alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-7829. CWE: CWE-119. CVSS: 1.899999976158142. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows mishandle junctions in the Synchronizer directory, which allows attackers to delete arbitrary files via Adobe Collaboration Sync, a related issue to CVE-2015-2428.
Near-miss passage: CVE-2015-0307. CWE: CWE-119. CVSS: 8.5. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via unspecified vectors.
Query: Sigma rule for Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get i
Matching passage: Sigma rule: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get i. Logsource: windows / registry_set. Rule: title: Add Debugger Entry To Hangs Key For Persistence id: 833ef470-fa01-4631-a79b-6f291c9ac498 status: test description: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes references: - https://persistence-info.github.io/Data/wer_debugger.html - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger condition: selection falsepositives: - This value is not set by default but could be rarly used by administrators level: high
Near-miss passage: Sigma rule: Detects loaded kernel modules that did not meet the WHQL signing requirements.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module id: 2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f status: test description: Detects loaded kernel modules that did not meet the WHQL signing requirements. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 modified: 2023-06-14 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3082 - 3083 filter_optional_vmware: FileNameBuffer: - system32\drivers\vsock.sys - System32\drivers\vmci.sys condition: selection and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Query: describe CVE-2015-2478
Matching passage: CVE-2015-2478. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application that triggers a Winsock call referencing an invalid address, aka "Winsock Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0856. CWE: CWE-264. CVSS: 4.599999904632568. daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the KDE crash handler, which allows local users to gain privileges by crashing a greeter when using certain themes, as demonstrated by the plasma-workspace breeze theme.
Query: risk of An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Matching passage: CVE-2015-9008. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.
Near-miss passage: CVE-2015-1590. CWE: CWE-264. CVSS: 7.800000190734863. The kamcmd administrative utility and default configuration in kamailio before 4.3.0 use /tmp/kamailio_ctl.
Query: common weakness: Incorrect Behavior Order: Early Validation
Matching passage: CWE-179 Incorrect Behavior Order: Early Validation. The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.
Near-miss passage: CWE-1327 Binding to an Unrestricted IP Address. The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.
Query: patch priority for CVE-2015-3156
Matching passage: CVE-2015-3156. CWE: CWE-59. CVSS: 5.5. The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file.
Near-miss passage: CVE-2015-0858. CWE: CWE-59. CVSS: 3.299999952316284. Cool Projects TarDiff allows local users to write to arbitrary files via a symlink attack on a pathname in a /tmp/tardiff-$$ temporary directory.
Query: patch priority for CVE-2015-1628
Matching passage: CVE-2015-1628. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web script or HTML via a crafted X-OWA-Canary cookie in an AD.RecipientType.User action, aka "OWA Modified Canary Parameter Cross Site Scripting Vulnerability."
Near-miss passage: CVE-2015-9362. CWE: CWE-79. CVSS: 6.099999904632568. The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: CVE similar to CVE-2015-8030
Matching passage: CVE-2015-8030. CWE: CWE-119. CVSS: 6.800000190734863. SAP 3D Visual Enterprise Viewer (VEV) allows remote attackers to execute arbitrary code via a crafted (1) U3D, (2) LWO, (3) JPEG2000, or (4) FBX file, aka "Out-Of-Bounds Indexing" vulnerabilities.
Near-miss passage: CVE-2015-6695. CWE: CWE-119. CVSS: 6.800000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted use of the value attribute, a different vulnerability than CVE-2015-6685, CVE-2015-6686, CVE-2015-6693, CVE-2015-6694, and CVE-2015-7622.
Query: write Sigma for Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.
Matching passage: Sigma rule: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.. Logsource: windows / ps_script. Rule: title: Suspicious Unblock-File id: 5947497f-1aa4-41dd-9693-c9848d58727d status: test description: Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2 author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Unblock-File ' - '-Path ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent loc. Logsource: azure / riskdetection. Rule: title: New Country id: adf9f4d2-559e-4f5c-95be-c28dff0b1476 status: test description: Detects sign-ins from new countries. The detection considers past activity locations to determine new and infrequent locations. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: newCountry condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: SOC runbook when seeing SIEM correlation: collection activity consistent with Data Staged
Matching passage: Playbook for T1074 Data Staged. 1) Validate alert telemetry against T1074. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: collection. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may stage collected data in a central location or directory prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy
Near-miss passage: Playbook for T1074.002 Remote Data Staging. Different response path focused on collection.
Query: patch priority for CVE-2015-7619
Matching passage: CVE-2015-7619. CWE: CWE-416. CVSS: 6.800000190734863. The ANShareFile2 method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-6673. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in Decoder.cpp in libpgf before 6.15.32.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfi. Logsource: windows / security. Rule: title: Tap Driver Installation - Security id: 9c8afa4d-0022-48f0-9456-3712466f9701 related: - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 type: derived status: test description: 'Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques. ' references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-11-29 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: security definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection: EventID: 4697 ServiceFileName|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: low
Near-miss passage: Sigma rule: Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credenti. Logsource: windows / security. Rule: title: Potentially Suspicious Explicit Credential Local Logon id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62 status: experimental description: 'Detects potentially suspicious explicit credential logon events where the user is trying to logon with explicit credentials (username and password) that are different from the current user context. It might indicate an attacker attempting to escalate privileges after obtaining credentials for a different user account. ' references: - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.003 logsource: product: windows service: security detection: selection_eid: EventID: 4648 selection_localhost: - TargetServerName: localhost - TargetInfo: localhost - IpAddress: - 127.0.0.1 - ::1 filter_main_computer_accounts: SubjectUserName|endswith: $ filter_main_system_processes: ProcessName|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: ProcessName|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_same_user: SubjectUserName|fieldref: TargetUserName condition: all of selection_* and not 1 of filter_main_* falsepositives: - RunAs usage from user-installed applications outside Program Files - Administrative scripts using explicit credentials from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml
Query: patch priority for CVE-2015-1271
Matching passage: CVE-2015-1271. CWE: CWE-119. CVSS: 6.800000190734863. PDFium, as used in Google Chrome before 44.0.2403.89, does not properly handle certain out-of-memory conditions, which allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted PDF document that triggers a large memory allocation.
Near-miss passage: CVE-2015-8869. CWE: CWE-119. CVSS: 9.100000381469727. OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sensitive information as demonstrated by a long string to the String.copy function.
Query: CVE similar to CVE-2015-2871
Matching passage: CVE-2015-2871. CWE: CWE-264. CVSS: 7.5. Chiyu BF-660C fingerprint access-control devices allow remote attackers to bypass authentication and (1) read or (2) modify communication configuration settings via a request to net.htm, a different vulnerability than CVE-2015-5618.
Near-miss passage: CVE-2015-3273. CWE: CWE-264. CVSS: 4.300000190734863. mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
Query: CVE similar to CVE-2015-10106
Matching passage: CVE-2015-10106. CWE: CWE-89. CVSS: 8.800000190734863. ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in mback2k mh_httpbl Extension up to 1.1.7 on TYPO3. This vulnerability affects the function moduleContent of the file mod1/index.php. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.8 is able to address this issue. The patch is identified as 429f50f4e4795b20dae06735b41fb94f010722bf. It is recommended to upgrade the affected component. VDB-230086 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Near-miss passage: CVE-2015-1441. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Piwigo before 2.5.6, 2.6.x before 2.6.5, and 2.7.x before 2.7.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: risk of Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] para
Matching passage: CVE-2015-2824. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the Simple Ads Manager plugin before 2.7.97 for WordPress allow remote attackers to execute arbitrary SQL commands via a (1) hits[][] parameter in a sam_hits action to sam-ajax.php; the (2) cstr parameter in a load_posts action to sam-ajax-admin.php; the (3) searchTerm parameter in a load_combo_data action to sam-ajax-admin.php; or the (4) subscriber, (5) contributor, (6) author, (7) editor, (8) admin, or (9) sadmin parameter in a load_users action to sam-ajax-admin.php.
Near-miss passage: CVE-2015-4628. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in application/controllers/admin/questiongroups.php in LimeSurvey before 2.06+ Build 150618 allows remote authenticated administrators to execute arbitrary SQL commands via the sid parameter.
Query: describe CVE-2015-9209
Matching passage: CVE-2015-9209. CWE: CWE-284. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, there is improper access control in a file storage API.
Near-miss passage: CVE-2015-2559. CWE: CWE-284. CVSS: 3.5. Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
Query: vulnerability: Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Matching passage: CVE-2015-3431. CWE: CWE-78. CVSS: 9.800000190734863. Pydio (formerly AjaXplorer) before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."
Near-miss passage: CVE-2015-7698. CWE: CWE-78. CVSS: 9.0. icewind1991 SMB before 1.0.3 allows remote authenticated users to execute arbitrary SMB commands via shell metacharacters in the user argument in the (1) listShares function in Server.php or the (2) connect or (3) read function in Share.php.
Query: detect Detects the execution of the hdiutil utility in order to create a disk image. in logs
Matching passage: Sigma rule: Detects the execution of the hdiutil utility in order to create a disk image.. Logsource: macos / process_creation. Rule: title: Disk Image Creation Via Hdiutil - MacOS id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae status: test description: Detects the execution of the hdiutil utility in order to create a disk image. references: - https://www.loobins.io/binaries/hdiutil/ - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/ - https://ss64.com/mac/hdiutil.html author: Omar Khaled (@beacon_exe) date: 2024-08-10 tags: - attack.exfiltration logsource: product: macos category: process_creation detection: selection: Image|endswith: /hdiutil CommandLine|contains: create condition: selection falsepositives: - Legitimate usage of hdiutil by administrators and users. level: medium
Near-miss passage: Sigma rule: Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manip. Logsource: windows / sysmon. Rule: title: Sysmon Configuration Change id: 8ac03a65-6c84-4116-acad-dc1558ff7a77 status: test description: Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: frack113 date: 2022-01-12 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 16 condition: selection falsepositives: - Legitimate administrative action level: medium regression_tests_path: regression_data/rules/windows/sysmon/sysmon_config_modification/info.yml
Query: describe CVE-2015-20108
Matching passage: CVE-2015-20108. CWE: CWE-77. CVSS: 9.800000190734863. xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
Near-miss passage: CVE-2015-1986. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2015-1938.