Apple Releases Security Updates for Multiple Products

Apple Releases Security Updates for Multiple Products

This article is contributed. See the original author and article here.

Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

SSL

Secure .gov websites use HTTPS A lock (lock icon) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
How to spot, stop, and report post-disaster scams

How to spot, stop, and report post-disaster scams

This article was originally posted by the FTC. See the original article here.

If you or someone you know has been affected by the devastating series of tornadoes that roared across Kentucky, Illinois, Tennessee, Arkansas, and Missouri, coping with the aftermath is never easy. But when scammers target people just trying to recover, it can be even worse. Here are ways to help you and your neighbors avoid common post-disaster scams.

  • Be skeptical of anyone promising immediate clean-up and debris removal. Some may quote outrageous prices, demand payment up-front, or lack the skills needed.
  • Check them out. Before you pay, ask for IDs, licenses, and proof of insurance. Don’t believe any promises that aren’t in writing.
  • Never pay by wire transfer, gift card, cryptocurrency, or in cash. And never make the final payment until the work is done and you’re satisfied.
  • Guard your personal information. Only scammers will say they’re a government official and then demand money or your credit card, bank account, or Social Security number.
  • Know that FEMA doesn’t charge application fees. If someone wants money to help you qualify for FEMA funds, that’s probably a scam.
  • Be wise to rental listing scams. Steer clear of people who tell you to wire money or ask for security deposits or rent before you’ve met or signed a lease.
  • Spot disaster-related charity scams. Scammers will often try to make a quick profit from the misfortune of others. Check out the FTC’s advice on donating wisely and avoiding charity scams.

Please share this 8.5 x 11 infographic, Picking Up the Pieces after a Disaster, and social media image in your community. Graphic listing ways to pick up the pieces after a disaster

Bookmark Dealing with Weather Emergencies. If a weather event or disaster affects you, come back for more tips on recovery and information about your rights. Like all our materials, the site is mobile-friendly, so you’ll have ready access to information when and where you need it.

Suspect a scam? Report it to the FTC at ReportFraud.ftc.gov. Want information on the latest frauds and scams we’re seeing? Sign up for our consumer alerts.

Note: This blog, originally posted on September 3, 2021, has been updated following the December 11-12 series of tornadoes.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Make your donation count by avoiding end-of-year charity scams

Make your donation count by avoiding end-of-year charity scams

This article was originally posted by the FTC. See the original article here.

Avoid charity fraudt. www.ftc.gov/charityThe season of giving is here. If you celebrate Christmas, you might be about to fill some stockings. But, for many, holiday giving includes supporting charitable causes. Charities in need of support will be making year-end appeals by phone, mail, email, and social media. Scammers know that, too, and every year try to trick people into giving to them, not the real deal. So here are some steps to take to make sure the charity is real and your money will support the programs you care about.

  • Check out the charity before you donate. Search online with the name of the charity plus words like “complaint,” “review,” or “scam.” Ask how much of your donation will go to the work of the charity (versus, say, fundraising). Learn more by seeing what organizations like the BBB Wise Giving Alliance, Charity Navigator, CharityWatch and Candid say about how a charity does its business and spends its money.
  • Double-check the name. Scammers sometimes use names that sound like real charities that you know and trust.
  • Don’t be rushed. Scammers love to pressure you to make fast decisions and pay them. But take it slow. Real charities will be happy to get your donation when you’re ready.
  • Avoid donations by cash, gift card, cryptocurrency, or money transfer service — if they demand to be paid that way. That’s how scammers ask to be paid. Your safer bet is to pay by credit card.
  • Report charity scams at ReportFraud.ftc.gov. Your report can help people in your community protect themselves from charity scams and other types of fraud. The FTC uses reports like yours to investigate and bring law enforcement cases.

Check out ftc.gov/charity for more, including on giving through online platforms. And take a moment to check out, and share, this charity fraud video. Happy giving!

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

CISA Adds Thirteen Known Exploited Vulnerabilities to Catalog

This article is contributed. See the original author and article here.

CISA has added thirteen new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.

CVE Number

CVE Title

Remediation Due Date

CVE-2021-44228

Apache Log4j2 Remote Code Execution Vulnerability

12/24/2021

CVE-2021-44515

Zoho Corp. Desktop Central Authentication Bypass Vulnerability

12/24/2021

CVE-2021-44168

Fortinet FortiOS Arbitrary File Download Vulnerability

12/24/2021

CVE-2021-35394

Realtek Jungle SDK Remote Code Execution Vulnerability

12/24/2021

CVE-2020-8816

Pi-Hole AdminLTE Remote Code Execution Vulnerability

6/10/2022

CVE-2020-17463

Fuel CMS SQL Injection Vulnerability

6/10/2022

CVE-2019-7238

Sonatype Nexus Repository Manager Incorrect Access Control Vulnerability

6/10/2022

CVE-2019-13272

Linux Kernel Improper Privilege Management Vulnerability

6/10/2022

CVE-2019-10758

MongoDB mongo-express Remote Code Execution Vulnerability

6/10/2022

CVE-2019-0193

Apache Solr DataImportHandler Code Injection Vulnerability

6/10/2022

CVE-2017-17562

Embedthis GoAhead Remote Code Execution Vulnerability

6/10/2022

CVE-2017-12149

Red Hat Jboss Application Server Remote Code Execution Vulnerability

6/10/2022

CVE-2010-1871

Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability

6/10/2022

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the specified criteria

Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation

This article is contributed. See the original author and article here.

The Apache Software Foundation has released a security advisory to address a remote code execution vulnerability (CVE-2021-44228) affecting Log4j versions 2.0-beta9 to 2.14.1. A remote attacker could exploit this vulnerability to take control of an affected system. Log4j is an open-source, Java-based logging utility widely used by enterprise applications and cloud services.

CISA encourages users and administrators to review the Apache Log4j 2.15.0 Announcement and upgrade to Log4j 2.15.0 or apply the recommended mitigations immediately.