivale al 20.3% de la población, siendo su mayoría originaria de la serranía peruana. Aunque Lima es el principal polo de atracción, en los últimos años, se ha observado un aumento en la migración hacia las regiones de Madre de Dios, Tacna, Arequipa y Moquegua (INEI, 2022). Entre el 2002 y 2007, Madre de Dios fue el departamento que tuvo la mayor cantidad de migrantes con un saldo migratorio neto de 14,8% (Yamada, 2012). Full Article
mi Avatar : the last airbender. Smoke and shadow. Part 1 / script, Gene Luen Yang ; art and cover, Gurihiru ; lettering, Michael Heisler. By library.gcpl.lib.oh.us Published On :: When the Fire Nation begins to believe that the country will perish if Zuko stays in power, Avatar Aang and his friends must protect the ruler. Full Article