alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi
Matching passage: Sigma rule: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi. Logsource: windows / registry_event. Rule: title: HybridConnectionManager Service Installation - Registry id: ac8866c7-ce44-46fd-8c17-b24acff96ca8 status: test description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-11-27 tags: - attack.resource-development - attack.t1608 logsource: category: registry_event product: windows detection: selection1: TargetObject|contains: \Services\HybridConnectionManager selection2: EventType: SetValue Details|contains: Microsoft.HybridConnectionManager.Listener.exe condition: selection1 or selection2 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get acces. Logsource: windows / ps_module. Rule: title: Suspicious Get-ADDBAccount Usage id: b140afd9-474b-4072-958e-2ebb435abd68 status: test description: Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers references: - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md author: Florian Roth (Nextron Systems) date: 2022-03-16 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: Payload|contains|all: - Get-ADDBAccount - 'BootKey ' - 'DatabasePath ' condition: selection falsepositives: - Unknown level: high
Query: risk of The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, o
Matching passage: CVE-2015-6237. CWE: CWE-287. CVSS: 9.800000190734863. The RPC service in Tripwire (formerly nCircle) IP360 VnE Manager 7.2.2 before 7.2.6 allows remote attackers to bypass authentication and (1) enumerate users, (2) reset passwords, or (3) manipulate IP filter restrictions via crafted "privileged commands."
Near-miss passage: CVE-2015-3442. CWE: CWE-287. CVSS: 9.800000190734863. Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.
Query: exploit Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-0355. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-8642. CWE: UNKNOWN. CVSS: 8.800000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
Query: exploit Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS be
Matching passage: CVE-2015-5962. CWE: CWE-189. CVSS: 5.0. Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter.
Near-miss passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Query: detect Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malici in logs
Matching passage: Sigma rule: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malici. Logsource: windows / ps_script. Rule: title: Powershell Create Scheduled Task id: 363eccc0-279a-4ccf-a3ab-24c2e63b11fb status: test description: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task author: frack113 date: 2021-12-28 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: - New-ScheduledTaskAction - New-ScheduledTaskTrigger - New-ScheduledTaskPrincipal - New-ScheduledTaskSettingsSet - New-ScheduledTask - Register-ScheduledTask selection_cimmethod: ScriptBlockText|contains|all: - Invoke-CimMethod - -ClassName - PS_ScheduledTask - -NameSpace - Root\Microsoft\Windows\TaskScheduler filter_main_legitimate_scripts: ScriptBlockText|contains|all: - Microsoft.PowerShell.Core\Export-ModuleMember - Microsoft.Management.Infrastructure.CimInstance - __cmdletization_methodParameter condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'r. Logsource: windows / process_creation. Rule: title: Potential Renamed Rundll32 Execution id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed related: - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e type: derived status: test description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection references: - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20 - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2023-02-03 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: DllRegisterServer filter: Image|endswith: \rundll32.exe condition: selection and not filter falsepositives: - Unlikely level: high
Query: CWE for Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
Matching passage: CWE-1045 Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor. A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
Near-miss passage: CWE-824 Access of Uninitialized Pointer. The product accesses or uses a pointer that has not been initialized.
Query: describe CVE-2015-6731
Matching passage: CVE-2015-6731. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.
Near-miss passage: CVE-2015-7415. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in IBM UrbanCode Deploy 6.0 before 6.0.1.12, 6.1 before 6.1.3.2, and 6.2 before 6.2.0.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: SOC runbook when seeing Persistence mechanism resembling Odbcconf
Matching passage: Playbook for T1218.008 Odbcconf. 1) Validate alert telemetry against T1218.008. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for
Near-miss passage: Playbook for T1218.009 Regsvcs/Regasm. Different response path focused on stealth.
Query: CVE similar to CVE-2015-3864
Matching passage: CVE-2015-3864. CWE: CWE-189. CVSS: 10.0. Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Near-miss passage: CVE-2015-5560. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-2667
Matching passage: CVE-2015-2667. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified directory.
Near-miss passage: CVE-2015-5551. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Query: exploit The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary comman
Matching passage: CVE-2015-2285. CWE: CWE-19. CVSS: 7.199999809265137. The logrotation script (/etc/cron.daily/upstart) in the Ubuntu Upstart package before 1.13.2-0ubuntu9, as used in Ubuntu Vivid 15.04, allows local users to execute arbitrary commands and gain privileges via a crafted file in /run/user/*/upstart/sessions/.
Near-miss passage: CVE-2015-0695. CWE: CWE-19. CVSS: 7.800000190734863. Cisco IOS XR 4.3.4 through 5.3.0 on ASR 9000 devices, when uRPF, PBR, QoS, or an ACL is configured, does not properly handle bridge-group virtual interface (BVI) traffic, which allows remote attackers to cause a denial of service (chip and card hangs and reloads) by triggering use of a BVI interface for IPv4 packets, aka Bug ID CSCur62957.
Query: describe CVE-2015-0641
Matching passage: CVE-2015-0641. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IOS XE 2.x and 3.x before 3.9.0S, 3.10 before 3.10.0S, 3.11 before 3.11.0S, 3.12 before 3.12.0S, 3.13 before 3.13.0S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via crafted IPv6 packets, aka Bug ID CSCub68073.
Near-miss passage: CVE-2015-6934. CWE: CWE-20. CVSS: 7.300000190734863. Serialized-object interfaces in VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations 5.x, and vCenter Application Discovery Manager (vADM) 7.x allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
Query: exploit kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Matching passage: CVE-2015-7052. CWE: CWE-264. CVSS: 7.199999809265137. kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Near-miss passage: CVE-2015-7792. CWE: CWE-264. CVSS: 9.800000190734863. Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors.
Query: describe CVE-2015-7709
Matching passage: CVE-2015-7709. CWE: CWE-264. CVSS: 10.0. The arkeiad daemon in the Arkeia Backup Agent in Western Digital Arkeia 11.0.12 and earlier allows remote attackers to bypass authentication and execute arbitrary commands via a series of crafted requests involving the ARKFS_EXEC_CMD operation.
Near-miss passage: CVE-2015-0662. CWE: CWE-264. CVSS: 7.199999809265137. Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation, aka Bug ID CSCus79385.
Query: vulnerability: Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptor
Matching passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Near-miss passage: CVE-2015-0814. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: vulnerability: The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JS
Matching passage: CVE-2015-7818. CWE: CWE-264. CVSS: 7.199999809265137. The administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows local users to execute arbitrary JSP code with SYSTEM privileges by using the Apache Axis AdminService deployment method to install a .jsp file.
Near-miss passage: CVE-2015-6755. CWE: CWE-264. CVSS: 7.5. The ContainerNode::parserInsertBefore function in core/dom/ContainerNode.cpp in Blink, as used in Google Chrome before 46.0.2490.71, proceeds with a DOM tree insertion in certain cases where a parent node no longer contains a child node, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
Query: SOC runbook when seeing Outbound C2 pattern associated with Visual Basic
Matching passage: Playbook for T1059.005 Visual Basic. 1) Validate alert telemetry against T1059.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integr
Near-miss passage: Playbook for T1059.010 AutoHotKey & AutoIT. Different response path focused on execution.
Query: CVE similar to CVE-2015-5130
Matching passage: CVE-2015-5130. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-4849. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/IspPunchInServlet.
Query: rule covering Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading
Matching passage: Sigma rule: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Masquerading as System Processes id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab status: experimental description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1036.004 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains|windash: ' /create ' CommandLine|contains: - ' audiodg' - ' conhost' - ' dwm.exe' - ' explorer' - ' lsass' - ' lsm' - ' mmc' - ' msiexec' - ' regsvr32' - ' rundll32' - ' services' - ' spoolsv' - ' svchost' - ' taskeng' - ' taskhost' - ' wininit' - ' winlogon' condition: all of selection_* falsepositives: - Legitimate system administration tasks scheduling trusted system processes. level: high
Near-miss passage: Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Query: patch priority for CVE-2015-7629
Matching passage: CVE-2015-7629. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via a TextFormat object with a crafted tabStops property, a different vulnerability than CVE-2015-7631, CVE-2015-7643, and CVE-2015-7644.
Near-miss passage: CVE-2015-5461. CWE: UNKNOWN. CVSS: 6.400000095367432. Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-8043. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-6715. CWE: UNKNOWN. CVSS: 6.800000190734863. The Function apply implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.