alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to 
Matching passage: CVE-2015-4893. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60; Java SE Embedded 8u51; and JRockit R28.3.7 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2015-4803 and CVE-2015-4911.
Near-miss passage: CVE-2015-4754. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: weakness Windows Hard Link
Matching passage: CWE-65 Windows Hard Link. The product, when opening a file or directory, does not sufficiently handle when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Near-miss passage: CWE-145 Improper Neutralization of Section Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as section delimiters when they are sent to a downstream component.
Query: risk of The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake stat
Matching passage: CVE-2015-2318. CWE: CWE-295. CVSS: 8.100000381469727. The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
Near-miss passage: CVE-2015-4094. CWE: CWE-295. CVSS: 5.800000190734863. The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Query: risk of Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting 
Matching passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Near-miss passage: CVE-2015-3964. CWE: UNKNOWN. CVSS: 10.0. SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Query: vulnerability: RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Matching passage: CVE-2015-0260. CWE: CWE-200. CVSS: 4.0. RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Near-miss passage: CVE-2015-7934. CWE: CWE-200. CVSS: 8.600000381469727. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Query: exploit Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2
Matching passage: CVE-2015-1495. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in Motorola Scanner SDK allow remote attackers to execute arbitrary code via a crafted string to the Open method in (1) IOPOSScanner.ocx or (2) IOPOSScale.ocx.
Near-miss passage: CVE-2015-3713. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime in Apple OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted movie file.
Query: persistence using Logon Script (Windows)
Matching passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Near-miss passage: T1037 Boot or Logon Initialization Scripts. Tactics: persistence, privilege escalation. Description: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.(Citation: Mandiant APT29 Eye Spy Email Nov 22)(Citation: Anomali Rocke March 2019) Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server. These scripts can vary based on operating system and whether applied locally or remotely. Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary. An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.
Query: Sigma YAML for windows / ps_classic_start
Matching passage: Sigma rule: Detects remote PowerShell sessions. Logsource: windows / ps_classic_start. Rule: title: Remote PowerShell Session (PS Classic) id: 60167e5c-84b2-4c95-a7ac-86281f27c445 related: - id: 96b9f619-aa91-478f-bacb-c3e50f8df575 type: derived status: test description: Detects remote PowerShell sessions references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-10 modified: 2024-01-03 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_classic_start detection: selection: Data|contains|all: - HostName=ServerRemoteHost - wsmprovhost.exe condition: selection falsepositives: - Legitimate use remote PowerShell sessions level: low
Near-miss passage: Sigma rule: Detects when an Okta end-user reports activity by their account as being potentially suspicious.. Logsource: okta / okta. Rule: title: Okta Suspicious Activity Reported by End-user id: 07e97cc6-aed1-43ae-9081-b3470d2367f1 status: test description: Detects when an Okta end-user reports activity by their account as being potentially suspicious. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.resource-development - attack.t1586.003 logsource: product: okta service: okta detection: selection: eventType: user.account.report_suspicious_activity_by_enduser condition: selection falsepositives: - If an end-user incorrectly identifies normal activity as suspicious. level: high
Query: describe CVE-2015-6051
Matching passage: CVE-2015-6051. CWE: UNKNOWN. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-6719. CWE: UNKNOWN. CVSS: 6.800000190734863. The CBSharedReviewCloseDialog method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: CVE similar to CVE-2015-0844
Matching passage: CVE-2015-0844. CWE: CWE-200. CVSS: 5.0. The WML/Lua API in Battle for Wesnoth 1.7.x through 1.11.x and 1.12.x before 1.12.2 allows remote attackers to read arbitrary files via a crafted (1) campaign or (2) map file.
Near-miss passage: CVE-2015-3690. CWE: CWE-200. CVSS: 4.300000190734863. The DiskImages subsystem in Apple iOS before 8.4 and OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Query: explain CWE-166
Matching passage: CWE-166 Improper Handling of Missing Special Element. The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.
Near-miss passage: CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug. Access to security-sensitive information stored in fuses is not limited during debug.
Query: exploit Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute 
Matching passage: CVE-2015-7504. CWE: CWE-787. CVSS: 8.800000190734863. Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
Near-miss passage: CVE-2015-5628. CWE: CWE-787. CVSS: 9.800000190734863. Stack-based buffer overflow in Yokogawa CENTUM CS 1000 R3.08.70 and earlier, CENTUM CS 3000 R3.09.50 and earlier, CENTUM CS 3000 Entry R3.09.50 and earlier, CENTUM VP R5.04.20 and earlier, CENTUM VP Entry R5.04.20 and earlier, ProSafe-RS R3.02.10 and earlier, Exaopc R3.72.00 and earlier, Exaquantum R2.85.00 and earlier, Exaquantum/Batch R2.50.30 and earlier, Exapilot R3.96.10 and earlier, Exaplog R3.40.00 and earlier, Exasmoc R4.03.20 and earlier, Exarqe R4.03.20 and earlier, Field Wireless Device OPC Server R2.01.02 and earlier, PRM R3.12.00 and earlier, STARDOM VDS R7.30.01 and earlier, STARDOM OPC Server for Windows R3.40 and earlier, FAST/TOOLS R10.01 and earlier, B/M9000CS R5.05.01 and earlier, B/M9000 VP R7.03.04 and earlier, and FieldMate R1.01 or R1.02 allows remote attackers to execute arbitrary code via a crafted packet.
Query: detection rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order
Matching passage: Sigma rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order. Logsource: windows / registry_set. Rule: title: Hypervisor Enforced Paging Translation Disabled id: 7f2954d2-99c2-4d42-a065-ca36740f187b status: test description: 'Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature. ' references: - https://twitter.com/standa_t/status/1808868985678803222 - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Query: describe CVE-2015-9254
Matching passage: CVE-2015-9254. CWE: CWE-798. CVSS: 9.800000190734863. Datto ALTO and SIRIS devices have a default VNC password.
Near-miss passage: CVE-2015-2885. CWE: CWE-798. CVSS: 9.800000190734863. Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the backdoor user account, and a password of guest for the backdoor guest account.
Query: exploit In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length
Matching passage: CVE-2015-9051. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.
Near-miss passage: CVE-2015-3830. CWE: CWE-20. CVSS: 6.5. The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to trick a victim by displaying a malicious page for legitimate domain names.
Query: Sigma rule for Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Matching passage: Sigma rule: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility. Logsource: windows / process_creation. Rule: title: Suspicious Reg Add BitLocker id: 0e0255bf-2548-47b8-9582-c0955c9283f5 status: test description: Detects suspicious addition to BitLocker related registry keys via the reg.exe utility references: - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/ author: frack113 date: 2021-11-15 modified: 2022-09-09 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - REG - ADD - \SOFTWARE\Policies\Microsoft\FVE - /v - /f CommandLine|contains: - EnableBDEWithNoTPM - UseAdvancedStartup - UseTPM - UseTPMKey - UseTPMKeyPIN - RecoveryKeyMessageSource - UseTPMPIN - RecoveryKeyMessage condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloa. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation with Curl and PowerShell Execution Combo id: 1d174d38-8fda-4081-a9b6-56d9763c0cd8 status: experimental description: 'Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them. This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host. ' references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_curl: CommandLine|contains|all: - 'curl ' - http - -o selection_powershell: CommandLine|contains: powershell condition: all of selection_* falsepositives: - Legitimate use of schtasks for administrative purposes. - Automation scripts combining curl and PowerShell in controlled environments. level: medium
Query: incident response steps for Suspicious Local Data Staging execution detected on endpoint
Matching passage: Playbook for T1074.001 Local Data Staging. 1) Validate alert telemetry against T1074.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash
Near-miss passage: Playbook for T1074.002 Remote Data Staging. Different response path focused on collection.
Query: CVE similar to CVE-2015-4066
Matching passage: CVE-2015-4066. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4342. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Query: detection rule: Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via differe
Matching passage: Sigma rule: Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via differe. Logsource: windows / process_creation. Rule: title: Mshtml.DLL RunHTMLApplication Suspicious Usage id: 4782eb5a-a513-4523-a0ac-f3082b26ac5c related: - id: 9f06447a-a33a-4cbe-a94f-a3f43184a7a3 type: obsolete - id: 73fcad2e-ff14-4c38-b11d-4172c8ac86c7 type: obsolete status: test description: 'Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...) ' references: - https://twitter.com/n1nj4sec/status/1421190238081277959 - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA) date: 2022-08-14 modified: 2024-02-23 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \..\ - mshtml CommandLine|contains: - '#135' - RunHTMLApplication condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when an end user consents to an application. Logsource: azure / auditlogs. Rule: title: End User Consent id: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a status: test description: Detects when an end user consents to an application references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: ConsentContext.IsAdminConsent: 'false' condition: selection falsepositives: - Unknown level: low
Query: secure coding against Mismatched Memory Management Routines
Matching passage: CWE-762 Mismatched Memory Management Routines. The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
Near-miss passage: CWE-108 Struts: Unvalidated Action Form. Every Action Form must have a corresponding validation form.
Query: describe CVE-2015-0858
Matching passage: CVE-2015-0858. CWE: CWE-59. CVSS: 3.299999952316284. Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Near-miss passage: CVE-2015-1338. CWE: CWE-59. CVSS: 7.199999809265137. kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Query: exploit Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter i
Matching passage: CVE-2015-4074. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Near-miss passage: CVE-2015-1198. CWE: CWE-22. CVSS: 7.5. Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.