ant

New Opinion Allowing Plaintiff to Present His Class Action Willful FCRA Claims to a Jury Reinforces Need to Remain Vigilant About FCRA Compliance

The Fair Credit Reporting Act (FCRA) is a federal law that governs employment-related background checks.  Most lawsuits asserting federal claims proceed in federal court.1  The FCRA is atypical in that FCRA claims can proceed in either federal or state court.  A new opinion from a California court of appeal in Hebert v.




ant

Atlanta Amends Anti-Discrimination Ordinance to Include Protections for Gender Expression and Criminal Histories

The City Council of Atlanta, Georgia recently passed an ordinance that amends its existing anti-discrimination law to include protection on the basis of “criminal history status” as well as “gender expression.”  The ordinance is effective immediately.

With regard to gender expression, the law simply amends existing law to include “gender expression” as an additional protected characteristic.




ant

Atlanta Amends Anti-Discrimination Ordinance to Include Protections for Gender Expression and Criminal Histories

Rachel P. Kaercher, Wendy Buckingham and William J. Simmons examine a new ordinance passed by the Atlanta City Council that amends its existing anti-discrimination law to include protections on the basis of criminal history status and gender expression.

SHRM Online

View (Subscription required.)




ant

Employers Face June 1, 2024 Deadline to Comply with Lehigh County, Pennsylvania’s New Expansive Anti-Discrimination Ordinance

The Lehigh County Human Relations Ordinance was enacted February 26, 2024, establishing county-specific non-discrimination requirements for employment, housing, education, health care and public accommodations.  The ordinance also creates a Lehigh County Human Relations Commission charged with investigating and enforcing claims of discrimination.  The ordinance becomes effective June 1, 2024.

Expanded Protected Characteristics and Employer Coverage




ant

California Court of Appeal Thwarts Efforts to Conceal Important Driving History Information from Employers

Employers with operations in California are all too familiar with how state and local officials continue to restrict the access employers have to public records, including criminal history information.1 For example, lengthy delays in completing standard criminal background checks are now routine in California.2 Apart from criminal background checks, many employers rely on motor vehicle record checks (MVRs) to vet candidates for positions that require driving as part of the job.  In Doe v. California Dept.




ant

Top 5 Changes in the SECURE 2.0 Act for Plan Sponsors and Participants

The Securing a Strong Retirement Act of 2022 included in the omnibus spending bill includes five significant changes for employers and plan sponsors:




ant

Watch Out New York – New Jersey Wants Its Taxes Too!

On July 21, 2023, New Jersey Governor Phil Murphy signed Assembly Bill No. S3128/A4694 into law,1 which implements an aggressive tax treatment of nonresidents who work for New Jersey employers.




ant

Shift Work and Tax Relief in Belgium: The New Law Introducing the ‘Variant Bis’ Has Been Published

We recently reported on the saga that followed the Constitutional Court's ruling of February 8, 2024 on the conditions for applying the partial exemption from payment of withholding tax for employers organizing shift work (CIR/92, art. 275/5). 

The ruling of February 8, 2024, had given rise to fears among many employers whose successive shifts fluctuate in size that they would simply lose the tax advantage, which can represent a reduction of 10 to 15% in the wage costs associated with shift workers. 




ant

Congressional Democrats Want to Weaponize Federal Labor Law

Michael Lotito writes about unions and their allies’ attempts to sneak parts of the Protecting the Right to Organize (PRO) Act into the budget bill.

The Wall Street Journal

View (Subscription required.)




ant

Arbitrator upholds reasonableness of hospital vaccination policy for termination of non-compliant

Rhonda B. Levy and Barry Kuretzky discuss a case in which an arbitrator issued the first award in Ontario to address and uphold the reasonableness of a hospital vaccination policy that allows employers to terminate employees for non-compliance.

Human Resources Director Canada

View (Subscription required.)




ant

Pencils, Paper, and Now NLRA Legal Protections – New General Counsel Memorandum Provides College Student Athletes with a Very Significant New “School Supply”

On September 29, 2021, National Labor Relations Board (NLRB) General Counsel (GC) Jennifer A. Abruzzo released a nine-page memorandum taking the unequivocal position that “certain Players at Academic Institutions” are employees under Section 2(3) of the National Labor Relations Act (NLRA).  Refusing to call such players “student athletes,” Abruzzo asserts in the memorandum (GC 21-08) that:




ant

Legal Landmines for Restaurant Owners

Libby Henninger authored this article outlining focus areas for employers reviewing compensation policies and practices.

Food & Beverage Magazine

View Article




ant

The Labor Dept. Wants to Revise a Trump-Era Policy on Handling of Discrimination Claims Against Contractors

David Goldstein talks about some differences as the Labor Department proposes changes to a Trump-era rule that it says “undermined” how it handles and resolves discrimination claims by federal contractors.

Government Executive

View




ant

New Haven Office Kicks Off 2024 with a New Leader – Littler Selects Paula Anthony as Office Managing Shareholder

NEW HAVEN, Conn. (January 4, 2024) – Littler, the world’s largest employment and labor law practice representing management, has appointed Paula Anthony as office managing shareholder (OMS) of the firm’s New Haven, Connecticut office, effective January 1, 2024. Anthony succeeds Lori Alexander who will be stepping down to continue to focus on her full-time litigation and advice practice.




ant

Littler Adds Unfair Competition and Trade Secrets Litigator Phillip Antablin in Los Angeles

LOS ANGELES (August 19, 2024) – Littler, the world’s largest employment and labor law practice representing management, has added Phillip Antablin as a shareholder in its Century City office in Los Angeles. Antablin previously served as Senior Counsel at Epstein Becker Green.




ant

New amendments to California bill clarify scope of prohibition on junk fees for restaurant industry

Stacey James and Jamie L. Santos discuss a California amendment that seeks to allow restaurants to support higher wages and benefits while clearly disclosing service fees to consumers upfront.

Wolters Kluwer

View (Subscription required)




ant

China’s New Cross-Border Data Transfer Rules Substantially Reduce Compliance Burdens for Multinational Employers

Multinational employers operating in China have been waiting since September 2023 for the Cyberspace Administration of China (CAC) to finalize proposed revisions to its complex and burdensome rules for cross-border data transfers.  Relief arrived on March 22, 2024, when the CAC published the “Provisions on Promoting and Regulating Cross-border Data Flows” (the “Approved Provisions”), which went into effect on the same day.




ant

Colorado’s Landmark AI Legislation Would Create Significant Compliance Burden for Employers Using AI Tools

UPDATE: On May 17, 2024, Colorado Governor Jared Polis signed Senate Bill 24-205 into law, although not without reservations. Governor Polis sent a letter to the members of the Colorado General Assembly encouraging them to reconsider and amend aspects of Senate Bill 24-205 before it takes effect on February 1, 2026.




ant

Legal-Ease: Your Lawyer as Your Business Consultant – A Labor & Employment Perspective

Kristy Peters discusses how employment law attorneys can be critical partners for employers to help them identify challenges and opportunities for their business.

InBusiness Phoenix

View




ant

Important Changes for Businesses in Australia – What Employers Should Know

  • Several new employment law changes in Australia have or will soon become enforceable.
  • Employers may need to review and revise their policies and procedures governing wage theft, the right to disconnect, shut-down notices, privacy, sexual harassment, and independent contractors.




ant

AIOTI, ISO/IEC JTC1, ETSI, oneM2M and W3C Collaborate on Two Joint White Papers on Semantic Interoperability Targeting Developers and Standardization Engineers

AIOTI, ISO/IEC JTC1, ETSI, oneM2M and W3C Collaborate on Two Joint White Papers on Semantic Interoperability Targeting Developers and Standardization Engineers

Cross-organization expert group works together on accelerating adoption of semantic technologies in IoT.

AIOTI today announced its collaborative role in the publication of two joint white papers on semantic interoperability entitled Semantic IoT Solutions - A Developer Perspective and Towards semantic interoperability standards based on ontologies in conjunction with organizations closely tied to the advancement of the IoT ecosystem.

Read More...




ant

ETSI IoT Week: semantics, experiences and security

ETSI IoT Week: semantics, experiences and security

Sophia Antipolis, 28 October 2019

ETSI IoT Week 2019 (21-25 October) drew more than 200 attendees to ETSI’s headquarters for what has become a must attend event for anyone who wants to understand the importance of standard-enabled technologies for IoT service deployments, in many different sectors.

Read More...




ant

ETSI OSM organizes its first fully remote Hackfest with a record number of participants

ETSI OSM organizes its first fully remote Hackfest with a record number of participants

Sophia Antipolis, 16 March 2020

These are special times where many face-to-face meetings are being postponed or canceled. But when the going gets tough, the tough gets going and ETSI OSM opted for reorganizing its Hackfest, originally planned as a physical event in Madrid from 9 to 12 March 2020, as a fully remote event. What originally seemed a huge challenge due to the hands-on approach and the high level of interaction required in a Hackfest, proved possible in a record time thanks to the outstanding engagement of the OSM community and the means provided by ETSI, making this Hackfest one of the best attended ever. The 4 days of Hackfest were run in parallel with the OSM Mid-Release EIGHT meeting and the OSM Ecosystem Day, also held remotely. 

Read More...




ant

ETSI releases migration strategies and recommendations for Quantum-Safe schemes

ETSI releases migration strategies and recommendations for Quantum-Safe schemes

Sophia Antipolis, 11 August 2020

The ETSI Quantum-Safe Cryptography (QSC) working group is pleased to announce the release of Technical Report TR 103 619 defining migration strategies and recommendations for Quantum-Safe schemes, and enhancing cryptography awareness across all business sectors.

Read More...




ant

ETSI’s CTO granted the prestigious award of Wireless World Research Forum

ETSI’s CTO granted the prestigious award of Wireless World Research Forum

Sophia Antipolis, 18 February 2021

During WWRF 45th meeting ETSI’s Chief Technical Officer (CTO), Adrian Scrase, has been granted the prestigious award of the Wireless World Research Forum in recognition of his significant contribution to the development of mobile communications standards, and for his longstanding support of the work of WWRF.

Read More...




ant

Homage to Pierre Laffitte, founder of Sophia-Antipolis and former Senator

Homage to Pierre Laffitte, founder of Sophia-Antipolis and former Senator

Sophia Antipolis, 8 July 2021

We were very sad to hear that Pierre Laffitte passed away on 7 July, at the age of 96. President and founder of the Sophia-Antipolis technopole, a scientist and politician, he has spent countless hours contributing to making Sophia-Antipolis the largest technopole in Europe.

Read More...




ant

ETSI releases two Technical Reports to support US NIST standards for post-quantum cryptography

ETSI releases two Technical Reports to support US NIST standards for post-quantum cryptography

Sophia Antipolis, 6 October 2021

In 2016 the US National Institute of Standards and Technology (NIST) announced their intention to develop new standards for post-quantum cryptography. They subsequently initiated a competition-like standardization process with a call for proposals for quantum-safe digital signatures, public-key encryption schemes, and key encapsulation mechanisms. NIST have stated that they intend to select quantum-safe schemes for standardization at the end of the current, third round of evaluation.

Read More...




ant

ETSI Secures Critical Infrastructures against Cyber Quantum Attacks with new TETRA Algorithms

ETSI Secures Critical Infrastructures against Cyber Quantum Attacks with new TETRA Algorithms

Sophia Antipolis, 8 November 2022

With the world facing growing challenges including the war in Europe and a global energy crisis, it is essential that the mission- and business-critical communications networks used by the public safety, critical infrastructure and utilities sectors (including transportation, electricity, natural gas and water plants) are secured against third-party attacks, to protect communications and sensitive data. With more than 120 countries using dedicated TETRA (Terrestrial Trunked Radio) networks for these critical services, work has been undertaken to ensure the ETSI TETRA technology standard remains robust in the face of evolving threats.

Read More...




ant

ETSI Quantum-Safe Cryptography event: a success 10 years later!

Sophia Antipolis, 16 February 2023

The 9th face-to-face ETSI-IQC Quantum-Safe Cryptography event this week attracted a large audience of nearly 200 people from Europe, North America and Asia, bringing together industry, academia and government. The event was kicked off by ETSI Director-General Luis Jorge Romero, who gave an overview of the quantum-safe standardization journey since the first workshop in 2013 and reiterated ETSI’s continued support for this important global effort.

Read More...




ant

ETSI releases World First Protection Profile for Quantum Key Distribution

Sophia Antipolis, 27 April 2023

ETSI has just released a Protection Profile (PP) for the security evaluation of quantum key distribution (QKD) modules, ETSI GS QKD 016. This Protection Profile is a first and anticipates the need for quantum safe cryptography. The ETSI specification will help manufacturers to submit pairs of QKD modules for evaluation under a security certification process.

Read More...




ant

Preparing for a secure future: industry and business share plans for quantum era at 10th ETSI/IQC Quantum-Safe Cryptography Conference

Sophia Antipolis, 24 May 2024

Speakers at the 10th ETSI/IQC Quantum Safe Cryptography Conference have called on organizations to prepare their cybersecurity infrastructures to address the challenges of a post-quantum world.

Organized by ETSI and the Institute for Quantum Computing, this year’s conference was hosted from 14-16 May by the Centre for Quantum Technologies (CQT), National University of Singapore (NUS), in partnership with the Infocomm Media Development Authority (IMDA) and the Cyber Security Agency (CSA) of Singapore. The event attracted an impressive 235 onsite delegates from 27 countries, reflecting fast-growing interest worldwide in the critical importance of quantum-safe cryptography in today’s cybersecurity strategies.

Read More...




ant

Research Assistant/ Research Analyst I

Job Summary: The International Food Policy Research Institute (IFPRI) seeks a qualified candidate to serve as a Research Assistants/ Research Analyst I in its Development Strategies and Governance Unit for the Sudan Strategy Support Program. This is a one-year, renewable appointment. The successful candidates will work with senior research staff in the analysis of agriculture, rural development, food and nutrition security and related policies and other research activities including research work related to the ensuing conflict in Sudan. The incumbent will work under the overall guidance of the IFPRI Sudan Program Leader but will be employed directly by IFPRl's organizational host, the Arab Organization for Agricultural Development (AOAD) - employment policies, compensation, and benefits of AOAD will apply to this position. Interested applicants must have authorization to work in Sudan. The final grade level will be determined by level of education and years of relevant work experience. Essential Duties: Specific Duties include but are not limited to: Assist the collection of primary and secondary data, Asist build large dataset from multiple sources, Assist to analyze data using advance analytical methods, Assist in conducting literature reviews and synthesis, Assist in drafting and translating reports, research papers, and blog posts between English and Arabic languages, Assist in capacity building and support outreach activities, Assist to coordinate projects and conduct other duties as assigned. Required Qualifications:  Research Assistant: Bachelor's or its equivalent in Economics, Agricultural Economics, Statistics, or closely related fields, Research Analyst: Bachelor’s degree plus two years of relevant professional experience or Master’s degree in a relevant discipline, Excellent knowledge of macroeconomic and/or microeconomic theory, Excellent knowledge of and quantitative econometric methods and/or economic modeling, Excellent knowledge of Stata and/or GAMS, Excellent analytical mind and drafting skills, Demonstrated fluency in written and spoken English and Arabic , Excellent interpersonal skills and to work in a team-oriented multi-cultural environment, Demonstrated ability to multi-task, meet deadlines, and manage time, Demonstrated professional level of attention to detail and accuracy of work, Ability to work independently and take initiative, Willingness to travel. Preferred Qualifications: Previous experience conducting research on and collecting data in Sudan. Familiarity with the literature on economic and agriculture development, food security, poverty reduction and related fields. Previous experience related to policy analysis and impact evaluation. Experience with spatial analysis and ARC-GIS. Experience with policy communication activities and events organization. Experience with managing websites and updating their contents. Experience in academia, the private sector, a development-oriented organization, or comparable institution,   Physical Demand & Work environment Employee will sit in an upright position for a long period of time. Employee will lift between 0-10 pounds. Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading.  




ant

Research Unit Contracts & Grants Manager I

The Development Strategies and Governance (DSG) Unit within the Transformation Strategies Department of the International Food Policy Research Institute (IFPRI) seeks a Research Unit Contracts & Grants Manager I, who will be responsible for financial management which includes budgetary responsibilities, cost monitoring and control, and financial analysis and reporting, contracts administration which includes proposal preparation and submission and the administration of the Unit’s special projects. Other responsibilities include supervising Unit Admin Support staff, serving as liaison with finance and administration as well as the Director General’s office; drafting correspondence for the Unit director and communication with external contacts (donors, clients, collaborators, sub-contractors and auditors); and service as active member on various standing and ad-hoc committees, as well as work with Project Managers in management of budgets, contracts, deliverables, invoices and other payment documents. This position is a 2-year, renewable appointment based in Washington, DC.   Essential Duties: Specific duties and responsibilities include but are not limited to: Providing technical support in proposal preparation, reviewing contracts to ensure they reflect the provisions negotiated, and monitoring performance of contracts and submission of specified deliverables.  Drafting, negotiating and monitoring consultant collaborative agreements, serve as liaison between program collaborators and finance/administrative issues, review monthly financial reports, and provide financial analysis reports on projects.  Preparing the divisional budgets and monitoring expense budgets Coordinating the drafting of project/program budgets; review of accounting transactions.  Developing spreadsheets & maintaining financial information for planning & reference. Drafting routine correspondence regarding contracts or project/program finances. Assisting in financial audits Coordinating financial and operational activities for field offices Ensuring the smooth operation of the program’s day-to-day activities; coordinate seminars and workshops, manage logistical arrangements on seminars/workshops. Liaising with IFPRI HR Services, Facilities and IT department for related issues and needs. Preparing administrative and operational procedures for the division and approves timesheets Maintaining division files Supervising administrative support staff Other tasks as assigned. Required Qualifications:  Bachelor’s degree plus ten years of relevant experience, or associate’s degree plus twelve years of relevant experience.   Two year of management experience Experience in developing, monitoring and managing budgets and contracts. Experience in coordinating budget processes, reviewing accounting transactions, developing financial projections and reports. Solid composition, grammar and proof-reading skills, with the ability to compose correspondence and reports; excellent written and oral English communications skills. Proficient in Microsoft Office; word processing & spreadsheet programs required. Ability to handle multiple tasks & prioritize tasks with minimal supervision in a fast-paced environment. Demonstrated experience and comfort working with multiple program managers simultaneously.  Ability to prioritize and coordinate tasks in such an environment. Demonstrated flexibility to adjust to multiple individual work styles.  Attention to detail and ability to work within a team in a multicultural environment.   Preferred Qualifications: Familiarity with IFPRI’s operational systems (finance, accounting, etc.) and the CGIAR system is highly desirable.  Proficiency in a second language of the U.N. system Demonstrated proficiency with MS Office, especially Microsoft Word, Outlook, Excel, and PowerPoint required, and demonstrated proficiency with financial management and administrative software applications such as Costpoint, OnBase, Deltek, and/or other applications. Physical Demand & Work environment: Employee will sit in an upright position for a long period of time  Employee will lift between 0-10 pounds.  Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary range for this job requisition is between $85,600- $104,900. In determining your salary, we will consider your experience and other job-related factors.  Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




ant

Staff Accountant II

Job Summary:  The International Food Policy Research Institute (IFPRI) seeks a Staff Accountant II for a two-year, renewable appointment to provide general accounting support in the Finance Department. This position will report to the Accounting Manager and is based at IFPRI Headquarters located in Washington, DC.   Essential Duties: Specific duties and responsibilities include but are not limited to: Assist in monthly and year end closing process. Prepare monthly journal entries and provide relevant supporting documentation. Prepare monthly account reconciliations as assigned and research and clear any transactional discrepancies.  Ensure field office expenditures are processed timely.  Review for compliance field office expenditure reports and documentation. Handle weekly cash deposit and process monthly deposit entry. Provide audit assistance in retrieving documents for auditors to review. Provide back up support when needed in processing accounts payable transactions, wire transfers, and payroll functions. Qualifications:  Bachelor’s degree in accounting, Finance or closely related field plus two years of relevant experience; or associate's degree plus five years of relevant experience. Strong attention to detail. Proficiency with Microsoft Excel. Strong analytical skills. Good oral and written communications skills. Demonstrated Ability to consistently process high volume of transactions. Preferred Qualification Deltek Costpoint Experience Physical Demand & Work environment: Employee will sit in an upright position for a long period of time.  Employee will lift between 0-10 pounds.  Employee is required to have close visual acuity to perform activities such as: preparing and analyzing data and figures; transcribing; viewing computer terminal; extensive reading. Salary Range: The expected salary range for this job requisition is between $55,600 - $68,100. In determining your salary, we will consider your experience and other job-related factors. Benefits: IFPRI is committed to providing our staff members with valuable and competitive benefits, as it is a core part of providing a strong overall employee experience. This position is eligible for health insurance coverage and a summary of our benefits can be found on our website. Please note that the listed benefits are generally available to active, non-temporary, full-time and part-time US-based employees who work at least 25 hours per week. The International Food Policy Research Institute (IFPRI) is an equal employment opportunity employer - F/M/Disability/Vet/Sexual Orientation/Gender Identity.




ant

From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25

Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.

Background

In January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.

As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.

25 Significant CVEs

CVE-1999-0211: SunOS Arbitrary Read/Write Vulnerability

Arbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.

CVE-2010-2568: Windows Shell Remote Code Execution Vulnerability

Remote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.

CVE-2014-0160: OpenSSL Information Disclosure Vulnerability

HeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.

CVE-2014-6271: GNU Bash Shellshock Remote Code Execution Vulnerability

Shellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.

CVE-2015-5119: Adobe Flash Player Use After Free

Remote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering​. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.

CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution Vulnerability

Remote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.

CVE-2017-0144: Windows SMB Remote Code Execution Vulnerability

EternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.

CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution Vulnerability

Remote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.

CVE-2019-0708: Remote Desktop Services Remote Code Execution Vulnerability

BlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.

CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution Vulnerability

SMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.

CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution Vulnerability

Path TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.

CVE-2019-10149: Exim Remote Command Execution Vulnerability

Remote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.

CVE-2020-1472: Netlogon Elevation of Privilege Vulnerability

ZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.

CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass Vulnerability

SpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.

CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load Vulnerability

MeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.

CVE-2021-36942: Windows LSA Spoofing Vulnerability

PetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.

CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code Execution

FollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).

CVE-2021-44228: Apache Log4j Remote Code Execution Vulnerability

Log4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).

CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery Vulnerability

ProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.

CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability

PrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.

CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection Vulnerability

SQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.

CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection Vulnerability

SQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.

CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure Vulnerability

CitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.

CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection Vulnerability

Remote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”

CVE-2024-3094: XZ Utils Embedded Malicious Code Vulnerability

Embedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.

Identifying affected systems

A list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:




ant

FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure

The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.

Last month, the Department of Homeland Security announced the availability of $279.9 million in grant funding for the Fiscal Year (FY) 2024 State and Local Cybersecurity Grant Program (SLCGP). Now in its third year, the four-year, $1 billion program provides funding for State, Local and Territorial (SLT) governments to implement cybersecurity solutions that address the growing threats and risks to their information systems. Applications must be submitted by December 3, 2024.

While there are no significant modifications to the program for FY 2024, the Federal Emergency Management Agency (FEMA), which administers SLCGP in coordination with the Cybersecurity and Infrastructure Security Agency (CISA), identified key changes, some of which we highlight below:

The FY 2024 NOFO adds CISA’s KEV catalog as a new performance measure and recommended resource

The FY 2024 notice of funding opportunity (NOFO) adds the CISA Known Exploited Vulnerabilities (KEV) catalog as a recommended resource to encourage governments to regularly view information related to cybersecurity vulnerabilities confirmed by CISA, prioritizing those exploited in the wild. In addition, CISA has added “Addressing CISA-identified cybersecurity vulnerabilities” to the list of performance measures it will collect through the duration of the program.

Tenable offers fastest, broadest coverage of CISA’s KEV catalog

At Tenable, our goal is to help organizations identify their cyber exposure gaps as accurately and quickly as possible. To achieve this goal, we have research teams around the globe working to provide precise and prompt coverage for new threats as they are discovered. Tenable monitors and tracks additions to the CISA KEV catalog on a daily basis and prioritizes developing new detections where they do not already exist.

Tenable updates the KEV coverage of its vulnerability management products — Tenable Nessus, Tenable Security Center and Tenable Vulnerability Management — allowing organizations to use KEV catalog data as an additional prioritization metric when figuring out what to fix first. The ready availability of this data in Tenable products can help agencies meet the SLCGP performance measures. This blog offers additional information on Tenable’s coverage of CISA’s KEV catalog.

FY 2024 NOFO adds “Adopting Enhanced Logging” as a new performance measure

The FY 2024 NOFO also adds “Adopting Enhanced Logging” to the list of performance measures CISA will collect throughout the program duration.

How Tenable’s library of compliance audits can help with Enhanced Logging

Tenable's library of Compliance Audits, including Center for Internet Security (CIS) and Defense Information Systems Agency (DISA), allows organizations to assess systems for compliance, including ensuring Enhanced Logging is enabled. Tenable's vulnerability management tools enable customers to easily schedule compliance scans. Users can choose from a continuously updated library of built-in audits or upload custom audits. By conducting these scans regularly, organizations can ensure their systems are secure and maintain compliance with required frameworks.

FY 2024 NOFO continues to require applicants to address program objectives in their applications

As with previous years, the FY 2024 NOFO sets four program objectives. Applicants must address at least one of the following in their applications:

  • Objective 1: Develop and establish appropriate governance structures, including by developing, implementing, or revising Cybersecurity Plans, to improve capabilities to respond to cybersecurity incidents, and ensure operations.
  • Objective 2: Understand their current cybersecurity posture and areas for improvement based on continuous testing, evaluation, and structured assessments.
  • Objective 3: Implement security protections commensurate with risk.
  • Objective 4: Ensure organization personnel are appropriately trained in cybersecurity, commensurate with responsibility.

How Tenable can help agencies meet Objective 2 of the program

Tenable is uniquely positioned to help SLTs meet Objective 2 through the Tenable One Exposure Management Platform. In addition to analyzing traditional IT environments, Tenable One analyzes cloud instances, web applications, critical infrastructure environments, identity access and privilege solutions such as Active Directory and more — including highly dynamic assets like mobile devices, virtual machines and containers. Once the complete attack surface is understood, the Tenable One platform applies a proactive risk-based approach to managing exposure, allowing SLT agencies to successfully meet each of the sub-objectives outlined in Objective 2 (see table below).

Sub-objectiveHow Tenable helps
2.1.1: Establish and regularly update asset inventoryTenable One deploys purpose-built sensors across on-premises and cloud environments to update inventories of human and machine assets, including cloud, IT, OT, IoT, mobile, applications, virtual machines, containers and identities
2.3.2. Effectively manage vulnerabilities by prioritizing mitigation of high-impact vulnerabilities and those most likely to be exploited.

Tenable One provides an accurate picture of both internal and external exposure by detecting and prioritizing a broad range of vulnerabilities, misconfiguration and excessive permissions across the attack surface.

Threat intelligence and data science from Tenable Research are then applied to give agencies easy-to-understand risk scores. For example, Tenable One provides advanced prioritization metrics and capabilities, asset exposure scores which combine total asset risk and asset criticality, cyber exposure scoring which calculates overall exposure for the organization, peer benchmarking for comparable organizations, as well as the ability to track SLAs and risk patterns over time.

Further, Tenable One provides rich critical technical context in the form of attack path analysis that maps asset, identity and risk relationships which can be exploited by attackers. It also provides business context by giving users an understanding of the potential impact on the things that matter most to an agency, such as business critical apps, services, processes and functions. These contextual views greatly improve the ability of security teams to prioritize and focus action where they can best reduce the potential for material impact. These advanced prioritization capabilities, along with mitigation guidance, ensure high-risk vulnerabilities can be addressed quickly.

2.4.1 SLT agencies are able to analyze network traffic and activity transiting or traveling to or from information systems, applications, and user accounts to understand baseline activity and identify potential threats.

Tenable provides purpose-built sensors, including a passive sensor, which can determine risk based on network traffic. After being placed on a Switched Port Analyzer (SPAN) port or network tap, the passive sensor will be able to discover new devices on a network as soon as they begin to send traffic, as well as discover vulnerabilities based on, but not limited to:

  • Services
  • User-agents
  • Application traffic
2.5.1 SLT agencies are able to respond to identified events and incidents, document root cause, and share information with partners.

Tenable One can help SLT agencies respond to identified events and incidents and document root cause more quickly. SOC analysts managing events and incidents and vulnerability analysts focused on remediation of vulnerabilities have access to deep technical content in the form of attack paths, with risk and and configuration details to verify viability, as well as business context to understand the potential impact to their agency.

This information is valuable not only to validate why IT teams should prioritize mitigation of issues before breach, but to prove that a successful attack has occurred. Further, agencies can deliver dashboards, reports and scorecards to help share important security data in meaningful ways across teams and with partners. Agencies are able to customize these to show the data that matters most and add details specific to their requirements. 

Source: Tenable, October 2024

Tenable One deployment options offer flexibility for SLT agencies

Tenable offers SLT agencies flexibility in their implementation models to help them best meet the requirements and objectives outlined as part of the SLCGP. Deployment models include:

  • Centralized risk-based vulnerability program managed by a state Department of Information Technology (DoIT)
  • Multi-entity projects
  • Decentralized deployments of Tenable One managed by individual municipalities,
  • Managed Security Service Provider (MSSP) models that allow agencies to rapidly adopt solutions by utilizing Tenable’s Technology Partner network.

Whole-of-state approach enables state-wide collaboration and cooperation

A “whole-of-state” approach — which enables state-wide collaboration to improve the cybersecurity posture of all stakeholders — allows state governments to share resources to support cybersecurity programs for local government entities, educational institutions and other organizations. Shared resources increase the level of defense for SLTs both individually and as a community and reduce duplication of work and effort. States get real-time visibility into all threats and deploy a standard strategy and toolset to improve cyber hygiene, accelerate incident response and reduce statewide risk. For more information, read Protecting Local Government Agencies with a Whole-of-State Cybersecurity Approach.

FY 2024 NOFO advises SLT agencies to adopt key cybersecurity best practices

As in previous years, the FY 2024 NOFO again recommends SLT agencies adopt key cybersecurity best practices. To do this, they are required to consult the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) throughout their development of plans and projects within the program. This is also a statutory requirement for receiving grant funding.

How Tenable One can help agencies meet the CISA CPGs

The CISA CPGs are a prioritized subset of cybersecurity practices aimed at meaningfully reducing risk to critical infrastructure operations and the American people. They provide a common set of IT and operational technology (OT) fundamental cybersecurity best practices to help SLT agencies address some of the most common and impactful cyber risks. Learn more about how Tenable One can help agencies meet the CISA CPGs here.

Learn more




ant

Social Media for Science Outreach – A Case Study: AntarcticGlaciers.org

To tie in with this month’s SoNYC birthday celebrations, we are hosting a collection of case




ant

OSC seeks applications for the Registrant Advisory Committee

TORONTO – The Ontario Securities Commission (OSC) is inviting applications for membership on its Registrant Advisory Committee (RAC or the Committee).




ant

SpotOn London 2013 Storify: The Dark Art of Dark Social: Email, the antisocial medium which will not die

Here is a Storify collecting the online conversations from the, “The Dark Art of Dark




ant

The Black Panther Party : a graphic novel history / David F. Walker ; art, colors, and letters by Marcus Kwame Anderson.

"Founded in Oakland, California, in 1966, the Black Panther Party for Self-Defense was a radical political organization that stood in defiant contrast to the mainstream civil rights movement. This gripping illustrated history explores the impact and significance of the Panthers, from their social, educational, and healthcare programs that were designed to uplift the Black community to their battle against police brutality through citizen patrols and frequent clashes with the FBI, which targeted the Party from its outset. Using dramatic comic book-style retellings and illustrated profiles of key figures, The Black Panther Party captures the major events, people, and actions of the Party, as well as their cultural and political influence and enduring legacy." -- Page [2] of cover.




ant

Innovations of targeted poverty reduction governance and policy in Zhejiang Province: Insights from China’s post-2020 anti-poverty strategy [in Chinese]




ant

Return to Santa Flores A Classic Love Story Iris Johansen.

#1 New York Times bestselling author Iris Johansen offers readers a classic tale of a love that seems impossible-and a hunger that is undeniable. Jenny Cashman longs to escape the refined, rarified air of her exclusive Swiss education. At nineteen, she's desperate for independence-and to once again see the man she loves. So she sells her belongings, leaves Europe, and heads to Las Vegas. The sight of Steve Jason's newest palatial hotel and casino thrills Jenny-but not as much as the sight of the man himself. Steve came to her rescue after her father died, paying for her years of expensive schooling. Now, she must convince him that she's old enough to make her own decisions . . . including about her passion for him. Steve Jason is a powerful mogul, a man who came from nothing and made a name for himself in the industry before he was thirty years old. He takes great care to keep all emotional involvement with others to a bare minimum-with only one exception. Jenny has always been incredibly important to him. But how can he keep her safe when she seems oblivious to her own stunning beauty and the reactions she gets from other men? It will take all of Steve's resolve to protect her-especially from his own desires.




ant

Investor Alert: Fraudulent social media “investment groups” take advantage of unsuspecting investors

TORONTO – The Canadian Securities Administrators (CSA) warns Canadians about fraudulent “investment groups” promoted on social media like Facebook and Instagram. These groups could be running a scam called a “pump and dump.”How the scam works:




ant

Batman, the Dark Knight detective. Volume 5 / Alan Grant, Archie Goodwin, writers ; pencilers, Norm Breyfogle, Dan Jurgens ; Steve Mitchell, Dick Giordano, inkers ; Adrienne Roy, colorist ; Todd Klein, letterer.

"Bruce Wayne's latest ward, Tim Drake, has all the makings of becoming the greatest Robin yet. He's intelligent, athletic, and levelheaded, and his detective skills rival those of his mentor. However, every Boy Wonder who has come before has endured tragedy, and Tim may be no exception when his parents are marked for death by the sinister Obeah Man. Will the Dark Knight stop the Obeah Man in time, or must Tim face a deadly rite of passage in order to be worthy of inheriting the mantle of Robin?"--Provided by publisher.




ant

Catwoman. Soulstealer : the graphic novel / based on the novel written by Sarah J. Maas ; adapted by Louise Simonson ; illustrated by Samantha Dodge with Carl Potts and Brett Ryans ; colors by Shari Chankhamma ; letters by Saida Temofonte.

Selina Kyle returns to Gotham City as new socialite Holly Vanderhees, but she needs to outsmart rival Batwing to rise to the top of the city's criminal underbelly.




ant

Future state. The next Batman / writers, John Ridley, Vita Ayala, Andrew Constant [and 4 others] ; pencillers, Laura Braga, Aneke, Nick Derington [and 5 others] ; inkers, Laura Braga, Aneke, Nick Derington [and 6 others] ; colorists, Arif Prianto, Jordie

"Giant, sprawling future Gotham City is under martial law, protected and regulated by a private security force led by the infamous Peacekeepers. Their mandate is to maintain the safety of the citizens of Gotham, regardless of any Constitutional rights, and to hunt down, incarcerate, or kill all masked vigilantes, villains, and criminals in the city limits. It's a dangerous and violent look at a possible future Gotham City and the heroes and villains who live there!" -- Provided by publisher.




ant

Batman, White Knight presents : Harley Quinn / Katana Collins, writer, story ; Sean Murphy, story, covers ; Matteo Scalera, art, variants ; Dave Stewart, colorist ; Matt Hollingsworth, cover colors ; AndWorld Design, lettering.

"Batman: White Knight Presents: Harley Quinn takes place two years after Batman: Curse of the White Knight. Azrael has wiped out criminals in Gotham, Jack Napier (formerly The Joker) is dead, Bruce Wayne (Batman) is in prison, and Harley Quinn is adjusting to life as a single mother, raising the twins she had with Jack. But as new villains arise, Harley is forced to dance with madness once again and confront her own past with The Joker and Batman while helping the Gotham City police and an eager young FBI agent uncover the truth behind a series of gruesome murders. This collection also features a chapter from Harley Quinn's newest digital first series, Harley Quinn Black + White + Red, told in a traditional black-and-white format with the color red uniquely shaping Harley Quinn's story." -- Provided by publisher.




ant

Future state. Batman, dark detective / Mariko Tamaki, Joshua Williamson, Gene Luen Yang [and others], writers ; Dan Mora, Giannis Milonogiannis, Ben Oliver [and others], art ; Jordie Bellaire, Arif Prianto, Otto Schmidt [and others], color ; Aditya Bidika

"Welcome to the possible future state of Gotham. The Magistrate, a freelance military and surveillance corporation, has been hired by Gotham's leadership to turn the old city into a futuristic surveillance state free of vigilante-based crime/heroics. Batman, horrified to see what his city was becoming, fought tooth and nail against Magistrate— and they killed him for it. Or did they? Bruce Wayne survived this assassination attempt, and has been laying low for years now trying to sort out how to beat Magistrate. The only problem? He doesn't think he can anymore. They're too big, they're too powerful. And the latest horrific revelation? They have eyes everywhere. It's left to Batman for one last mission. Destroy their command center, expose the drones, and free the city. Whatever the cost." -- Provided by publisher.




ant

Pokémon. Sun & Moon. Volume 10 / story, Hidenori Kusaka ; art, Satoshi Yamamoto ; translation, Tetsuichiro Miyaki ; English adaptation, Bryant Turnage ; touch-up & lettering, Susan Daigle-Leach.

"Sun dreams of money. Moon dreams of scientific discoveries. When their paths cross with Team Skull, both their plans go awry … Lost in an alternate dimension, Sun and Moon battle to help their new friends defend the eternally dark city of Ultra Megalopolis. But then a betrayal deprives them of their transportation home! Meanwhile, what surprising news does Lillie receive?" -- Provided by publisher




ant

How can African agriculture adapt to climate change: Analysis of the determinants of farmers' choice of adaptation methods and perceptions of climate change in the Nile Basin of Ethiopia [in Amharic]

"Ethiopia's agricultural sector, which is dominated by smallscale, mixed-crop, and livestock farming, is the mainstay of the country's economy. It constitutes more than half of the country's gross domestic product, generates more than 85 percent of foreign exchange earnings, and employs about 80 percent of the population. Unfortunately, Ethiopia's dependence on agriculture makes the country particularly vulnerable to the adverse impactsof climate change on crop and livestock production.