if ETSI releases Technical Report on requirements for smart lifts for IoT By www.etsi.org Published On :: Thu, 28 Apr 2022 06:19:22 GMT ETSI releases Technical Report on requirements for smart lifts for IoT Sophia Antipolis, 4 June 2020 To facilitate upcoming standards, the ETSI SmartM2M technical committee has released ETSI TR 103 546, a Technical Report on smart lifts, collecting and developing the type and range of data which should be exchanged between lifts and their relevant management applications. This study paves the way for technical requirements to monitor the activities and the performance of such lifts and describe their interaction with IoT devices and applications. Read More... Full Article
if ETSI advisor at the Stakeholder Cybersecurity Certification Group launched by the EC By www.etsi.org Published On :: Thu, 28 Apr 2022 06:21:35 GMT ETSI advisor at the Stakeholder Cybersecurity Certification Group launched by the EC Sophia Antipolis, 24 June 2020 ETSI is pleased to announce that it has been invited to be part of the newly formed Stakeholder Cybersecurity Certification Group. The kick-off meeting took place today. Together with the European Cybersecurity Certification Group (ECCG), composed of Member States’ representatives, the newly established Stakeholder Cybersecurity Certification Group (SCCG) will advise the Commission on strategic issues regarding the European cybersecurity certification framework. It will also assist the Commission in the preparation of the Union rolling work programme, which sets the priorities for the definition of schemes within the EU cybersecurity certification framework. ETSI will bring in its long-standing experience in cybersecurity, with standards developed both for enterprises and consumers within several of its technical bodies, including the Technical Committee CYBER. Read More... Full Article
if ETSI issues New White Paper on Artificial Intelligence By www.etsi.org Published On :: Thu, 28 Apr 2022 06:22:21 GMT ETSI issues New White Paper on Artificial Intelligence Sophia Antipolis, 29 June 2020 ETSI is pleased to unveil a new White Paper on Artificial Intelligence (AI). This White Paper explores key issues of AI that present both huge opportunities and new challenges for information and communication technologies (ICT). This ETSI White Paper surveys the many technical activities in ETSI that consider AI. They include 5G systems, network optimization, privacy/security, data management, semantic interoperability and testing across all areas. Each area is considering the use of aspects of AI, including Health and Human Factors scenarios. Key references from other bodies are included for global context. Read More... Full Article
if ETSI Multi-Access Edge Computing extends services to WiFi to address enterprise needs By www.etsi.org Published On :: Fri, 24 Jul 2020 08:14:52 GMT ETSI Multi-Access Edge Computing extends services to WiFi to address enterprise needs Sophia Antipolis, 16 July 2020 The ETSI Industry Specification Group on Multi-Access Edge Computing, ISG MEC, has recently released ETSI MEC GS 028 to extend network information services to the world of WiFi and thus squarely into enterprises space. Read More... Full Article
if New ETSI white paper: Harmonizing standards for edge computing, a synergized architecture leveraging ETSI ISG MEC and 3GPP specifications By www.etsi.org Published On :: Thu, 28 Apr 2022 06:22:52 GMT New ETSI white paper: Harmonizing standards for edge computing, a synergized architecture leveraging ETSI ISG MEC and 3GPP specifications Sophia Antipolis, 27 July 2020 Members and officials of the ETSI Multi-access Edge Computing group and the 3GPP SA WG6 have just published a new white paper which aims to harmonize standards for edge computing. The white paper highlights the role of standards for edge when edge computing is deployed in conjunction with mobile networks. It also reviews the leading efforts in the industry and introduces a synergized architecture which leverages the ETSI ISG MEC and 3GPP specifications. This paper highlights the value proposition of different standards streams and how those standards may be combined when it comes to deployments. Some deployment options are discussed. Read More... Full Article
if ETSI Fifth Generation Fixed Network White Paper paves the way for Fibre to Everywhere and Everything By www.etsi.org Published On :: Thu, 28 Apr 2022 06:25:14 GMT ETSI Fifth Generation Fixed Network White Paper paves the way for Fibre to Everywhere and Everything Sophia Antipolis, 30 September 2020 The ETSI ISG F5G (Fifth Generation Fixed Network) has released a White Paper that sets the scene for the evolution of on-premise, fixed access, and aggregation networks. In this White Paper, ETSI presents the vision, value, use cases, features, and technologies of F5G, aiming to foster a global effort to realize its full potential. Read More... Full Article
if ETSI Unveils First Cloud-Native VNF Management Specifications By www.etsi.org Published On :: Thu, 28 Apr 2022 13:54:34 GMT ETSI Unveils First Cloud-Native VNF Management Specifications Sophia Antipolis, 17 November 2020 The ETSI group on Network Functions Virtualization (ETSI Industry Specification Group NFV) is pleased to unveil its first specification enabling containerized VNFs to be managed in an NFV framework. The ETSI GS NFV-IFA 040 specifies requirements for service interfaces and an object model for OS (Operating System) container management and orchestration. Read More... Full Article
if ETSI experts complete specifications for Vulnerable Road Users By www.etsi.org Published On :: Thu, 28 Apr 2022 06:26:47 GMT ETSI experts complete specifications for Vulnerable Road Users Sophia Antipolis, 24 November 2020 A group of experts in ETSI TC ITS, the committee in charge of Intelligent Transport Systems, has just completed a set of three standards related to Vulnerable Road Users (VRU) protection with the specification ETSI TS 103 300-3. This standard defines the VRU awareness service together with its key interfaces and protocols as well as the VRU awareness message (VAM) format, semantics and syntax. The specification completes the Technical Report, ETSI TR 103 300-1 on use cases and the Technical specification, ETSI TS 103 300-2, addressing the functional architecture and requirements for VRU. The development of the standards included stakeholders from around the world and received a large set of contributions from representatives working on different types of vulnerable road users, for example bicycles and motorcycles. Read More... Full Article
if ETSI releases Middlebox Security Protocols framework specification By www.etsi.org Published On :: Thu, 17 Dec 2020 08:59:39 GMT ETSI releases Middlebox Security Protocols framework specification Sophia Antipolis, 17 December 2020 ETSI is pleased to announce a new specification, ETSI TS 103 523-1: Part 1 of the Middlebox Security Protocol (MSP) series, which defines the security properties of a Middlebox Security Protocol. Read More... Full Article
if ETSI Report Paves the Way for First World Standards in Securing Artificial Intelligence By www.etsi.org Published On :: Thu, 28 Apr 2022 14:32:02 GMT ETSI Report Paves the Way for First World Standards in Securing Artificial Intelligence Sophia Antipolis, 19 January 2021 The ETSI Securing Artificial Intelligence Industry Specification Group (SAI ISG) last month released its first Group Report, ETSI GR SAI 004, which gives an overview of the problem statement regarding the securing of AI. ETSI SAI is the first standardization initiative dedicated to securing AI. The Report describes the problem of securing AI-based systems and solutions, with a focus on machine learning, and the challenges relating to confidentiality, integrity and availability at each stage of the machine learning lifecycle. It also points out some of the broader challenges of AI systems including bias, ethics and ability to be explained. A number of different attack vectors are outlined, as well as several cases of real-world use and attacks. Read More... Full Article
if ETSI releases Middlebox Security Protocols specification for fine-grained access control By www.etsi.org Published On :: Tue, 02 Mar 2021 13:59:33 GMT ETSI releases Middlebox Security Protocols specification for fine-grained access control Sophia Antipolis, 2 March 2021 ETSI is pleased to announce a new specification, ETSI TS 103 523-2: Transport Layer MSP (TLMSP), Part 2 of the Middlebox Security Protocol (MSP) series, which defines a protocol for varied (fine-grained) access control to communications traffic. This specification was developed by the ETSI Technical Committee CYBER. Read More... Full Article
if ETSI releases Mitigation Strategy Report on Securing Artificial Intelligence By www.etsi.org Published On :: Tue, 18 May 2021 06:40:45 GMT ETSI releases Mitigation Strategy Report on Securing Artificial Intelligence Sophia Antipolis, 18 May 2021 ETSI has recently released ETSI GR SAI 005, a report which summarizes and analyses existing and potential mitigation against threats for AI-based systems. Setting a baseline for a common understanding of relevant AI cyber security threats and mitigations will be key for widespread deployment and acceptance of AI systems and applications. This report sheds light on the available methods for securing AI-based systems by mitigating known or potential security threats identified in the recent ENISA threat landscape publication and ETSI GR SAI 004 Problem Statement Report. It also addresses security capabilities, challenges, and limitations when adopting mitigation for AI-based systems in certain potential use cases. Read More... Full Article
if ETSI releases IoT testing specifications for MQTT, CoAP and industrial automation and control systems By www.etsi.org Published On :: Thu, 28 Apr 2022 14:36:33 GMT ETSI releases IoT testing specifications for MQTT, CoAP and industrial automation and control systems Sophia Antipolis, 25 June 2021 The ETSI committee on Methods for Testing and Specifications (TC MTS) has recently completed a first set of seven standards addressing the testing of the IoT MQTT and CoAP protocols, and the foundational security IoT-Profile. Read More... Full Article
if ETSI releases specifications boosting trustful end-to-end network and service automation By www.etsi.org Published On :: Thu, 28 Apr 2022 14:40:25 GMT ETSI releases specifications boosting trustful end-to-end network and service automation Sophia Antipolis, 13 September 2021 ETSI is pleased to announce the release of three major specifications and reports developed by its Zero-touch network and Service Management (ZSM) group. ETSI GS ZSM 003, defines end-to-end network slicing management and orchestration architecture blueprint and solutions, and ETSI GS ZSM 009-1 specifies the enablers for closed-loop automation. The general security aspects related to the ZSM framework and solutions, and potential mitigation options are introduced in the ETSI GR ZSM 010. Read More... Full Article
if ETSI launches first specification for the 5th Generation Fixed Network, F5G technology landscape By www.etsi.org Published On :: Thu, 23 Sep 2021 10:02:40 GMT ETSI launches first specification for the 5th Generation Fixed Network, F5G technology landscape Sophia Antipolis, 23 September 2021 ETSI's 5th Generation Fixed Network group (F5G ISG) has just released its first specification, ETSI GS F5G 003, entitled F5G Technology Landscape. In this specification, the ISG studies the technical requirements, existing standards and gaps for 10 different new use cases, for home, enterprises or industrial needs. ETSI GS F5G 003 use cases include PON (passive optical network) on-premises and passive optical LAN. In this case, a PON system could connect end devices (like HDTV, HD surveillance cameras and VR/AR helmets) and provide higher data rate, better coordination and controlled latency than current Ethernet and Wi-Fi mesh. Read More... Full Article
if ETSI releases test specification to comply with world-leading Consumer IoT Security standard By www.etsi.org Published On :: Tue, 12 Oct 2021 08:03:19 GMT ETSI releases test specification to comply with world-leading Consumer IoT Security standard Sophia Antipolis, 12 October 2021 ETSI has released the test specification for the existing ETSI EN 303 645, the world leading consumer IoT security standard. This test specification, ETSI TS 103 701, describes how a conformity assessment is performed in a structured and comprehensive way. This will allow supplier organizations such as manufacturers, vendors or distributers to assess the compliance of their devices against ETSI ETSI EN 303 645 in self-assessments or via testing labs. User organizations can also apply the test specification for in-house testing. Read More... Full Article
if ETSI Announces First Specification for Smart Contracts By www.etsi.org Published On :: Tue, 18 Jan 2022 14:27:50 GMT ETSI Announces First Specification for Smart Contracts Sophia Antipolis, 18 January 2022 ETSI has just released GS PDL 011 the first in a series of specifications that are concerned with the implementation of permissioned distributed ledgers (PDL). This and following specifications will help with the realisation of the numerous operational and security advantages of a decentralised approach to the recording of transactions, while simultaneously being both inexpensive to perform and inherently scalable. Read More... Full Article
if ETSI releases first specification on 5th Generation Fixed Network (F5G) architecture By www.etsi.org Published On :: Thu, 12 May 2022 12:09:30 GMT ETSI releases first specification on 5th Generation Fixed Network (F5G) architecture Sophia Antipolis, 12 May 2022 ETSI's 5th Generation Fixed Network group (ISG F5G) has released its first specification for F5G Network Architecture ETSI GS F5G 004. This architecture will deliver a variety of services to residential and business customers over a single physical network with guaranteed SLAs (service level agreements). Read More... Full Article
if ETSI releases new specification on Quality of Service for F5G By www.etsi.org Published On :: Mon, 20 Jun 2022 13:20:08 GMT ETSI releases new specification on Quality of Service for F5G Sophia Antipolis, 20 June 2022 The ETSI's 5th-Generation Fixed Network group (F5G ISG) has released a new specification, ETSI GS F5G 005 on “High-Quality Service Experience Factors”. This specification studies the end-to-end Quality of Experience (QoE) factors for services over the broadband network. High QoE reflects the overall performance of services from the end user's perspective. It also analyses the general factors that impact service performance and identifies the overall high-QoE dimensions for each service, mainly using Virtual Reality (VR) as a benchmark for F5G applications. Read More... Full Article
if ETSI simplifies ICT end-users’ lives with a guide available in 19 European languages By www.etsi.org Published On :: Thu, 21 Jul 2022 08:21:40 GMT ETSI simplifies ICT end-users’ lives with a guide available in 19 European languages Sophia Antipolis, 21 July 2022 ETSI is pleased to announce the new version of the ETSI Guide EG 203 499, developed by experts from the Human Factors Technical Committee. The guide aims to further simplify end-user access to ICT devices, services and applications by providing recommended terms for basic and commonly used ICT-related objects and activities, notably the terms that end users are commonly exposed to. Read More... Full Article
if ETSI releases first O-RAN specification By www.etsi.org Published On :: Thu, 15 Sep 2022 14:59:13 GMT ETSI releases first O-RAN specification ETSI - Sophia Antipolis/France, O-RAN ALLIANCE - Bonn/Germany, 15 September 2022 ETSI and O-RAN are pleased to announce that ETSI has adopted the first O-RAN specification as ETSI TS 103 859, namely ‘O-RAN Fronthaul Control, User and Synchronization Plane Specification v7.02’. The document focuses on Open Fronthaul, one of the interfaces in the O-RAN Architecture for open and intelligent Radio Access Networks. It specifies the control plane, user plane and synchronization plane protocols used over the fronthaul interface linking the O-DU (O-RAN Distributed Unit) and the O-RU (O-RAN Radio Unit) for the lower layer functional splits. The scope of TS 103 859 includes both LTE and NR (5G). Read More... Full Article
if New ETSI specification allows single UICC to support the use of multiple applications simultaneously By www.etsi.org Published On :: Thu, 27 Oct 2022 09:48:19 GMT New ETSI specification allows single UICC to support the use of multiple applications simultaneously Sophia Antipolis, 26 October 2022 New specifications released by ETSI will enable multiple subscriptions and identities to exist in the same smartphone handset without needing several SIM cards to be within the device. The mobile telecom industry has been facing an increasing demand for applications running on mobile devices like banking, payments, transport and identity for some time. These new specifications address this demand by adding the possibility to host and address several "virtual secure elements" into the same UICC. This allows multiple virtual secure elements to coexist logically separated, whilst having the ability to be addressed independently through the same physical interface. Read More... Full Article
if ETSI’s Activities in Artificial Intelligence: Read our New White Paper By www.etsi.org Published On :: Fri, 06 Jan 2023 17:27:18 GMT ETSI’s Activities in Artificial Intelligence: Read our New White Paper Sophia Antipolis, 21 December 2022 ETSI has a long history of developing standards in the field of artificial intelligence (AI) and systems that use and support AI. Today ETSI is pleased to release a new White Paper developed by a variety of members and experts. They include companies from telecom and network communication sectors, from large and small and medium enterprises, based either in Europe, Asia or America. This White Paper entitled ETSI Activities in the field of Artificial Intelligence supports all stakeholders and summarizes ongoing effort in ETSI and planned future activities. It also includes an analysis on how ETSI deliverables may support current policy initiatives in the field of artificial intelligence. A section of the document outlines ETSI activities of relevance to address Societal Challenges in AI while another addresses the involvement of the European Research Community. Read More... Full Article
if ETSI releases three Reports on Securing Artificial Intelligence for a secure, transparent and explicable AI system By www.etsi.org Published On :: Thu, 20 Jul 2023 16:31:23 GMT Sophia Antipolis, 11 July 2023 ETSI is pleased to announce three new Reports developed by its Securing AI group (ISG SAI). They address explicability and transparency of AI processing and provide an AI computing platform security framework. The last Report is a multi-partner Proofs of Concepts framework. Read More... Full Article
if Role of Fibre Networks in Carbon Shift: ETSI's White Paper By www.etsi.org Published On :: Thu, 30 Nov 2023 09:06:00 GMT Sophia Antipolis, 30 November 2023 ETSI is pleased to announce a new White Paper developed by some of the members of its F5G Industry Specification Group, entitled “All-optical network facilitates the Carbon Shift”, highlighting the role of fibre networks as a key ICT enabler to meet the UN sustainability goals. Read More... Full Article
if 3GPP Commits to Develop 6G Specifications By www.etsi.org Published On :: Wed, 06 Dec 2023 09:39:04 GMT As the project celebrates the 25th anniversary of the signing of the 3GPP Project Agreement, the 3GPP Organizational Partners have today issued the following joint press release. Sophia Antipolis, 4 December 2023 With its work on 3G, 4G and 5G specifications used by billions of communications services consumers globally, 3GPP stands ready to create the 6G future. Read More... Full Article
if ETSI Open Source MANO announces Release FIFTEEN, leaner and easier to maintain By www.etsi.org Published On :: Mon, 08 Apr 2024 10:24:02 GMT Sophia Antipolis, 21 December 2023 The ETSI Open Source MANO community is proud to announce OSM Release FIFTEEN, meeting the well-established cadence of two releases per year. The OSM community delivers one Long Term Support (LTS) and one regular release every year, to ensure the OSM user base is provided with continuous innovations and production-ready stability. Read More... Full Article
if ETSI Protection Profile for securing smartphones gains world-first certification from French Cybersecurity Agency By www.etsi.org Published On :: Fri, 12 Apr 2024 09:05:05 GMT Sophia Antipolis, 12 January 2024 In a significant step highlighting the critical importance of security for mobile device users, the French National Cybersecurity Agency (ANSSI) has certified ETSI's Consumer Mobile Device Protection Profile under the Common Criteria global certification framework. This represents the first certification by a national administration of a comprehensive suite of specifications for assessing the security of smartphones. Read More... Full Article
if ETSI Announces 1st Release of SDG OpenCAPIF Delivering a Robust, Secure, and Efficient 3GPP API Management Platform By www.etsi.org Published On :: Fri, 12 Jul 2024 08:12:20 GMT Sophia Antipolis, 9 July 2024 ETSI is excited to announce OpenCAPIF Release 1 is now available in the ETSI Labs. OpenCAPIF develops a Common API Framework as defined by 3GPP and this new version introduces several improvements and new features to deliver a more robust, secure, and efficient API Management Platform. These advancements are developed in tight collaboration and incorporating feedback from a growing Research Ecosystem including SNS projects such as 6G-SANDBOX, FIDAL, IMAGINEB5G, SAFE6G, ORIGAMI, ENVELOPE and SUNRISE6G. Read More... Full Article
if Take Control: Be the CEO of Your Career and Life By www.alumni.mcgill.ca Published On :: Wed, 31 Dec 1969 19:00:00 -0500 Starts: Wed, 04 Dec 2024 19:00:00 -050012/04/2024 05:30:00PMLocation: Montreal, Canada Full Article
if Racial Uplift Ideology in the Era of the Negro Problem By nationalhumanitiescenter.org Published On :: Fri, 25 Jun 2010 11:53:34 -0400 New essay by Kevin K. Gaines, "Racial Uplift Ideology in the Era of the Negro Problem," added to Freedom's Story: Teaching African American Literature and History, TeacherServe from the National Humanities Center. Full Article
if SpotOn London 2012 Storify: eBooks and apps By www.nature.com Published On :: Tue, 20 Nov 2012 10:53:56 +0000 Here is a Storify round up of the SpotOn London session: Enhanced eBooks & BookApps: The Full Article Featured SpotOn London (#SoLo) Storifys Tools #solo12ebook
if SpotOn London 2012 Storify: Collaborating and building your online presence: educating scientists and science students By www.nature.com Published On :: Wed, 21 Nov 2012 10:24:27 +0000 Jenny Evans has created a Storify summary of her SpotOn London session: Collaborating and building your online Full Article Featured SpotOn London (#SoLo) Storifys Tools #solo12edu
if SpotOn London 2012 Storify: BrainSpace, a global interest graph for scientists By www.nature.com Published On :: Tue, 18 Dec 2012 13:20:35 +0000 Here is a Storify summary of the SpotOn London session: BrainSpace, a global interest graph for Full Article Featured SpotOn London (#SoLo) Storifys Tools #solo12PD
if SpotOn London 2013: What should the scientific record look like in the digital age? By www.nature.com Published On :: Thu, 07 Nov 2013 10:34:33 +0000 Julia Schölermann is the organiser for this year’s SpotOn London session on, What should the scientific Full Article Featured SpotOn London (#SoLo) Tools
if SpotOn London Storify: Wikipedia editing session By www.nature.com Published On :: Mon, 11 Nov 2013 15:16:19 +0000 Here is a Storify collecting the online conversations from the Wikipedia editing workshop at this year’s Full Article Featured SpotOn London (#SoLo) Storifys Tools #solo13wiki
if How does agricultural productivity growth affect agrifood system transformation goals? By www.youtube.com Published On :: Tue, 9 Jul 2024 16:46:57 GMT Full Article
if From Bugs to Breaches: 25 Significant CVEs As MITRE CVE Turns 25 By www.tenable.com Published On :: Tue, 22 Oct 2024 11:11:11 -0400 Twenty five years after the launch of CVE, the Tenable Security Response Team has handpicked 25 vulnerabilities that stand out for their significance.BackgroundIn January 1999, David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities” describing an effort to create interoperability between multiple vulnerability databases. To achieve a common taxonomy for vulnerabilities and exposures, they proposed Common Vulnerabilities and Exposures (CVE). In September 1999, the MITRE Corporation finalized the first CVE list, which included 321 records. CVE was revealed to the world the following month.As of October 2024, there are over 240,000 CVEs. including many that have significantly impacted consumers, businesses and governments. The Tenable Security Response Team has chosen to highlight the following 25 significant vulnerabilities, followed by links to product coverage for Tenable customers to utilize.25 Significant CVEsCVE-1999-0211: SunOS Arbitrary Read/Write VulnerabilityArbitrary ReadArbitrary WriteLocalCritical1999Why it’s significant: To our knowledge, there is no formally recognized “first CVE.” However, the GitHub repository for CVE.org shows that the first CVE submitted was CVE-1999-0211 on September 29, 1999 at 12:00AM. Because it was the first one, we’ve chosen to highlight it. The vulnerability was first identified in 1991 and a revised patch was issued in 1994.CVE-2010-2568: Windows Shell Remote Code Execution VulnerabilityRemote Code ExecutionExploitedZero-DayLocalStuxnetHigh2010Why it’s significant: Regarded as one of the most sophisticated cyberespionage tools ever created, Stuxnet was designed to target SCADA systems in industrial environments to reportedly sabotage Iran's nuclear program. Stuxnet exploited CVE-2010-2568 as one of its initial infection vectors, spreading via removable drives. Once a compromised USB drive was inserted into a system, Stuxnet was executed automatically via the vulnerability, infecting the host machine, propagating to other systems through network shares and additional USB drives.CVE-2014-0160: OpenSSL Information Disclosure VulnerabilityHeartbleedInformation DisclosureExploitedZero-DayNetworkCybercriminalsHigh2014Why it’s significant: Dubbed “Heartbleed” because it was found in the Heartbeat extension of OpenSSL, this vulnerability allows an attacker, without prior authentication, to send a malicious heartbeat request with a false length field, claiming the packet contains more data than it does. The receiving system would then return data from its memory extending beyond the legitimate request, which may include sensitive private data, such as server keys and user credentials. OpenSSL is used by millions of websites, cloud services, and even VPN software, for encryption, making Heartbleed one of the most widespread vulnerabilities at the time.CVE-2014-6271: GNU Bash Shellshock Remote Code Execution VulnerabilityShellshock Bash Bug Remote Code ExecutionExploitedZero-DayNetworkCybercriminalsCritical2014Why it’s significant: An attacker could craft an environment variable that contained both a function definition and additional malicious code. When Bash, a command interpreter used by Unix-based systems including Linux and macOS, processed this variable, it would execute the function, but also run the arbitrary commands appended after the function definition. “Shellshock” quickly became one of the most severe vulnerabilities discovered, comparable to Heartbleed’s potential impact. Attackers could exploit Shellshock to gain full control of vulnerable systems, leading to data breaches, service interruptions and malware deployment. The impact extended far beyond local systems. Bash is used by numerous services, particularly web servers, via CGI scripts to handle HTTP requests.CVE-2015-5119: Adobe Flash Player Use After FreeRemote Code Execution Denial-of-ServiceExploitedZero-DayCybercriminalsAPT GroupsCritical2015Why it’s significant: Discovered during the Hacking Team data breach, it was quickly weaponized, appearing in multiple exploit kits. CVE-2015-5119 is a use-after-free flaw in Flash’s ActionScript ByteArray class, allowing attackers to execute arbitrary code by tricking users into visiting a compromised website. It was quickly integrated into attack frameworks used by Advanced Persistent Threat (APT) groups like APT3, APT18, and Fancy Bear (APT28). These groups, with ties to China and Russia, used the vulnerability to spy on and steal data from governments and corporations. Fancy Bear has been associated with nation-state cyber warfare, exploiting Flash vulnerabilities for political and military intelligence information gathering. This flaw, along with several other Flash vulnerabilities, highlighted Flash’s risks, accelerating its eventual phase-out.CVE-2017-11882: Microsoft Office Equation Editor Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsHigh2017Why it’s significant: The vulnerability existed for 17 years in Equation Editor (EQNEDT32.EXE), a Microsoft Office legacy component used to insert and edit complex mathematical equations within documents. Once CVE-2017-11882 became public, cybercriminals and APT groups included it in maliciously crafted Office files. It became one of 2018’s most exploited vulnerabilities and continues to be utilized by various threat actors including SideWinder.CVE-2017-0144: Windows SMB Remote Code Execution VulnerabilityEternalBlueRemote Code ExecutionExploitedNetworkWannaCry NotPetyaHigh2017Why it’s significant: CVE-2017-0144 was discovered by the National Security Agency (NSA) and leaked by a hacker group known as Shadow Brokers, making it widely accessible. Dubbed “EternalBlue,” its capacity to propagate laterally through networks, often infecting unpatched machines without human interaction, made it highly dangerous. It was weaponized in the WannaCry ransomware attack in May 2017 and spread globally. It was reused by NotPetya, a data-destroying wiper originally disguised as ransomware. NotPetya targeted companies in Ukraine before spreading worldwide. This made it one of history’s costliest cyberattacks.CVE-2017-5638: Apache Struts 2 Jakarta Multipart Parser Remote Code Execution VulnerabilityRemote Code ExecutionExploitedNetworkEquifax BreachCritical2017Why it’s significant: This vulnerability affects the Jakarta Multipart Parser in Apache Struts 2, a popular framework for building Java web applications. An attacker can exploit it by injecting malicious code into HTTP headers during file uploads, resulting in remote code execution (RCE), giving attackers control of the web server. CVE-2017-5638 was used in the Equifax breach, where personal and financial data of 147 million people was stolen, emphasizing the importance of patching widely-used frameworks, particularly in enterprise environments, to prevent catastrophic data breaches.CVE-2019-0708: Remote Desktop Services Remote Code Execution VulnerabilityBlueKeep DejaBlue Remote Code ExecutionExploitedNetworkRansomware GroupsCybercriminalsCritical2019Why it’s significant: Dubbed "BlueKeep," this vulnerability in Windows Remote Desktop Services (RDS) was significant for its potential for widespread, self-propagating attacks, similar to the infamous WannaCry ransomware. An attacker could exploit this flaw to execute arbitrary code and take full control of a machine through Remote Desktop Protocol (RDP), a common method for remote administration. BlueKeep was featured in the Top Routinely Exploited Vulnerabilities list in 2022 and was exploited by affiliates of the LockBit ransomware group.CVE-2020-0796: Windows SMBv3 Client/Server Remote Code Execution VulnerabilitySMBGhost EternalDarknessRemote Code ExecutionExploited NetworkCybercriminalsRansomware GroupsCritical2020Why it’s significant: Its discovery evoked memories of EternalBlue because of the potential for it to be wormable, which is what led to it becoming a named vulnerability. Researchers found it trivial to identify the flaw and develop proof-of-concept (PoC) exploits for it. It was exploited in the wild by cybercriminals, including the Conti ransomware group and its affiliates.CVE-2019-19781: Citrix ADC and Gateway Remote Code Execution VulnerabilityPath TraversalExploitedNetworkAPT GroupsRansomware GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Citrix Application Delivery Controller (ADC) and Citrix Gateway is significant due to its rapid exploitation by multiple threat actors, including state-sponsored groups and ransomware affiliates. By sending crafted HTTP requests, attackers could gain RCE and take full control of affected devices to install malware or steal data. The vulnerability remained unpatched for a month after its disclosure, leading to widespread exploitation. Unpatched systems are still being targeted today, highlighting the risk of ignoring known vulnerabilities.CVE-2019-10149: Exim Remote Command Execution VulnerabilityRemote Command ExecutionExploitedNetworkAPT GroupsCybercriminalsCritical2019Why it’s significant: This vulnerability in Exim, a popular Mail Transfer Agent, allows attackers to execute arbitrary commands with root privileges simply by sending a specially crafted email. The availability of public exploits led to widespread scanning and exploitation of vulnerable Exim servers, with attackers using compromised systems to install cryptocurrency miners (cryptominers), launch internal attacks or establish persistent backdoors. The NSA warned that state-sponsored actors were actively exploiting this flaw to compromise email servers and gather sensitive information.CVE-2020-1472: Netlogon Elevation of Privilege VulnerabilityZerologonElevation of PrivilegeExploitedLocalRansomware GroupsAPT GroupsCybercriminalsCritical2020Why it’s significant: This vulnerability in the Netlogon Remote Protocol (MS-NRPC) allows attackers with network access to a Windows domain controller to reset its password, enabling them to impersonate the domain controller and potentially take over the entire domain. Its severity was underscored when Microsoft reported active exploitation less than two months after disclosure and the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to patch the flaw. Despite available patches, it continues to be exploited by ransomware groups, APT groups, and others, highlighting its broad and ongoing impact on network security.CVE-2017-5753: CPU Speculative Execution Bounds Check Bypass VulnerabilitySpectreSpeculative Execution Bounds Check BypassLocalMedium2018Why it’s significant: In a speculative execution process, an idle microprocessor waiting to receive data speculates what the next instruction might be. Although meant to enhance performance, this process became a fundamental design flaw affecting the security of numerous modern processors. In Spectre’s case, an attacker-controlled process could read arbitrary memory belonging to another process. Since its discovery in January 2018, Spectre has affected nearly all modern processors from Intel, AMD and ARM. While it’s difficult to execute a successful Spectre attack, fully remediating the root cause is hard and requires microcode as well as operating system updates to mitigate the risk.CVE-2017-5754: CPU Speculative Execution Rogue Data Cache Load VulnerabilityMeltdownSpeculative Execution Rogue Data Cache LoadLocalHigh2018Why it’s significant: Meltdown, another speculative execution vulnerability released alongside Spectre, can allow a userspace program to read privileged kernel memory. It exploits a race condition between the memory access and privilege checking while speculatively executing instructions. Meltdown impacts desktop, laptop and cloud systems and, according to researchers, may affect nearly every Intel processor released since 1995. With a wide reaching impact, both Spectre and Meltdown sparked major interest in a largely unexplored security area. The result: a slew of research and vulnerability discoveries, many of which were also given names and logos. While there’s no evidence of a successful Meltdown exploit, the discovery showcased the risk of security boundaries enforced by hardware.CVE-2021-36942: Windows LSA Spoofing VulnerabilityPetitPotamSpoofingExploitedZero-DayNetworkRansomware GroupsHigh2021Why it’s significant: This vulnerability can force domain controllers to authenticate to an attacker-controlled destination. Shortly after a PoC was disclosed, it was adopted by ransomware groups like LockFile, which have chained Microsoft Exchange vulnerabilities with PetitPotam to take over domain controllers. Patched in the August 2021 Patch Tuesday release, the initial patch for CVE-2021-36942 only partially mitigated the issue, with Microsoft pushing general mitigation guidance for defending against NTLM Relay Attacks.CVE-2022-30190: Microsoft Windows Support Diagnostic Tool Remote Code ExecutionFollinaRemote Code ExecutionExploitedZero-DayLocalQakbot RemcosHigh2022Why it’s significant: Follina, a zero-day RCE vulnerability in MSDT impacting several versions of Microsoft Office, was later designated CVE-2022-30190. After public disclosure in May 2022, Microsoft patched Follina in the June 2022 Patch Tuesday. After disclosure, reports suggested that Microsoft dismissed the flaw’s initial disclosure as early as April 2022. Follina has been widely adopted by threat actors and was associated with some of 2021’s top malware strains in a joint cybersecurity advisory from CISA and the Australian Cyber Security Centre (ACSC), operating under the Australian Signals Directorate (ASD).CVE-2021-44228: Apache Log4j Remote Code Execution VulnerabilityLog4ShellRemote Code ExecutionExploitedNetworkCybercriminalsAPT GroupsCritical2021Why it’s significant: Log4j, a Java logging library widely used across many products and services, created a large attack surface. The discovery of CVE-2021-44228, dubbed “Log4Shell,” caused great concern, as exploitation simply requires sending a specially crafted request to a server running a vulnerable version of Log4j. After its disclosure, Log4Shell was exploited in attacks by cryptominers, DDoS botnets, ransomware groups and APT groups including those affiliated with the Iranian Islamic Revolutionary Guard Corps (IRGC).CVE-2021-26855: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityProxyLogonServer-Side Request Forgery (SSRF)ExploitedZero-DayNetworkAPT Groups Ransomware GroupsCybercriminalsCritical2021Why it’s significant: CVE-2021-26855 was discovered as a zero-day along with four other vulnerabilities in Microsoft Exchange Server. It was exploited by a nation-state threat actor dubbed HAFNIUM. By sending a specially crafted HTTP request to a vulnerable Exchange Server, an attacker could steal the contents of user mailboxes using ProxyLogon. Outside of HAFNIUM, ProxyLogon has been used by ransomware groups and other cybercriminals. Its discovery created a domino effect, as other Exchange Server flaws, including ProxyShell and ProxyNotShell, were discovered, disclosed and subsequently exploited by attackers.CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution VulnerabilityPrintNightmareRemote Code ExecutionExploitedLocalAPT GroupsRansomware GroupsCybercriminalsHigh2021Why it’s significant: This RCE in the ubiquitous Windows Print Spooler could grant authenticated attackers arbitrary code execution privileges as SYSTEM. There was confusion surrounding the disclosure of this flaw, identified as CVE-2021-34527 and dubbed “PrintNightmare.” Originally, CVE-2021-1675, disclosed in June 2021, was believed to be the real PrintNightmare. However, Microsoft noted CVE-2021-1675 is “similar but distinct” from PrintNightmare. Since its disclosure, several Print Spooler vulnerabilities were disclosed, while a variety of attackers, including the Magniber and Vice Society ransomware groups exploited PrintNightmare.CVE-2021-27101: Accellion File Transfer Appliance (FTA) SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2021Why it’s significant: The file transfer appliance from Accellion (now known as Kiteworks) was exploited as a zero-day by the CLOP ransomware group between December 2020 and early 2021. Mandiant, hired by Kiteworks to investigate, determined that CLOP (aka UNC2546) exploited several flaws in FTA including CVE-2021-27101. This was CLOP’s first foray into targeting file transfer solutions, as they provide an easy avenue for the exfiltration of sensitive data that can be used to facilitate extortion.CVE-2023-34362: Progress Software MOVEit Transfer SQL Injection VulnerabilitySQL InjectionExploitedZero-DayNetworkRansomware GroupCritical2023Why it’s significant: CLOP’s targeting of file transfer solutions culminated in the discovery of CVE-2023-34362, a zero-day in Progress Software’s MOVEit Transfer, a secure managed file transfer software. CLOP targeted MOVEit in May 2023 and the ramifications are still felt today. According to research conducted by Emsisoft, 2,773 organizations have been impacted and information on over 95 million individuals has been exposed as of October 2024. This attack underscored the value in targeting file transfer solutions.CVE-2023-4966: Citrix NetScaler and ADC Gateway Sensitive Information Disclosure VulnerabilityCitrixBleedInformation DisclosureExploitedZero-DayNetworkRansomware GroupsAPT GroupsCritical2023Why it’s significant: CVE-2023-4966, also known as “CitrixBleed,” is very simple to exploit. An unauthenticated attacker could send a specially crafted request to a vulnerable NetScaler ADC or Gateway endpoint and obtain valid session tokens from the device’s memory. These session tokens could be replayed back to bypass authentication, and would persist even after the available patches had been applied. CitrixBleed saw mass exploitation after its disclosure, and ransomware groups like LockBit 3.0 and Medusa adopted it.CVE-2023-2868: Barracuda Email Security Gateway (ESG) Remote Command Injection VulnerabilityRemote Command InjectionExploitedZero-DayNetworkAPT GroupsCritical2023Why it’s significant: Researchers found evidence of zero-day exploitation of CVE-2023-2868 in October 2022 by the APT group UNC4841. While Barracuda released patches in May 2023, the FBI issued a flash alert in August 2023 declaring them “ineffective,” stating that “active intrusions” were being observed on patched systems. This led to Barracuda making an unprecedented recommendation for the “immediate replacement of compromised ESG appliances, regardless of patch level.”CVE-2024-3094: XZ Utils Embedded Malicious Code VulnerabilityEmbedded Malicious CodeZero-DayUnknown Threat Actor (Jia Tan)Critical2024Why it’s significant: CVE-2024-3094 is not a traditional vulnerability. It is a CVE assigned for a supply-chain backdoor discovered in XZ Utils, a compression library found in various Linux distributions. Developer Andres Freund discovered the backdoor while investigating SSH performance issues. CVE-2024-3094 highlighted a coordinated supply chain attack by an unknown individual that contributed to the XZ GitHub project for two and a half years, gaining the trust of the developer before introducing the backdoor. The outcome of this supply chain attack could have been worse were it not for Freund’s discovery.Identifying affected systemsA list of Tenable plugins for these vulnerabilities can be found on the individual CVE pages:CVE-1999-0211CVE-2010-2568CVE-2014-0160CVE-2014-6271CVE-2015-5119CVE-2017-11882CVE-2017-0144CVE-2017-5638CVE-2019-0708CVE-2020-0796CVE-2019-19781CVE-2019-10149CVE-2020-1472CVE-2017-5753CVE-2017-5754CVE-2021-36942CVE-2022-30190CVE-2021-44228CVE-2021-26855CVE-2021-34527CVE-2021-27101CVE-2023-34362CVE-2023-4966CVE-2023-2868CVE-2024-3094 Full Article
if OSC publishes gamification research and launches new trading simulation tool for Investor Education Month By www.osc.ca Published On :: Wed, 09 Oct 2024 12:31:40 GMT TORONTO – The Ontario Securities Commission (OSC) today released a new report that studied the impact of gamification on investors. Full Article
if OSC study finds ESG ratings greatly influence investor decisions but are difficult to understand By www.osc.ca Published On :: Wed, 30 Oct 2024 13:50:36 GMT TORONTO – The Ontario Securities Commission (OSC) today released the results of a study examining the influence of environmental, social and governance (ESG) factors on retail investor decision making. Full Article
if SpotOn London 2012 Storify: Fixing the fraud: how do we safeguard science from misconduct? By www.nature.com Published On :: Wed, 14 Nov 2012 12:00:49 +0000 #solo12fraud Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12fraud
if SpotOn London 2012 Storify: Crowdfunded science – new opportunities or dangerous echo chamber? By www.nature.com Published On :: Wed, 14 Nov 2012 14:55:52 +0000 Finding sources for funding research can be a demanding task, and one that's not always successful. A new trend that's emerging out of the necessity to fund projects that have no traditional means of support is "crowdfunding." A panel at SpotOnLondon weighs the resulting apprehensions and benefits. Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12funding
if SpotOn London 2012: My not-so-secret-anymore double life: Juggling research and science communication By www.nature.com Published On :: Mon, 19 Nov 2012 12:52:44 +0000 Dr Anne Osterrieder is a Research and Science Communication Fellow in Plant Cell Biology at the Department of Full Article Policy SpotOn London (#SoLo) #solo12jobs
if SpotOn London 2012 Storify: Incentivising Open Access and Open Science: Carrot and Stick By www.nature.com Published On :: Tue, 20 Nov 2012 13:12:21 +0000 Here is a Storify round up of the SpotOn London session: Incentivising Open Access and Open Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12open
if SpotOn London 2012 Storify: ORCID – why do we need a unique researcher ID? By www.nature.com Published On :: Tue, 20 Nov 2012 15:53:18 +0000 Here is a Storify round up of the SpotOn London session: ORCID – why do we Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12ORCID
if SpotOn London 2012 Storify: What do you need to start a revolution? By www.nature.com Published On :: Wed, 21 Nov 2012 11:57:53 +0000 Here is a Storify round up of the SpotOn London session: What do you need to Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12revo
if SpotOn London 2012 Storify: Tackling the terabyte: how should research adapt to the era of big data? By www.nature.com Published On :: Wed, 21 Nov 2012 15:09:37 +0000 Here is a Storify round up of the SpotOn London session: Tackling the terabyte: how should Full Article Featured Policy SpotOn London (#SoLo) Storifys #solo12tera
if SpotOn London 2013 Storify: Open, Portable, Decoupled – How should Peer Review change? By www.nature.com Published On :: Mon, 11 Nov 2013 14:51:25 +0000 Here is a Storify collating the online conversation around the Open, Portable, Decoupled – How should Full Article Featured Outreach SpotOn London (#SoLo) Storifys #solo13peer
if SpotOn London 2013 Storify: Science games: does play work? By www.nature.com Published On :: Mon, 11 Nov 2013 15:05:12 +0000 Here is a Storify collecting the online conversations from the Science games: does play work? session at Full Article Featured Outreach SpotOn London (#SoLo) Storifys #solo13play
if SpotOn London Storify: Communicating Science in an Open Access World By www.nature.com Published On :: Mon, 11 Nov 2013 15:11:14 +0000 Here is a Storify collecting the online conversations from the Communicating Science in an Open Access Full Article Featured Outreach SpotOn London (#SoLo) Storifys #solo13open
