alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-6510
Matching passage: CVE-2015-6510. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in pfSense before 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) srctrack, (2) use_mfs_tmp_size, or (3) use_mfs_var_size parameter to system_advanced_misc.php; the (4) port, (5) snaplen, or (6) count parameter to diag_packet_capture.php; the (7) pppoe_resethour, (8) pppoe_resetminute, (9) wpa_group_rekey, or (10) wpa_gmk_rekey parameter to interfaces.php; the (11) pppoe_resethour or (12) pppoe_resetminute parameter to interfaces_ppps_edit.php; the (13) member[] parameter to interfaces_qinq_edit.php; the (14) port or (15) retry parameter to load_balancer_pool_edit.php; the (16) pkgrepourl parameter to pkg_mgr_settings.php; the (17) zone parameter to services_captiveportal.php; the port parameter to (18) services_dnsmasq.php or (19) services_unbound.php; the (20) cache_max_ttl or (21) cache_min_ttl parameter to services_unbound_advanced.php; the (22) sshport parameter to system_advanced_admin.php; the (23) id, (24) tunable, (25) descr, or (26) value parameter to system_advanced_sysctl.php; the (27) firmwareurl, (28) repositoryurl, or (29) branch parameter to system_firmware_settings.php; the (30) pfsyncpeerip, (31) synchronizetoip, (32) username, or (33) passwordfld parameter to system_hasync.php; the (34) maxmss parameter to vpn_ipsec_settings.php; the (35) ntp_server1, (36) ntp_server2, (37) wins_server1, or (38) wins_server2 parameter to vpn_openvpn_csc.php; or unspecified parameters to (39) load_balancer_relay_action.php, (40) load_balancer_relay_action_edit.php, (41) load_balancer_relay_protocol.php, or (42) load_balancer_relay_protocol_edit.php.
Near-miss passage: CVE-2015-2807. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter.
Query: exploit SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.act
Matching passage: CVE-2015-6962. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the web application in Farol allows remote attackers to execute arbitrary SQL commands via the email parameter to tkmonitor/estrutura/login/Login.actions.php.
Near-miss passage: CVE-2015-7342. CWE: CWE-89. CVSS: 7.199999809265137. JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
Query: describe CVE-2015-1684
Matching passage: CVE-2015-1684. CWE: CWE-200. CVSS: 4.300000190734863. VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."
Near-miss passage: CVE-2015-4503. CWE: CWE-200. CVSS: 5.0. The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Query: write Sigma for Detects the usage of the unsafe bpftrace option
Matching passage: Sigma rule: Detects the usage of the unsafe bpftrace option. Logsource: linux / process_creation. Rule: title: BPFtrace Unsafe Option Usage id: f8341cb2-ee25-43fa-a975-d8a5a9714b39 status: test description: Detects the usage of the unsafe bpftrace option references: - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/ - https://bpftrace.org/ author: Andreas Hunkeler (@Karneades) date: 2022-02-11 tags: - attack.execution - attack.t1059.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: bpftrace CommandLine|contains: --unsafe condition: selection falsepositives: - Legitimate usage of the unsafe option level: medium
Near-miss passage: Sigma rule: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Portable Gpg.EXE Execution id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41 status: test description: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. references: - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a - https://securelist.com/locked-out/68960/ - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-06 modified: 2023-11-10 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \gpg.exe - \gpg2.exe - OriginalFileName: gpg.exe - Description: GnuPG’s OpenPGP tool filter_main_legit_location: Image|contains: - :\Program Files (x86)\GNU\GnuPG\bin\ - :\Program Files (x86)\GnuPG VS-Desktop\ - :\Program Files (x86)\GnuPG\bin\ - :\Program Files (x86)\Gpg4win\bin\ condition: selection and not 1 of filter_main_* level: medium
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote 
Matching passage: CVE-2015-0218. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout.
Near-miss passage: CVE-2015-4242. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco FireSIGHT System Software 5.4.1.2 and 6.0.0 in FireSIGHT Management Center allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuu94721.
Query: Sigma rule for Detects suspicious PowerShell scripts accessing SAM hives
Matching passage: Sigma rule: Detects suspicious PowerShell scripts accessing SAM hives. Logsource: windows / process_creation. Rule: title: PowerShell SAM Copy id: 1af57a4b-460a-4738-9034-db68b880c665 status: test description: Detects suspicious PowerShell scripts accessing SAM hives references: - https://twitter.com/splinter_code/status/1420546784250769408 author: Florian Roth (Nextron Systems) date: 2021-07-29 modified: 2023-01-06 tags: - attack.credential-access - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains|all: - \HarddiskVolumeShadowCopy - System32\config\sam selection_2: CommandLine|contains: - Copy-Item - cp $_. - cpi $_. - copy $_. - .File]::Copy( condition: all of selection* falsepositives: - Some rare backup scenarios - PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs level: high
Near-miss passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / security. Rule: title: Remote Access Tool Services Have Been Installed - Security id: c8b00925-926c-47e3-beea-298fd563728e related: - id: 1a31b18a-f00c-4061-9900-f735b96c99fc type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 modified: 2024-12-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceName|contains: - AmmyyAdmin - AnyDesk - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - The rule doesn't look for anything suspicious so false positives are expected. If you use one of the tools mentioned, comment it out level: medium
Query: exploit Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
Matching passage: CVE-2015-4882. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect availability via vectors related to CORBA.
Near-miss passage: CVE-2015-3623. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in QlikTech Qlikview before 11.20 SR12 allows remote attackers to conduct server-side request forgery (SSRF) attacks and read arbitrary files via crafted XML data in a request to AccessPoint.aspx.
Query: exploit Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to 
Matching passage: CVE-2015-0327. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0323.
Near-miss passage: CVE-2015-5890. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5871, CVE-2015-5872, and CVE-2015-5873.
Query: vulnerability: The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Matching passage: CVE-2015-0844. CWE: CWE-200. CVSS: 5.0. The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: patch priority for CVE-2015-1309
Matching passage: CVE-2015-1309. CWE: UNKNOWN. CVSS: 5.0. XML external entity vulnerability in the Extended Computer Aided Test Tool (eCATT) in SAP NetWeaver AS ABAP 7.31 and earlier allows remote attackers to access arbitrary files via a crafted XML request, related to ECATT_DISPLAY_XMLSTRING_REMOTE, aka SAP Note 2016638.
Near-miss passage: CVE-2015-2612. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote attackers to affect confidentiality via vectors related to LDAP Security Adapter.
Query: detect Detects Obfuscated use of stdin to execute PowerShell in logs
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / security. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Security id: 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 related: - id: 72862bf2-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - cmd - powershell selection2: ServiceFileName|contains: - ${input} - noexit selection3: ServiceFileName|contains: - ' /c ' - ' /r ' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "DbgModel.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DbgModel.DLL id: fef394cd-f44d-4040-9b18-95d92fe278c0 status: test description: Detects potential DLL sideloading of "DbgModel.dll" references: - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html author: Gary Lobermier date: 2024-07-11 modified: 2024-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: ImageLoaded|endswith: \dbgmodel.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_windbg: ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_ filter_optional_windows_kits: ImageLoaded|startswith: - C:\Program Files (x86)\Windows Kits\ - C:\Program Files\Windows Kits\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Query: CVE similar to CVE-2015-0985
Matching passage: CVE-2015-0985. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that modify the default user's password via a GET request.
Near-miss passage: CVE-2015-3624. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx in Ektron Content Management System (CMS) before 9.10 SP1 (Build 9.1.0.184.1.120) allows remote attackers to hijack the authentication of content administrators for requests that delete content via a delete action.
Query: describe CVE-2015-1327
Matching passage: CVE-2015-1327. CWE: CWE-264. CVSS: 7.800000190734863. Content Hub before version 0.0+15.04.20150331-0ubuntu1.0 DBUS API only requires a file path for a content item, it doesn't actually require the confined app have access to the file to create a transfer. This could allow a malicious application using the DBUS API to export file:///etc/passwd which would then send a copy of that file to another app.
Near-miss passage: CVE-2015-6779. CWE: CWE-264. CVSS: 4.300000190734863. PDFium, as used in Google Chrome before 47.0.2526.73, does not properly restrict use of chrome: URLs, which allows remote attackers to bypass intended scheme restrictions via a crafted PDF document, as demonstrated by a document with a link to a chrome://settings URL.
Query: containment actions for Lateral movement indicators for Hidden Users
Matching passage: Playbook for T1564.002 Hidden Users. 1) Validate alert telemetry against T1564.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user
Near-miss passage: Playbook for T1564.003 Hidden Window. Different response path focused on stealth.
Query: exploit daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or poss
Matching passage: CVE-2015-3147. CWE: CWE-59. CVSS: 6.5. daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or possibly have other unspecified impact via a symlink attack on (1) /var/spool/abrt or (2) /var/tmp/abrt.
Near-miss passage: CVE-2015-1335. CWE: CWE-59. CVSS: 7.199999809265137. lxc-start in lxc before 1.0.8 and 1.1.x before 1.1.4 allows local container administrators to escape AppArmor confinement via a symlink attack on a (1) mount target or (2) bind mount source.
Query: indicators of Bootkit
Matching passage: T1542.003 Bootkit. Tactics: stealth, persistence. Description: Adversaries may use bootkits to persist on systems. A bootkit is a malware variant that modifies the boot sectors of a hard drive, allowing malicious code to execute before a computer's operating system has loaded. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. In BIOS systems, a bootkit may modify the Master Boot Record (MBR) and/or Volume Boot Record (VBR).(Citation: Mandiant M Trends 2016) The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.(Citation: Lau 2011) The MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code. In UEFI (Unified Extensible Firmware Interface) systems, a bootkit may instead create or modify files in the EFI system partition (ESP). The ESP is a partition on data storage used by devices containing UEFI that allows the system to boot the OS and other utilities used by the system. An adversary can use the newly created or patched files in the ESP to run malicious kernel code.(Citation: Microsoft Security)(Citation: welivesecurity)
Near-miss passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Query: patch priority for CVE-2015-7639
Matching passage: CVE-2015-7639. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7636, CVE-2015-7637, CVE-2015-7638, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-0350. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: vulnerability: Unspecified vulnerability in (1) the Oracle Communications Diameter Signaling Router (DSR) component in Oracle Communications Applications 4.1.6 and earlier, 5.1.0 and earlier, 6.0
Matching passage: CVE-2015-2608. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in (1) the Oracle Communications Diameter Signaling Router (DSR) component in Oracle Communications Applications 4.1.6 and earlier, 5.1.0 and earlier, 6.0.2 and earlier, and 7.1.0 and earlier; (2) the Oracle Communications Performance Intelligence Center Software component in Oracle Communications Applications 9.0.3 and earlier and 10.1.5 and earlier; (3) the Oracle Communications Policy Management component in Oracle Communications Applications 9.9.0 and earlier, 10.5.0 and earlier, 11.5.0 and earlier, and 12.1.0 and earlier; and (4) the Oracle Communications Tekelec HLR Router component in Oracle Communications Applications 4.0.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to PMAC.
Near-miss passage: CVE-2015-4429. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2015-3126.
Query: describe CVE-2015-2000
Matching passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2003. CWE: CWE-118. CVSS: 9.800000190734863. The PJSIP PJSUA2 SDK before SVN Changeset 51322 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.