alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to
Matching passage: CVE-2015-0456. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.8.0 allows remote attackers to affect integrity via unknown vectors related to Portlet Services.
Near-miss passage: CVE-2015-4876. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote authenticated users to affect integrity via unknown vectors related to Pivot Grid.
Query: describe CVE-2015-9440
Matching passage: CVE-2015-9440. CWE: CWE-352. CVSS: 6.5. The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new.
Near-miss passage: CVE-2015-6378. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Cisco DPQ3925 devices with EDVA 5.5.2 allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuv05943.
Query: patch priority for CVE-2015-0925
Matching passage: CVE-2015-0925. CWE: CWE-94. CVSS: 9.0. The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Near-miss passage: CVE-2015-0898. CWE: CWE-94. CVSS: 7.5. futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Query: risk of Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
Matching passage: CVE-2015-4682. CWE: CWE-200. CVSS: 6.5. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows remote authenticated users to obtain the installation path via an HTTP POST request to PlcmRmWeb/JConfigManager.
Near-miss passage: CVE-2015-6747. CWE: CWE-200. CVSS: 5.0. Basware Banking (Maksuliikenne) 8.90.07.X does not properly prevent access to private keys, which allows remote attackers to spoof communications with banks via unspecified vectors. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 due to different vulnerability types. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6746.
Query: risk of IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that lev
Matching passage: CVE-2015-1061. CWE: CWE-94. CVSS: 9.300000190734863. IOSurface in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages "type confusion" during serialized-object handling.
Near-miss passage: CVE-2015-9272. CWE: CWE-94. CVSS: 9.800000190734863. The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
Query: describe CVE-2015-5261
Matching passage: CVE-2015-5261. CWE: CWE-119. CVSS: 7.099999904632568. Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation.
Near-miss passage: CVE-2015-2401. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1767 and CVE-2015-2408.
Query: describe CVE-2015-9073
Matching passage: CVE-2015-9073. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.
Near-miss passage: CVE-2015-9020. CWE: CWE-476. CVSS: 7.800000190734863. In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory.
Query: CVE similar to CVE-2015-1560
Matching passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Near-miss passage: CVE-2015-10050. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in brandonfire miRNA_Database_by_PHP_MySql. It has been declared as critical. This vulnerability affects the function __construct/select_single_rna/count_rna of the file inc/model.php. The manipulation leads to sql injection. The patch is identified as 307c5d510841e6142ddcbbdbb93d0e8a0dc3fd6a. It is recommended to apply a patch to fix this issue. VDB-218374 is the identifier assigned to this vulnerability.
Query: risk of Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Ex
Matching passage: CVE-2015-1667. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0887. CWE: CWE-399. CVSS: 7.099999904632568. npppd in the PPP Access Concentrator (PPPAC) on SEIL SEIL/x86 Fuji routers 1.00 through 3.30, SEIL/X1 routers 3.50 through 4.70, SEIL/X2 routers 3.50 through 4.70, and SEIL/B1 routers 3.50 through 4.70 allows remote attackers to cause a denial of service (infinite loop and device hang) via a crafted SSTP packet.
Query: describe CVE-2015-2239
Matching passage: CVE-2015-2239. CWE: CWE-19. CVSS: 4.300000190734863. Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine, a different vulnerability than CVE-2015-1231.
Near-miss passage: CVE-2015-0560. CWE: CWE-19. CVSS: 5.0. The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Query: detect Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or A in logs
Matching passage: Sigma rule: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or A. Logsource: azure / auditlogs. Rule: title: App Granted Microsoft Permissions id: c1d147ae-a951-48e5-8b41-dcd0170c7213 status: test description: Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-10 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add delegated permission grant - Add app role assignment to service principal condition: selection falsepositives: - When the permission is legitimately needed for the app level: high
Near-miss passage: Sigma rule: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory. Logsource: windows / ps_script. Rule: title: Active Directory Group Enumeration With Get-AdGroup id: 8c3a6607-b7dc-4f0d-a646-ef38c00b76ee status: test description: Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: frack113 date: 2022-03-17 modified: 2022-11-17 tags: - attack.discovery - attack.t1069.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-AdGroup ' - -Filter condition: selection falsepositives: - Unknown level: low
Query: write Sigma for Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a
Matching passage: Sigma rule: Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of a. Logsource: windows / process_creation. Rule: title: WMI Persistence - Script Event Consumer id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e status: test description: 'Detects the execution of a script event consumer. When scrcons.exe launches, it does so in response to the creation of an ActiveScriptEventConsumer instance and will execute registered JScript or VBScript code as a result. Script event consumers are a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse script event consumers to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://redcanary.com/blog/threat-detection/child-processes/ - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2022-10-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: Image: C:\WINDOWS\system32\wbem\scrcons.exe ParentImage: C:\Windows\System32\svchost.exe condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium
Near-miss passage: Sigma rule: Identifies when a privilege role can be activated without performing mfa.. Logsource: azure / pim. Rule: title: Roles Activation Doesn't Require MFA id: 94a66f46-5b64-46ce-80b2-75dcbe627cc0 status: test description: Identifies when a privilege role can be activated without performing mfa. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: noMfaOnRoleActivationAlertIncident condition: selection falsepositives: - Investigate if user is performing MFA at sign-in. level: high
Query: threat report mentioning Selective Exclusion
Matching passage: T1679 Selective Exclusion. Tactics: stealth. Description: Adversaries may intentionally exclude certain files, folders, directories, file types, or system components from encryption or tampering during a ransomware or malicious payload execution. Some file extensions that adversaries may avoid encrypting include `.dll`, `.exe`, and `.lnk`.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024) Adversaries may perform this behavior to avoid alerting users, to evade detection by security tools and analysts, or, in the case of ransomware, to ensure that the system remains operational enough to deliver the ransom notice. Exclusions may target files and components whose corruption would cause instability, break core services, or immediately expose the attack. By carefully avoiding these areas, adversaries maintain system responsiveness while minimizing indicators that could trigger alarms or otherwise inhibit achieving their goals.
Near-miss passage: T1205.002 Socket Filters. Tactics: stealth, persistence, command and control. Description: Adversaries may attach filters to a network socket to monitor then activate backdoors used for persistence or command and control. With elevated permissions, adversaries can use features such as the `libpcap` library to open sockets and install filters to allow or disallow certain types of data to come through the socket. The filter may apply to all traffic passing through the specified network interface (or every interface if not specified). When the network interface receives a packet matching the filter criteria, additional actions can be triggered on the host, such as activation of a reverse shell. To establish a connection, an adversary sends a crafted packet to the targeted host that matches the installed filter criteria.(Citation: haking9 libpcap network sniffing) Adversaries have used these socket filters to trigger the installation of implants, conduct ping backs, and to invoke command shells. Communication with these socket filters may also be used in conjunction with [Protocol Tunneling](https://attack.mitre.org/techniques/T1572).(Citation: exatrack bpf filters passive backdoors)(Citation: Leonardo Turla Penquin May 2020) Filters can be installed on any Unix-like platform with `libpcap` installed or on Windows hosts using `Winpcap`. Adversaries may use either `libpcap` with `pcap_setfilter` or the standard library function `setsockopt` with `SO_ATTACH_FILTER` options. Since the socket connection is not active until the packet is received, this behavior may be difficult to detect due to the lack of activity on a host, low CPU overhead, and limited visibility into raw socket usage.
Query: patch priority for CVE-2015-1264
Matching passage: CVE-2015-1264. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Google Chrome before 43.0.2357.65 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted data that is improperly handled by the Bookmarks feature.
Near-miss passage: CVE-2015-4337. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Query: Sigma rule for Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm
Matching passage: Sigma rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm. Logsource: windows / ps_script. Rule: title: Access to Browser Login Data id: fc028194-969d-4122-8abe-0470d5b8f12f related: - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d type: obsolete - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b type: similar status: test description: 'Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-01-30 tags: - attack.credential-access - attack.t1555.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Copy-Item - -Destination selection_path: ScriptBlockText|contains: - \Opera Software\Opera Stable\Login Data - \Mozilla\Firefox\Profiles - \Microsoft\Edge\User Data\Default - \Google\Chrome\User Data\Default\Login Data - \Google\Chrome\User Data\Default\Login Data For Account condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect changes of syslog daemons configuration files. Logsource: linux / auditd. Rule: title: Logging Configuration Changes on Linux Host id: c830f15d-6f6e-430f-8074-6f73d6807841 status: test description: Detect changes of syslog daemons configuration files references: - self experience author: Mikhail Larin, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/syslog.conf - /etc/rsyslog.conf - /etc/syslog-ng/syslog-ng.conf condition: selection falsepositives: - Legitimate administrative activity level: high
Query: risk of Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute a
Matching passage: CVE-2015-7860. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the agent in Persistent Accelerite Radia Client Automation (formerly HP Client Automation), possibly before 9.1, allows remote attackers to execute arbitrary code by sending a large amount of data in an environment that lacks relationship-based firewalling.
Near-miss passage: CVE-2015-3665. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3664 and CVE-2015-3669.
Query: Multiple failed authentications followed by Netsh Helper DLL
Matching passage: T1546.007 Netsh Helper DLL. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>. Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Near-miss passage: T1546.017 Udev Rules. Tactics: persistence, privilege escalation. Description: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024) Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as `/dev/random`, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key `RUN+=` to detach and run the malicious content’s process in the background to bypass these controls.(Citation: Reichert aon sedexp 2024)
Query: CVE similar to CVE-2015-8709
Matching passage: CVE-2015-8709. CWE: CWE-264. CVSS: 7.0. kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here.
Near-miss passage: CVE-2015-0142. CWE: CWE-264. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to cause a denial of service (maintenance-mode transition and data-storage outage) by calling the System Administration Mode function.
Query: weakness Excessive Platform Resource Consumption within a Loop
Matching passage: CWE-1050 Excessive Platform Resource Consumption within a Loop. The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors.
Near-miss passage: CWE-1025 Comparison Using Wrong Factors. The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
Query: CVE similar to CVE-2015-8956
Matching passage: CVE-2015-8956. CWE: CWE-476. CVSS: 6.099999904632568. The rfcomm_sock_bind function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 4.2 allows local users to obtain sensitive information or cause a denial of service (NULL pointer dereference) via vectors involving a bind system call on a Bluetooth RFCOMM socket.
Near-miss passage: CVE-2015-8916. CWE: CWE-476. CVSS: 6.5. bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," which allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted rar file.
Query: incident response steps for Multiple failed authentications followed by LNK Icon Smuggling
Matching passage: Playbook for T1027.012 LNK Icon Smuggling. 1) Validate alert telemetry against T1027.012. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host di
Near-miss passage: Playbook for T1027.018 Invisible Unicode. Different response path focused on stealth.