alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7946
Matching passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Near-miss passage: CVE-2015-0211. CWE: CWE-200. CVSS: 4.0. mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course:manageactivities and mod/lti:addinstance capabilities before proceeding with registered-tool list searches, which allows remote authenticated users to obtain sensitive information via requests to the LTI Ajax service.
Query: risk of The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-compu
Matching passage: CVE-2015-0837. CWE: CWE-203. CVSS: 5.900000095367432. The mpi_powm function in Libgcrypt before 1.6.3 and GnuPG before 1.4.19 allows attackers to obtain sensitive information by leveraging timing differences when accessing a pre-computed table during modular exponentiation, related to a "Last-Level Cache Side-Channel Attack."
Near-miss passage: CVE-2015-8313. CWE: CWE-203. CVSS: 5.900000095367432. GnuTLS incorrectly validates the first byte of padding in CBC modes
Query: vulnerability: Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL
Matching passage: CVE-2015-0984. CWE: CWE-22. CVSS: 10.0. Directory traversal vulnerability in the FTP server on Honeywell Excel Web XL1000C50 52 I/O, XL1000C100 104 I/O, XL1000C500 300 I/O, XL1000C1000 600 I/O, XL1000C50U 52 I/O UUKL, XL1000C100U 104 I/O UUKL, XL1000C500U 300 I/O UUKL, and XL1000C1000U 600 I/O UUKL controllers before 2.04.01 allows remote attackers to read files under the web root, and consequently obtain administrative login access, via a crafted pathname.
Near-miss passage: CVE-2015-6500. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in ownCloud Server before 8.0.6 and 8.1.x before 8.1.1 allows remote authenticated users to list directory contents and possibly cause a denial of service (CPU consumption) via a .. (dot dot) in the dir parameter to index.php/apps/files/ajax/scan.php.
Query: risk of The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are availa
Matching passage: CVE-2015-1226. CWE: CWE-264. CVSS: 5.0. The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
Near-miss passage: CVE-2015-3965. CWE: CWE-264. CVSS: 8.800000190734863. Hospira Symbiq Infusion System 3.13 and earlier allows remote authenticated users to trigger "unanticipated operations" by leveraging "elevated privileges" for an unspecified call to an incorrectly exposed function.
Query: CVE similar to CVE-2015-0938
Matching passage: CVE-2015-0938. CWE: CWE-200. CVSS: 5.0. search.php on the Blue Coat Malware Analysis appliance with software before 4.2.4.20150312-RELEASE allows remote attackers to bypass intended access restrictions, and list or read arbitrary documents, by providing matching keywords in conjunction with a crafted parameter.
Near-miss passage: CVE-2015-3454. CWE: CWE-200. CVSS: 7.5. TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Query: risk of Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability tha
Matching passage: CVE-2015-5206. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Near-miss passage: CVE-2015-4788. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4774 and CVE-2015-4779.
Query: exploit Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contain
Matching passage: CVE-2015-6291. CWE: CWE-20. CVSS: 7.800000190734863. Cisco AsyncOS before 8.5.7-043, 9.x before 9.1.1-023, and 9.5.x and 9.6.x before 9.6.0-046 on Email Security Appliance (ESA) devices mishandles malformed fields during body-contains, attachment-contains, every-attachment-contains, attachment-binary-contains, dictionary-match, and attachment-dictionary-match filtering, which allows remote attackers to cause a denial of service (memory consumption) via a crafted attachment in an e-mail message, aka Bug ID CSCuv47151.
Near-miss passage: CVE-2015-3234. CWE: CWE-20. CVSS: 4.300000190734863. The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
Query: describe CVE-2015-8970
Matching passage: CVE-2015-8970. CWE: CWE-476. CVSS: 5.5. crypto/algif_skcipher.c in the Linux kernel before 4.4.2 does not verify that a setkey operation has been performed on an AF_ALG socket before an accept system call is processed, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted application that does not supply a key, related to the lrw_crypt function in crypto/lrw.c.
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: indicators of Messaging Applications
Matching passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: weakness Exposure of Sensitive Information to an Unauthorized Actor
Matching passage: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Near-miss passage: CWE-524 Use of Cache Containing Sensitive Information. The code uses a cache that contains sensitive information, but the cache can be read by an actor outside of the intended control sphere.
Query: describe CVE-2015-4368
Matching passage: CVE-2015-4368. CWE: UNKNOWN. CVSS: 5.0. The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors.
Near-miss passage: CVE-2015-1255. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Query: risk of SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain
Matching passage: CVE-2015-7596. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Near-miss passage: CVE-2015-4946. CWE: CWE-264. CVSS: 3.299999952316284. Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 allows local users to bypass intended access restrictions via unspecified vectors.
Query: detect Detection well-known mimikatz command line arguments in logs
Matching passage: Sigma rule: Detection well-known mimikatz command line arguments. Logsource: windows / process_creation. Rule: title: HackTool - Mimikatz Execution id: a642964e-bead-4bed-8910-1bb4d63e3b4d status: test description: Detection well-known mimikatz command line arguments references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://tools.thehacker.recipes/mimikatz/modules author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton date: 2019-10-22 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 logsource: category: process_creation product: windows detection: selection_tools_name: CommandLine|contains: - DumpCreds - mimikatz selection_function_names: CommandLine|contains: - ::aadcookie - ::detours - ::memssp - ::mflt - ::ncroutemon - ::ngcsign - ::printnightmare - ::skeleton - ::preshutdown - ::mstsc - ::multirdp selection_module_names: CommandLine|contains: - 'rpc::' - 'token::' - 'crypto::' - 'dpapi::' - 'sekurlsa::' - 'kerberos::' - 'lsadump::' - 'privilege::' - 'process::' - 'vault::' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file. Logsource: windows / file_event. Rule: title: HackTool - NPPSpy Hacktool Usage id: cad1fe90-2406-44dc-bd03-59d0b58fe722 status: test description: Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy - https://twitter.com/0gtweet/status/1465282548494487554 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2024-06-27 tags: - attack.credential-access logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \NPPSpy.txt - \NPPSpy.dll condition: selection falsepositives: - Unknown level: high
Query: exploit In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corr
Matching passage: CVE-2015-8592. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corruption.
Near-miss passage: CVE-2015-9111. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
Query: CVE similar to CVE-2015-4685
Matching passage: CVE-2015-4685. CWE: CWE-264. CVSS: 7.0. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: write Sigma for Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common
Matching passage: Sigma rule: Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common. Logsource: windows / file_event. Rule: title: Suspicious Startup Folder Persistence id: 28208707-fe31-437f-9a7f-4b1108b94d2e related: - id: 2aa0a6b4-a865-495b-ab51-c28249537b75 type: similar status: test description: 'Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems. ' references: - https://github.com/last-byte/PersistenceSniper - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-08-10 modified: 2025-10-12 tags: - attack.privilege-escalation - attack.execution - attack.t1204.002 - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Windows\Start Menu\Programs\Startup\ TargetFilename|endswith: - .bat - .cmd - .dll - .hta - .jar - .js - .jse - .msi - .ps1 - .psd1 - .psm1 - .scr - .url - .vba - .vbe - .vbs - .wsf condition: selection falsepositives: - Rare legitimate usage of some of the extensions mentioned in the rule level: high
Near-miss passage: Sigma rule: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe pro. Logsource: windows / file_event. Rule: title: LSASS Process Memory Dump Creation Via Taskmgr.EXE id: 69ca12af-119d-44ed-b50f-a47af0ebc364 status: test description: Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager. author: Swachchhanda Shrawan Poudel date: 2023-10-19 references: - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1 tags: - attack.credential-access - attack.t1003.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - :\Windows\system32\taskmgr.exe - :\Windows\SysWOW64\taskmgr.exe TargetFilename|contains|all: - \AppData\Local\Temp\ - \lsass - .DMP condition: selection falsepositives: - Rare case of troubleshooting by an administrator or support that has to be investigated regardless level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_taskmgr_lsass_dump/info.yml
Query: describe CVE-2015-6853
Matching passage: CVE-2015-6853. CWE: CWE-345. CVSS: 9.100000381469727. The Domino web agent in CA Single Sign-On (aka SSO, formerly SiteMinder) R6, R12.0 before SP3 CR13, R12.0J before SP3 CR1.2, R12.5 before CR5, R12.51 before CR4, and R12.52 before SP1 CR3 allows remote attackers to cause a denial of service (daemon crash) or obtain sensitive information via a crafted request.
Near-miss passage: CVE-2015-3956. CWE: CWE-345. CVSS: 9.800000190734863. Hospira Plum A+ Infusion System version 13.4 and prior, Plum A+3 Infusion System version 13.6 and prior, and Symbiq Infusion System, version 3.13 and prior accept drug libraries, firmware updates, pump commands, and unauthorized configuration changes from unauthenticated devices on the host network. Hospira recommends that customers close Port 20/FTP and Port 23/TELNET on the affected devices. Hospira has also released the Plum 360 Infusion System which is not vulnerable to this issue.
Query: describe CVE-2015-6126
Matching passage: CVE-2015-6126. CWE: CWE-362. CVSS: 7.199999809265137. Race condition in the Pragmatic General Multicast (PGM) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application, aka "Windows PGM UAF Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-1862. CWE: CWE-362. CVSS: 7.0. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Query: patch priority for CVE-2015-7228
Matching passage: CVE-2015-7228. CWE: UNKNOWN. CVSS: 5.0. The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-5652. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in python.exe in Python through 3.5.0 on Windows allows local users to gain privileges via a Trojan horse readline.pyd file in the current working directory. NOTE: the vendor says "It was determined that this is a longtime behavior of Python that cannot really be altered at this point."
Query: how to detect InstallUtil
Matching passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Near-miss passage: T1218.012 Verclsid. Tactics: stealth. Description: Adversaries may abuse verclsid.exe to proxy execution of malicious code. Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.(Citation: WinOSBite verclsid.exe) Adversaries may abuse verclsid.exe to execute malicious payloads. This may be achieved by running <code>verclsid.exe /S /C {CLSID}</code>, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects. COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010)). Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.(Citation: LOLBAS Verclsid)(Citation: Red Canary Verclsid.exe)(Citation: BOHOPS Abusing the COM Registry)(Citation: Nick Tyrer GitHub)
Query: exploit The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Matching passage: CVE-2015-1141. CWE: UNKNOWN. CVSS: 4.900000095367432. The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Near-miss passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.