alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: common weakness: Exposure of Backup File to an Unauthorized Control Sphere
Matching passage: CWE-530 Exposure of Backup File to an Unauthorized Control Sphere. A backup file is stored in a directory or archive that is made accessible to unauthorized actors.
Near-miss passage: CWE-422 Unprotected Windows Messaging Channel ('Shatter'). The product does not properly verify the source of a message in the Windows Messaging System while running at elevated privileges, creating an alternate channel through which an attacker can directly send a message to the product.
Query: risk of XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory 
Matching passage: CVE-2015-7461. CWE: CWE-399. CVSS: 6.5. XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory consumption) via crafted XML data. IBM X-Force ID: 108357.
Near-miss passage: CVE-2015-0045. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0053.
Query: weakness Use of Platform-Dependent Third Party Components
Matching passage: CWE-1103 Use of Platform-Dependent Third Party Components. The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
Near-miss passage: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
Query: Persistence mechanism resembling Resource Forking
Matching passage: T1564.009 Resource Forking. Tactics: stealth. Description: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.(Citation: macOS Hierarchical File System Overview) Usage of a resource fork is identifiable when displaying a file’s extended attributes, using <code>ls -l@</code> or <code>xattr -l</code> commands. Resource forks have been deprecated and replaced with the application bundle structure. Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the <code>/Resources</code> folder.(Citation: Resource and Data Forks)(Citation: ELC Extended Attributes) Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files. Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked. Resource fork content may also be obfuscated/encrypted until execution.(Citation: sentinellabs resource named fork 2020)(Citation: tau bundlore erika noerenberg 2020)
Near-miss passage: T1564.012 File/Path Exclusions. Tactics: stealth. Description: Adversaries may attempt to hide their file-based artifacts by writing them to specific folders or file names excluded from antivirus (AV) scanning and other defensive capabilities. AV and other file-based scanners often include exclusions to optimize performance as well as ease installation and legitimate use of applications. These exclusions may be contextual (e.g., scans are only initiated in response to specific triggering events/alerts), but are also often hardcoded strings referencing specific folders and/or files assumed to be trusted and legitimate.(Citation: Microsoft File Folder Exclusions) Adversaries may abuse these exclusions to hide their file-based artifacts. For example, rather than tampering with tool settings to add a new exclusion (i.e., [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685)), adversaries may drop their file-based payloads in default or otherwise well-known exclusions. Adversaries may also use [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001) and other [Discovery](https://attack.mitre.org/tactics/TA0007)/[Reconnaissance](https://attack.mitre.org/tactics/TA0043) activities to both discover and verify existing exclusions in a victim environment.
Query: CWE for Path Equivalence: 'filedir' (Trailing Backslash)
Matching passage: CWE-54 Path Equivalence: 'filedir' (Trailing Backslash). The product accepts path input in the form of trailing backslash ('filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-11 ASP.NET Misconfiguration: Creating Debug Binary. Debugging messages help attackers learn about the system and plan a form of attack.
Query: patch priority for CVE-2015-4959
Matching passage: CVE-2015-4959. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP16 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-7536. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Query: describe CVE-2015-2775
Matching passage: CVE-2015-2775. CWE: CWE-22. CVSS: 7.599999904632568. Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.
Near-miss passage: CVE-2015-7237. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
Query: common weakness: Improperly Controlled Sequential Memory Allocation
Matching passage: CWE-1325 Improperly Controlled Sequential Memory Allocation. The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
Near-miss passage: CWE-204 Observable Response Discrepancy. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.
Query: CVE similar to CVE-2015-5645
Matching passage: CVE-2015-5645. CWE: CWE-264. CVSS: 6.5. ICZ MATCHA SNS before 1.3.7 allows remote authenticated users to obtain administrative privileges via unspecified vectors.
Near-miss passage: CVE-2015-2830. CWE: CWE-264. CVSS: 1.899999976158142. arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.
Query: CVE similar to CVE-2015-0252
Matching passage: CVE-2015-0252. CWE: CWE-20. CVSS: 5.0. internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a denial of service (segmentation fault and crash) via crafted XML data.
Near-miss passage: CVE-2015-8705. CWE: CWE-20. CVSS: 7.0. buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit, or daemon crash) or possibly have unspecified other impact via (1) OPT data or (2) an ECS option.
Query: describe CVE-2015-8726
Matching passage: CVE-2015-8726. CWE: CWE-20. CVSS: 5.5. wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Near-miss passage: CVE-2015-6403. CWE: CWE-20. CVSS: 7.199999809265137. The TFTP implementation on Cisco Small Business SPA30x, SPA50x, SPA51x phones 7.5.7 improperly validates firmware-image file integrity, which allows local users to load a Trojan horse image by leveraging shell access, aka Bug ID CSCut67400.
Query: rule covering Detects activity as "net user administrator /domain" and "net group domain admins /domain"
Matching passage: Sigma rule: Detects activity as "net user administrator /domain" and "net group domain admins /domain". Logsource: windows / security. Rule: title: Reconnaissance Activity id: 968eef52-9cff-4454-8992-1e74b9cbad6c status: test description: Detects activity as "net user administrator /domain" and "net group domain admins /domain" references: - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community date: 2017-03-07 modified: 2022-08-22 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.s0039 logsource: product: windows service: security definition: The volume of Event ID 4661 is high on Domain Controllers and therefore "Audit SAM" and "Audit Kernel Object" advanced audit policy settings are not configured in the recommendations for server systems detection: selection: EventID: 4661 AccessMask: '0x2d' ObjectType: - SAM_USER - SAM_GROUP ObjectName|startswith: S-1-5-21- ObjectName|endswith: - '-500' - '-512' condition: selection falsepositives: - Administrator activity level: high
Near-miss passage: Sigma rule: Show when a monitor or a span/rspan is setup or modified. Logsource: cisco / aaa. Rule: title: Cisco Sniffing id: b9e1f193-d236-4451-aaae-2f3d2102120d status: test description: Show when a monitor or a span/rspan is setup or modified author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: cisco service: aaa detection: keywords: - monitor capture point - set span - set rspan condition: keywords falsepositives: - Admins may setup new or modify old spans, or use a monitor for troubleshooting level: medium
Query: write Sigma for Detects AWS root account usage
Matching passage: Sigma rule: Detects AWS root account usage. Logsource: aws / cloudtrail. Rule: title: AWS Root Credentials id: 8ad1600d-e9dc-4251-b0ee-a65268f29add status: test description: Detects AWS root account usage references: - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection_usertype: userIdentity.type: Root selection_eventtype: eventType: AwsServiceEvent condition: selection_usertype and not selection_eventtype falsepositives: - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html level: medium
Near-miss passage: Sigma rule: Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to usin. Logsource: windows / process_creation. Rule: title: Potential Network Sniffing Activity Using Network Tools id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5 status: test description: 'Detects potential network sniffing via use of network tools such as "tshark", "windump". Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-21 modified: 2023-02-20 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: category: process_creation product: windows detection: selection_tshark: Image|endswith: \tshark.exe CommandLine|contains: -i selection_windump: Image|endswith: \windump.exe condition: 1 of selection_* falsepositives: - Legitimate administration activity to troubleshoot network issues level: medium
Query: risk of strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
Matching passage: CVE-2015-3991. CWE: CWE-19. CVSS: 9.800000190734863. strongSwan 5.2.2 and 5.3.0 allows remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.
Near-miss passage: CVE-2015-0819. CWE: CWE-19. CVSS: 4.300000190734863. The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
Query: rule covering Detects the enumeration of other remote systems.
Matching passage: Sigma rule: Detects the enumeration of other remote systems.. Logsource: macos / process_creation. Rule: title: Macos Remote System Discovery id: 10227522-8429-47e6-a301-f2b2d014e7ad status: test description: Detects the enumeration of other remote systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Alejandro Ortuno, oscd.community date: 2020-10-22 modified: 2021-11-27 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: macos detection: selection_1: Image|endswith: /arp CommandLine|contains: -a selection_2: Image|endswith: /ping CommandLine|contains: - ' 10.' - ' 192.168.' - ' 172.16.' - ' 172.17.' - ' 172.18.' - ' 172.19.' - ' 172.20.' - ' 172.21.' - ' 172.22.' - ' 172.23.' - ' 172.24.' - ' 172.25.' - ' 172.26.' - ' 172.27.' - ' 172.28.' - ' 172.29.' - ' 172.30.' - ' 172.31.' - ' 127.' - ' 169.254.' condition: 1 of selection* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects a ping command that uses a hex encoded IP address. Logsource: windows / process_creation. Rule: title: Ping Hex IP id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd status: test description: Detects a ping command that uses a hex encoded IP address references: - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna - https://twitter.com/vysecurity/status/977198418354491392 author: Florian Roth (Nextron Systems) date: 2018-03-23 modified: 2025-10-17 tags: - attack.stealth - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ping.exe CommandLine|re: 0x[a-fA-F0-9]{8} condition: selection falsepositives: - Unlikely, because no sane admin pings IP addresses in a hexadecimal form level: high
Query: patch priority for CVE-2015-1840
Matching passage: CVE-2015-1840. CWE: CWE-200. CVSS: 5.0. jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: patch priority for CVE-2015-5304
Matching passage: CVE-2015-5304. CWE: CWE-264. CVSS: 3.5. Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-6647. CWE: CWE-264. CVSS: 7.800000190734863. The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application that leverages QSEECOM access, aka internal bug 24441554.
Query: exploit XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory 
Matching passage: CVE-2015-7461. CWE: CWE-399. CVSS: 6.5. XML external entity (XXE) vulnerability in IBM Connections 3.0.1.1 and earlier, 4.0, 4.5, and 5.0 before CR4 allows remote authenticated users to cause a denial of service (memory consumption) via crafted XML data. IBM X-Force ID: 108357.
Near-miss passage: CVE-2015-0045. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0053.
Query: CVE similar to CVE-2015-0828
Matching passage: CVE-2015-0828. CWE: UNKNOWN. CVSS: 6.800000190734863. Double free vulnerability in the nsXMLHttpRequest::GetResponse function in Mozilla Firefox before 36.0, when a nonstandard memory allocator is used, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via crafted JavaScript code that makes an XMLHttpRequest call with zero bytes of data.
Near-miss passage: CVE-2015-6662. CWE: UNKNOWN. CVSS: 6.800000190734863. XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2168485.
Query: exploit agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering pro
Matching passage: CVE-2015-7519. CWE: CWE-20. CVSS: 3.700000047683716. agent/Core/Controller/SendRequest.cpp in Phusion Passenger before 4.0.60 and 5.0.x before 5.0.22, when used in Apache integration mode or in standalone mode without a filtering proxy, allows remote attackers to spoof headers passed to applications by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X_User header.
Near-miss passage: CVE-2015-9246. CWE: CWE-20. CVSS: 9.800000190734863. An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
Query: Sigma rule for Attackers can use print.exe for remote file copy
Matching passage: Sigma rule: Attackers can use print.exe for remote file copy. Logsource: windows / process_creation. Rule: title: Abusing Print Executable id: bafac3d6-7de9-4dd9-8874-4a1194b493ed status: test description: Attackers can use print.exe for remote file copy references: - https://lolbas-project.github.io/lolbas/Binaries/Print/ - https://twitter.com/Oddvarmoe/status/985518877076541440 author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative date: 2020-10-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \print.exe CommandLine|startswith: print CommandLine|contains|all: - /D - .exe filter_print: CommandLine|contains: print.exe condition: selection and not filter_print falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass techniq. Logsource: windows / file_event. Rule: title: UAC Bypass Using IDiagnostic Profile - File id: 48ea844d-19b1-4642-944e-fe39c2cc1fec status: test description: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique references: - https://github.com/Wh04m1001/IDiagnosticProfileUAC author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-03 tags: - attack.execution - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: file_event detection: selection: Image|endswith: \DllHost.exe TargetFilename|startswith: C:\Windows\System32\ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: exploit RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Matching passage: CVE-2015-0260. CWE: CWE-200. CVSS: 4.0. RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Near-miss passage: CVE-2015-7934. CWE: CWE-200. CVSS: 8.600000381469727. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station allows remote attackers to discover log-file pathnames via unspecified vectors.
Query: describe CVE-2015-5770
Matching passage: CVE-2015-5770. CWE: CWE-264. CVSS: 5.800000190734863. MobileInstallation in Apple iOS before 8.4.1 does not ensure the uniqueness of universal provisioning profile bundle IDs, which allows attackers to replace arbitrary extensions via a crafted enterprise app.
Near-miss passage: CVE-2015-5735. CWE: CWE-264. CVSS: 7.199999809265137. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to write to arbitrary memory locations via a 0x226108 ioctl call.
Query: vulnerability: The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.
Matching passage: CVE-2015-5902. CWE: UNKNOWN. CVSS: 4.900000095367432. The debugging feature in the kernel in Apple OS X before 10.11 mismanages state, which allows local users to cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-7904. CWE: UNKNOWN. CVSS: 6.5. Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.