alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attacker
Matching passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Near-miss passage: CVE-2015-4077. CWE: CWE-200. CVSS: 2.0999999046325684. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.
Query: Sigma rule for Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing
Matching passage: Sigma rule: Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in RunMRU Registry Path - ClickFix id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://github.com/JohnHammond/recaptcha-phish author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\ Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - Windows id: 2fbbe9ff-0afc-470b-bdc0-592198339968 related: - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Query: describe CVE-2015-9468
Matching passage: CVE-2015-9468. CWE: CWE-79. CVSS: 6.099999904632568. The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.
Near-miss passage: CVE-2015-0101. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager Standard 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; IBM Business Process Manager Express 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5; and IBM Business Process Manager Advanced 7.5.x before 7.5, 8.0.x before 8.0.1, 8.5.x before 8.5.5.
Query: describe CVE-2015-2418
Matching passage: CVE-2015-2418. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in Microsoft Malicious Software Removal Tool (MSRT) before 5.26 allows local users to gain privileges via a crafted DLL, aka "MSRT Race Condition Vulnerability."
Near-miss passage: CVE-2015-1340. CWE: CWE-362. CVSS: 8.100000381469727. LXD before version 0.19-0ubuntu5 doUidshiftIntoContainer() has an unsafe Chmod() call that races against the stat in the Filepath.Walk() function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.
Query: exploit Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbi
Matching passage: CVE-2015-4492. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
Near-miss passage: CVE-2015-4554. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Query: CVE similar to CVE-2015-0621
Matching passage: CVE-2015-0621. CWE: CWE-19. CVSS: 7.800000190734863. Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347.
Near-miss passage: CVE-2015-5344. CWE: CWE-19. CVSS: 9.800000190734863. The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Query: risk of Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors.
Matching passage: CVE-2015-5878. CWE: CWE-200. CVSS: 2.0999999046325684. Notes in Apple OS X before 10.11 misparses links, which allows local users to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-1933. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.8 IFIX001, and 7.6.0 before 7.6.0.1 IFIX001; Maximo Asset Management 7.5.x before 7.5.0.8 IFIX001 and 7.6.0 before 7.6.0.1 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products do not have an off autocomplete attribute for the password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: CVE similar to CVE-2015-6920
Matching passage: CVE-2015-6920. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Near-miss passage: CVE-2015-1988. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: patch priority for CVE-2015-2316
Matching passage: CVE-2015-2316. CWE: CWE-399. CVSS: 5.0. The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.
Near-miss passage: CVE-2015-6394. CWE: CWE-399. CVSS: 4.900000095367432. The kernel in Cisco NX-OS 5.2(9)N1(1) on Nexus 5000 devices allows local users to cause a denial of service (device crash) via crafted USB parameters, aka Bug ID CSCus89408.
Query: CVE similar to CVE-2015-0786
Matching passage: CVE-2015-0786. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2181. CWE: CWE-119. CVSS: 8.800000190734863. Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) password or (2) username.
Query: rule covering Detects usage of crontab to list the tasks of the user
Matching passage: Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Near-miss passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / ps_script. Rule: title: Root Certificate Installed - PowerShell id: 42821614-9264-4761-acfc-5772c3286f76 status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-10 modified: 2022-12-02 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains|all: - Move-Item - Cert:\LocalMachine\Root selection2: ScriptBlockText|contains|all: - Import-Certificate - Cert:\LocalMachine\Root condition: 1 of selection* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Query: patch priority for CVE-2015-0805
Matching passage: CVE-2015-0805. CWE: CWE-17. CVSS: 7.5. The Off Main Thread Compositing (OMTC) implementation in Mozilla Firefox before 37.0 makes an incorrect memset call during interaction with the mozilla::layers::BufferTextureClient::AllocateForSurface function, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors that trigger rendering of 2D graphics content.
Near-miss passage: CVE-2015-1728. CWE: CWE-17. CVSS: 9.300000190734863. Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site, aka "Windows Media Player RCE via DataObject Vulnerability."
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to inject arbitrary web script or HTML via the (
Matching passage: CVE-2015-0526. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Validation Manager (RVM) 3.2 before build 201 allow remote attackers to inject arbitrary web script or HTML via the (1) displayMode or (2) wrapPreDisplayMode parameter.
Near-miss passage: CVE-2015-0549. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: rule covering Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to e
Matching passage: Sigma rule: Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to e. Logsource: windows / process_creation. Rule: title: Remote Access Tool - MeshAgent Command Execution via MeshCentral id: 74a2b202-73e0-4693-9a3a-9d36146d0775 status: test description: 'Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes. ' references: - https://github.com/Ylianst/MeshAgent - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173 - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55 author: '@Kostastsale' date: 2024-09-22 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: \meshagent.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe condition: selection falsepositives: - False positives can be found in environments using MeshAgent for remote management, analysis should prioritize the grandparent process, MeshAgent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host. level: medium
Near-miss passage: Sigma rule: Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identif. Logsource: aws / cloudtrail. Rule: title: AWS ConsoleLogin Failed Authentication id: 6393e346-1977-46ef-8987-ad414a145fad status: experimental description: 'Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts. ' references: - https://naikordian.github.io/blog/posts/brute-force-aws-console/ - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.credential-access - attack.t1110 logsource: product: aws service: cloudtrail detection: selection: eventName: ConsoleLogin errorMessage: Failed authentication condition: selection falsepositives: - Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts. level: medium
Query: patch priority for CVE-2015-5821
Matching passage: CVE-2015-5821. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5545. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5546, CVE-2015-5547, CVE-2015-5548, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Query: describe CVE-2015-9067
Matching passage: CVE-2015-9067. CWE: UNKNOWN. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Near-miss passage: CVE-2015-4752. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect availability via vectors related to Server : I_S.
Query: exploit In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 
Matching passage: CVE-2015-9182. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, lack of input validation in OEMCrypto_GenerateSignature() can cause buffer over read.
Near-miss passage: CVE-2015-0661. CWE: CWE-20. CVSS: 4.0. The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Query: alert when Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
Matching passage: Sigma rule: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder. Logsource: windows / file_event. Rule: title: Suspicious Files in Default GPO Folder id: 5f87308a-0a5b-4623-ae15-d8fa1809bc60 status: test description: Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 tags: - attack.stealth - attack.t1036.005 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\ TargetFilename|endswith: - .dll - .exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress. Logsource: windows / process_creation. Rule: title: Compressed File Creation Via Tar.EXE id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9 status: test description: 'Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ' references: - https://unit42.paloaltonetworks.com/chromeloader-malware/ - https://lolbas-project.github.io/lolbas/Binaries/Tar/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage author: Nasreddine Bencherchali (Nextron Systems), AdmU3 date: 2023-12-19 tags: - attack.collection - attack.exfiltration - attack.t1560 - attack.t1560.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tar.exe - OriginalFileName: bsdtar selection_create: CommandLine|contains: - -c - -r - -u condition: all of selection_* falsepositives: - Likely level: low
Query: exploit EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.
Matching passage: CVE-2015-3172. CWE: CWE-79. CVSS: 5.400000095367432. EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.
Near-miss passage: CVE-2015-4671. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Query: detect Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left in logs
Matching passage: Sigma rule: Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left. Logsource: linux / process_creation. Rule: title: File Deletion id: 30aed7b6-d2c1-4eaf-9382-b6bc43e50c57 status: stable description: Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md author: Ömer Günal, oscd.community date: 2020-10-07 modified: 2022-09-15 tags: - attack.stealth - attack.t1070.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /rm - /shred - /unlink condition: selection falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.. Logsource: windows / security. Rule: title: External Remote RDP Logon from Public IP id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 related: - id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc type: derived status: test description: Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port. references: - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html - https://twitter.com/Purp1eW0lf/status/1616144561965002752 author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) date: 2023-01-19 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1133 - attack.t1078 - attack.t1110 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 10 filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 filter_main_empty: IpAddress: '-' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate or intentional inbound connections from public IP addresses on the RDP port. level: medium
Query: risk of The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a den
Matching passage: CVE-2015-8227. CWE: CWE-20. CVSS: 8.5. The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.
Near-miss passage: CVE-2015-3204. CWE: CWE-20. CVSS: 5.0. libreswan 3.9 through 3.12 allows remote attackers to cause a denial of service (daemon restart) via an IKEv1 packet with (1) unassigned bits set in the IPSEC DOI value or (2) the next payload value set to ISAKMP_NEXT_SAK.