can Ontario, Canada: Requirements for Mandatory Policies, Training and Postings By www.littler.com Published On :: Wed, 24 Feb 2021 18:12:56 +0000 Employers subject to provincial legislation (i.e., not federal employers) that have employees in Ontario often ask about legislative requirements under various employment statutes, including mandatory policies, training, postings, and information sheets under the Employment Standards Act, 2000, the Workplace Safety and Insurance Act, 1997, the Occupational Health and Safety Act, the Accessibility for Ontarians with Disabilities Act, 2005, the Pay Equity Act, the Smoke-Free Ontario Act, 2017, the Working for Workers Act, 2021, a Full Article
can Puerto Rico Treasury Department Takes Action in Response to Hurricane Fiona By www.littler.com Published On :: Wed, 28 Sep 2022 20:55:07 +0000 On September 17, 2022, Puerto Rico Governor Hon. Pedro Pierluisi issued Executive Order No. OE-2022-045, declaring a state of emergency due to the passing of Hurricane Fiona through the Island. Likewise, on September 21, 2022, President Joseph Biden authorized a disaster declaration for Puerto Rico, opening up additional relief and assistance for Puerto Rico's recovery process after the devastation left by the hurricane. Full Article
can Canada Entered Last Phase of CPP Enhancements on January 1, 2024 By www.littler.com Published On :: Mon, 29 Jan 2024 18:06:42 +0000 All Canadian employers other than those in Quebec1 are required to: Deduct Canada Pension Plan (CPP) contributions from their employees’ pensionable earnings if the employee meets certain conditions; Contribute an amount equal to the CPP contributions that were deducted; and Remit both amounts. These obligations end when the employee reaches the maximum contribution for the year. Full Article
can New Legislation and New PAGA in CA, New Administration in DC – How Can Employers Thrive in 2025? By www.littler.com Published On :: Tue, 01 Oct 2024 19:06:12 +0000 Full Article
can Ontario, Canada: Arbitrator Upholds Mandatory COVID-19 Vaccination Policy By www.littler.com Published On :: Fri, 12 Nov 2021 21:23:15 +0000 On November 9, 2021, in United Food and Commercial Workers Union, Canada Local 333 v. Full Article
can British Columbia, Canada: Arbitrator Decides Employer Could Terminate Employee Who Refused Government-Ordered Vaccination By www.littler.com Published On :: Wed, 13 Apr 2022 17:35:47 +0000 On April 4, 2022, in Fraser Health Authority v British Columbia General Employees’ Union, 2022 CanLII 25560, Arbitrator Koml Kandola of the British Columbia Labour Relations Board dismissed the union’s grievance respecting the dismissal of the grievor because she was ineligible to work under the order issued b Full Article
can Canada: Key Trends in Arbitration Awards Pertaining to Mandatory COVID-19 Vaccination Policies By www.littler.com Published On :: Wed, 27 Apr 2022 14:34:41 +0000 Since late fall 2021, we have seen a steady flow of arbitration awards emerge in Ontario and British Columbia that consider issues relating to mandatory COVID-19 vaccination policies in the unionized workplace. In this Insight, we provide an overview of key trends in these awards. Full Article
can Ontario, Canada Human Rights Tribunal Finds it Has Concurrent Jurisdiction with Labour Arbitrators to Decide Human Rights Claims in Unionized Workplaces By www.littler.com Published On :: Thu, 13 Oct 2022 20:25:07 +0000 The Human Rights Tribunal of Ontario recently held a preliminary hearing to determine whether allegations made under the Human Rights Code (Code) fell within the exclusive jurisdiction of a labour arbitrator, or whether the Tribunal had concurrent jurisdiction over employment-related human rights matters in a unionized workplace. Full Article
can Ontario, Canada Arbitrator Finds Employer Did Not Violate Collective Agreements by Not Recognizing National Day of Mourning as a Paid Holiday By www.littler.com Published On :: Tue, 07 Mar 2023 16:02:15 +0000 Arbitrator dismissed four union grievances alleging National Day of Mourning should have been a paid holiday. It is not enough for a day to be referred to as a “holiday” by a governmental entity to be deemed as such for collective agreement purposes; a legislative process culminating in the proclamation of the day as a “holiday” is required. Full Article
can Employers can count sick leave credits as paid medical leave days under CLC: arbitrator By www.littler.com Published On :: Tue, 12 Mar 2024 19:38:37 +0000 Rhonda Levy, Adrian Jakibchuk, Barry Kuretzky and George Vassos comment on an arbitrator’s ruling that federal employers can count employees’ sick leave credits as paid medical leave days under the Canada Labour Code (CLC) if their own program provides “a more favourable benefit” to workers. Human Resources Director Canada View Full Article
can Pencils, Paper, and Now NLRA Legal Protections – New General Counsel Memorandum Provides College Student Athletes with a Very Significant New “School Supply” By www.littler.com Published On :: Fri, 01 Oct 2021 18:32:52 +0000 On September 29, 2021, National Labor Relations Board (NLRB) General Counsel (GC) Jennifer A. Abruzzo released a nine-page memorandum taking the unequivocal position that “certain Players at Academic Institutions” are employees under Section 2(3) of the National Labor Relations Act (NLRA). Refusing to call such players “student athletes,” Abruzzo asserts in the memorandum (GC 21-08) that: Full Article
can NLRB Regional Director Says Dartmouth Men’s Basketball Players Are Employees, Can Vote in Union Election By www.littler.com Published On :: Wed, 07 Feb 2024 19:38:45 +0000 On February 5, 2024, the NLRB’s Regional Director for Region 1, Laura Sacks, issued a written decision finding that Dartmouth’s men’s basketball players are employees under the National Labor Relations Act. Based on their status as employees, Regional Director Sacks found, Dartmouth’s men’s basketball players are eligible to vote in a union election petitioned for by Local 560 of the Service Employees International Union, a labor union that already represents several other more traditional employee groups at Dartmouth. Full Article
can House Republicans Warn Against College Athlete Unions By www.littler.com Published On :: Thu, 14 Mar 2024 14:34:57 +0000 While testifying at a congressional hearing, Tyler A. Sims said the potential consequences of unionizing could be damaging for athletes. Inside Higher Ed View (Subscription required.) Full Article
can Dartmouth basketball vote shows unionization ‘can happen anywhere,’ attorney says By www.littler.com Published On :: Wed, 10 Apr 2024 14:26:46 +0000 Tyler Sims discusses the potential wage-and-hour implications of Dartmouth College’s men’s basketball team voting to form what may become the NCAA’s first-ever athlete labor union. HR Dive View (Subscription required.) Full Article
can Canada Announces Increase in Off-campus Work Hours for Study Permit Holders By www.littler.com Published On :: Tue, 30 Apr 2024 19:07:02 +0000 On April 29, 2024, The Honourable Marc Miller, Minister of Immigration, Refugees and Citizenship, announced that effective the fall semester 2024, international students holding a valid study permit will be permitted to work up to 24 hours per week off campus during the school term. The current policy permits international students to work up to only 20 hours per week off campus during the school term. This change is designed to not only help students gain work experience and offset expenses, but also to address ongoing Canadian labour shortage needs. Full Article
can Pay to Play? Third Circuit Holds NCAA Athletes Can Be Considered Employees By www.littler.com Published On :: Tue, 16 Jul 2024 17:38:06 +0000 The Third Circuit in Johnson v. NCAA ruled that athletes at NCAA Division I schools may be considered employees under the Fair Labor Standards Act. The Johnson decision creates a circuit split that could lead the United States Supreme Court to resolve this issue. Colleges and universities could face substantial back pay claims from current and former college athletes based on Johnson. Full Article
can NLRB General Counsel Suggests How Colleges and Universities Can Satisfy NLRA Disclosure Obligations Without Violating FERPA By www.littler.com Published On :: Mon, 26 Aug 2024 15:18:27 +0000 Colleges and universities that employ their own students face conflicts about how to protect student information, as required by the Family Educational Rights and Privacy Act (FERPA), while disclosing information about student-employees who seek to unionize, as required by the National Labor Relations Act (NLRA). On August 6, 2024, the National Labor Relations Board’s general counsel issued a memorandum with her advice about how higher education institutions should handle this dilemma. Full Article
can Ontario, Canada: Bill 149, Working for Workers Four Act, 2023 Introduced for First Reading By www.littler.com Published On :: Thu, 16 Nov 2023 19:37:46 +0000 UPDATE: On March 21, 2024, Ontario’s Bill 149 - Working for Workers Four Act, 2024 received Royal Assent. The amendments to the ESA made by Bill 149 came into force on the day it received Royal Assent, with the following exceptions: Full Article
can Supreme Court of Canada Confirms “Owners” of Construction Projects Are “Employers” Under OHSA By www.littler.com Published On :: Tue, 05 Dec 2023 18:48:43 +0000 Supreme Court of Canada lets stand decision finding an “owner” of a construction project can be considered an “employer” within the meaning of the Occupational Health and Safety Act (OHSA). This decision has significant implications for the construction sector, as a project owner can now be liable for OHSA violations of its contractor, subject to a due diligence defence. Full Article
can Effective January 1, 2024, Employers in British Columbia, Canada Have Duties to Cooperate and to Maintain Employment Regarding Certain Workplace Injuries By www.littler.com Published On :: Tue, 30 Jan 2024 14:32:25 +0000 On November 24, 2022, Bill 41 – 2022: Workers Compensation Amendment Act (No. 2), 2022 (Bill 41), which introduced changes to British Columbia’s Workers Compensation Act, received Royal Assent. Effective January 1, 2024, Bill 41 imposes certain duties on employers and employees following a workplace injury. Full Article
can Connecticut Employers Can Terminate Employees Impaired by Medical Marijuana While Working; Appellate Court Also Provides Guidance for Reasonable Suspicion Drug Tests By www.littler.com Published On :: Tue, 19 Mar 2024 20:51:43 +0000 In a significant decision about workplace drug use, the Connecticut Appellate Court backed an employer’s right to terminate a worker who was impaired on the job by medical marijuana. The decision also clarified the factual basis an employer must possess to justify ordering a drug test based on suspicion of impairment. Full Article
can Ontario, Canada Court Affirms City Lacked Control of Workplace and Exercised Due Diligence, Upholding Acquittal of OHSA Charges By www.littler.com Published On :: Wed, 18 Sep 2024 15:45:54 +0000 In R. v. Greater Sudbury (City), 2024 ONSC 3959, the Ontario Superior Court of Justice (OSCJ) dismissed an appeal of the trial judge’s decision in which she acquitted the City of Sudbury (City) of various charges under the Occupational Health and Safety Act (OHSA). Full Article
can Managing Legal Compliance and Workplace Culture in the Nevada Cannabis Industry By www.littler.com Published On :: Thu, 18 Jul 2024 16:54:38 +0000 Full Article
can How Employers Can Best Protect Themselves in Montana By www.littler.com Published On :: Mon, 29 Jul 2024 17:03:13 +0000 Full Article
can Now That the Election Is Over, Here’s What Texas Employers Can Expect By www.littler.com Published On :: Wed, 23 Oct 2024 17:42:28 +0000 Full Article
can Littler Continues Robust Canadian Expansion with Five New Additions to Toronto Office By www.littler.com Published On :: Tue, 02 Jul 2024 14:38:05 +0000 New Additions Follow Arrival of Three Partners in Recent Months Full Article
can Three Littler Partners Recognized in the 2025 Edition of the Best Lawyers in Canada™ By www.littler.com Published On :: Thu, 29 Aug 2024 14:12:48 +0000 TORONTO (August 29, 2024) – Littler, the world’s largest employment and labour law practice representing management, is pleased to announce that three of its attorneys have been featured in the 2025 edition of The Best Lawyers in Canada™ in Labour and Employment Law. The attorneys included in this year’s edition were: Full Article
can Ontario, Canada: Bill 190, Working for Workers Five Act, 2024 Receives Royal Assent By www.littler.com Published On :: Thu, 31 Oct 2024 14:48:33 +0000 Ontario’s Bill 190, Working for Workers Five Act, 2024 (Bill 190), which amends the Employment Standards Act, 2000, Occupational Health and Safety Act, and Workplace Safety and Insurance Act, 1997, received Royal Assent, although many clarifying regulations have not yet been issued. Full Article
can Labour and Employment Law in Canada – 2024 in Review & Trends for 2025 By www.littler.com Published On :: Mon, 04 Nov 2024 17:25:19 +0000 Full Article
can Ontario, Canada Appellate Court Provides Guidance to Employers on How to Draft Employment Settlement Documents By www.littler.com Published On :: Mon, 11 Nov 2024 20:13:37 +0000 The Court of Appeal for Ontario found that settlement documents signed after an employee separated from employment prevented him from suing for the value of vested stock options. The OCA emphasized that the employee had executed the settlement documents with the benefit of legal advice and that they clearly released the employee’s entitlement to the damages claimed. Full Article
can Crash Course in U.S. Employment Law: How a Multinational Based Outside the United States Can Avoid Big Mistakes Managing a U.S. Workforce By www.littler.com Published On :: Wed, 20 Mar 2024 20:24:07 +0000 Multinationals based outside the United States that enter the U.S. market and employ U.S. staff tend to encounter hurdles, and to make mistakes, because the U.S system of labor/employment regulation is of a fundamentally different character from those of every other country in the world. Full Article
can Colorado’s Landmark AI Legislation Would Create Significant Compliance Burden for Employers Using AI Tools By www.littler.com Published On :: Thu, 16 May 2024 21:09:22 +0000 UPDATE: On May 17, 2024, Colorado Governor Jared Polis signed Senate Bill 24-205 into law, although not without reservations. Governor Polis sent a letter to the members of the Colorado General Assembly encouraging them to reconsider and amend aspects of Senate Bill 24-205 before it takes effect on February 1, 2026. Full Article
can Canada: SCC Decision Offers Potential Insight into Privacy Rights for Private-Sector Employees By www.littler.com Published On :: Thu, 08 Aug 2024 19:55:42 +0000 In a significant decision focused on public employers, the Supreme Court of Canada (SCC) recently held that Ontario public school boards are “government” and, as such, they are subject to the provisions of the Canadian Charter of Rights and Freedoms (Charter), and their teachers are protected from unreasonable search and seizure in their places of employment. In York Region District School Board v. Full Article
can Mailbag: We rejected a job candidate. When can we delete their information? By www.littler.com Published On :: Fri, 13 Sep 2024 19:16:47 +0000 David Goldstein discusses how long employers should keep rejected job candidates’ records and says their ATS system for storing those records should be configured to comply with applicable laws. HR Dive View Full Article
can Strikes in the Age of Automation and AI: How HR Can Prepare for the Future By www.littler.com Published On :: Wed, 16 Oct 2024 14:40:22 +0000 Bradford Kelley talks about how important it is for employers to create effective AI policies. SHRM View (Subscription required) Full Article
can ETSI IoT week highlights how ICT standards can help sustainability By www.etsi.org Published On :: Mon, 17 Oct 2022 09:09:23 GMT ETSI IoT week highlights how ICT standards can help sustainability Sophia Antipolis, 17 October 2022 Last week ETSI hosted the 2022 ETSI IoT Week event, focused on “Pursuing the Digital and Green Transformation”. 52 speakers from industry, research, universities, cities and other SDOs demonstrated, with concrete examples, how ICT standards can help reach the UN Sustainable Development Goals (SDGs) and the European Green Deal to an audience from 22 countries around the world. Read More... Full Article
can ETSI launches a new group on Terahertz, a candidate technology for 6G By www.etsi.org Published On :: Mon, 12 Dec 2022 09:44:30 GMT ETSI launches a new group on Terahertz, a candidate technology for 6G Sophia Antipolis, 12 December 2022 On 8 December the newly launched ETSI Industry Specification Group on Terahertz (ISG THz) held its kick-off meeting and decided on work priorities for this candidate technology for 6G. “ISG THz provides an opportunity for ETSI members to coordinate their pre-standards research efforts on THz technology across various European collaborative projects, extended with relevant global initiatives, a move towards paving the way for future standardization of the technology,” outlines Thomas Kürner, Chair of ISG THz. Read More... Full Article
can ETSI Launches a New Group for Integrated Sensing and Communications, a Candidate Technology for 6G By www.etsi.org Published On :: Tue, 21 Nov 2023 09:28:14 GMT Sophia Antipolis, 21 November 2023 ETSI is delighted to announce the launch of the Industry Specification Group for Integrated Sensing and Communications (ISG ISAC). This group will establish the technical foundations for ISAC technology development and standardization in 6G. 87 participants from both the industrial sphere and the academic sphere took an active part in the kick-off meeting, which was held at ETSI premises, in Sophia Antipolis, France, on 17 November 2023. Read More... Full Article
can MAA France: Fall All-Canadian Bowling Night for McGillians By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Thu, 14 Nov 2024 22:00:00 -050011/14/2024 07:30:00PMLocation: PARIS, Canada Full Article
can Native American Religion in Early America By nationalhumanitiescenter.org Published On :: Wed, 5 Mar 2008 14:42:22 -0400 Teaching about Native American religion is a challenging task to tackle with students at any level. Full Article
can American Abolitionism and Religion By nationalhumanitiescenter.org Published On :: Tue, 4 Mar 2008 10:35:22 -0400 Students reading about the coming of the Civil War will find the topic of religion and abolition more interesting than they imagined. Full Article
can Somewhere in the Nadir of African American History, 1890-1920 By nationalhumanitiescenter.org Published On :: Fri, 12 Feb 2010 11:10:22 -0400 New essay by Glenda Gilmore just added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
can Frederick Douglass and Harriet Jacobs: American Slave Narrators By nationalhumanitiescenter.org Published On :: Wed, 17 Mar 2010 15:11:23 -0400 New essay by Lucinda MacKethan just added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
can African American Protest Poetry By nationalhumanitiescenter.org Published On :: Fri, 18 Jun 2010 15:11:23 -0400 New essay by Trudier Harris, "African American Protest Poetry," added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
can How Slavery Affected African American Families By nationalhumanitiescenter.org Published On :: Tue, 27 Jul 2010 14:11:14 -0400 New essay, "How Slavery Affected African American Families," by Heather Andrea Williams, associate professor of history at the University of North Carolina at Chapel Hill, added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
can Jazz and the African American Literary Tradition By nationalhumanitiescenter.org Published On :: Tue, 27 Jul 2010 14:41:19 -0400 New essay, "Jazz and the African American Literary Tradition," by Gerald Early, Merle Kling Professor of Modern Letters at Washington University in St. Louis, added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
can Summary of Comments to CSA/CIRO Staff Notice 23-331 Request for Feedback on December 2022 SEC Market Structure Proposals and Potential Impact on Canadian Capital Markets By www.osc.ca Published On :: Fri, 20 Sep 2024 12:37:28 GMT This document is only available in PDF format. Full Article
can OSC Staff Notice 11-737 (Revised) – Securities Advisory Committee – Vacancies By www.osc.ca Published On :: Thu, 17 Oct 2024 13:10:29 GMT The Securities Advisory Committee (“SAC”) is a committee of industry experts established by the Commission to advise it and its staff on a variety of matters including policy initiatives and capital markets trends. Full Article
can Agronomy & Policy Solutions for Implementation of the African Fertilizer and Soil Health Action Plan By www.youtube.com Published On :: Wed, 11 Sep 2024 04:32:41 GMT Full Article
can From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25 By www.tenable.com Published On :: Tue, 22 Oct 2024 11:11:11 -0400 Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.BackgroundIn January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.25 Significant CVEsCVE-1999-0211: SunOS Arbitrary Read/Write VulnerabilityArbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.CVE-2010-2568: Windows Shell Remote Code Execution VulnerabilityRemote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.CVE-2014-0160: OpenSSL Information Disclosure VulnerabilityHeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.CVE-2014-6271: GNU Bash Shellshock Remote Code Execution VulnerabilityShellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.CVE-2015-5119: Adobe Flash Player Use After FreeRemote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.CVE-2017-0144: Windows SMB Remote Code Execution VulnerabilityEternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.CVE-2019-0708: Remote Desktop Services Remote Code Execution VulnerabilityBlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution VulnerabilitySMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution VulnerabilityPath TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.CVE-2019-10149: Exim Remote Command Execution VulnerabilityRemote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.CVE-2020-1472: Netlogon Elevation of Privilege VulnerabilityZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass VulnerabilitySpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load VulnerabilityMeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.CVE-2021-36942: Windows LSA Spoofing VulnerabilityPetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code ExecutionFollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).CVE-2021-44228: Apache Log4j Remote Code Execution VulnerabilityLog4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution VulnerabilityPrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure VulnerabilityCitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection VulnerabilityRemote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”CVE-2024-3094: XZ Utils Embedded Malicious Code VulnerabilityEmbedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:CVE-1999-0211CVE-2010-2568CVE-2014-0160CVE-2014-6271CVE-2015-5119CVE-2017-11882CVE-2017-0144CVE-2017-5638CVE-2019-0708CVE-2020-0796CVE-2019-19781CVE-2019-10149CVE-2020-1472CVE-2017-5753CVE-2017-5754CVE-2021-36942CVE-2022-30190CVE-2021-44228CVE-2021-26855CVE-2021-34527CVE-2021-27101CVE-2023-34362CVE-2023-4966CVE-2023-2868CVE-2024-3094 Full Article