alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software
Matching passage: Sigma rule: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software. Logsource: windows / windefend. Rule: title: Windows Defender Malware And PUA Scanning Disabled id: bc275be9-0bec-4d77-8c8f-281a2df6710f related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5010 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlati. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure Via SSH id: d3f90469-fb05-42ce-b67d-0fded91bbef3 status: test description: 'Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.lateral-movement - attack.credential-access - attack.t1021.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed(SSH) condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Query: risk of The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acr
Matching passage: CVE-2015-6700. CWE: CWE-772. CVSS: 5.0. The setBackground function in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via invalid arguments, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6701, CVE-2015-6702, CVE-2015-6703, and CVE-2015-6704.
Near-miss passage: CVE-2015-6704. CWE: CWE-772. CVSS: 4.300000190734863. The animations property implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information from process memory via a function call, a different vulnerability than CVE-2015-6697, CVE-2015-6699, CVE-2015-6700, CVE-2015-6701, CVE-2015-6702, and CVE-2015-6703.
Query: patch priority for CVE-2015-1997
Matching passage: CVE-2015-1997. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar Vulnerability Manager 7.2.x before 7.2.5 Patch 5 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-3655. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to hijack the authentication of administrators by leveraging improper enforcement of the anti-CSRF token.
Query: risk of SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted PO
Matching passage: CVE-2015-6299. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web interface in Cisco Unity Connection 9.1(1.2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted POST request, aka Bug ID CSCuv63824.
Near-miss passage: CVE-2015-1560. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier (fixed in Centreon web 2.7.0) allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
Query: exploit IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Matching passage: CVE-2015-1899. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 8.5 through CF05 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Near-miss passage: CVE-2015-5963. CWE: CWE-399. CVSS: 5.0. contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.
Query: CVE similar to CVE-2015-1944
Matching passage: CVE-2015-1944. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-9439. CWE: CWE-79. CVSS: 4.800000190734863. The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=addthis_social_widget pubid parameter.
Query: describe CVE-2015-4863
Matching passage: CVE-2015-4863. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Portable Clusterware component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Near-miss passage: CVE-2015-2014. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the web server in IBM Domino 8.5 before 8.5.3 FP6 IF9 and 9.0 before 9.0.1 FP4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or cross-site scripting (XSS) attacks via a crafted URL, aka SPR SJAR9DNGDA.
Query: vulnerability: The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST ellipti
Matching passage: CVE-2015-8805. CWE: CWE-310. CVSS: 9.800000190734863. The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementation of the P-256 NIST elliptic curve, which allows attackers to have unspecified impact via unknown vectors, a different vulnerability than CVE-2015-8803.
Near-miss passage: CVE-2015-8989. CWE: CWE-310. CVSS: 8.800000190734863. Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database.
Query: Sigma rule for Indicates user activity that is unusual for the user or consistent with known attack patterns.
Matching passage: Sigma rule: Indicates user activity that is unusual for the user or consistent with known attack patterns.. Logsource: azure / riskdetection. Rule: title: Azure AD Threat Intelligence id: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba status: test description: Indicates user activity that is unusual for the user or consistent with known attack patterns. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: investigationsThreatIntelligence condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Suspicious Execution id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 related: - id: 48bbc537-b652-4b4e-bd1d-281172df448f type: similar status: test description: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe selection_cli: CommandLine|contains: msmpeng.exe condition: all of selection_* falsepositives: - Unlikely level: high
Query: risk of Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explore
Matching passage: CVE-2015-6149. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6147.
Near-miss passage: CVE-2015-5919. CWE: CWE-119. CVSS: 7.199999809265137. GasGauge in Apple watchOS before 2 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5918.
Query: detect Detects execution of "reg.exe" to disable security services such as Windows Defender. in logs
Matching passage: Sigma rule: Detects execution of "reg.exe" to disable security services such as Windows Defender.. Logsource: windows / process_creation. Rule: title: Security Service Disabled Via Reg.EXE id: 5e95028c-5229-4214-afae-d653d573d0ec status: test description: Detects execution of "reg.exe" to disable security services such as Windows Defender. references: - https://twitter.com/JohnLaTwC/status/1415295021041979392 - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1 - https://vms.drweb.fr/virus/?i=24144899 - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim date: 2021-07-14 modified: 2023-06-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg_add: CommandLine|contains|all: - reg - add selection_cli_reg_start: CommandLine|contains|all: - d 4 - v Start CommandLine|contains: - \AppIDSvc - \MsMpSvc - \NisSrv - \SecurityHealthService - \Sense - \UsoSvc - \WdBoot - \WdFilter - \WdNisDrv - \WdNisSvc - \WinDefend - \wscsvc - \wuauserv condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / network_connection. Rule: title: Uncommon Outbound Kerberos Connection id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 related: - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.credential-access - attack.t1558 - attack.lateral-movement - attack.t1550.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: 88 Initiated: 'true' filter_main_lsass: Image: C:\Windows\System32\lsass.exe filter_optional_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Image|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium
Query: detection rule: Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LS
Matching passage: Sigma rule: Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LS. Logsource: windows / process_access. Rule: title: LSASS Access From Potentially White-Listed Processes id: 4be8b654-0c01-4c9d-a10c-6b28467fc651 status: test description: 'Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference ' references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz - https://twitter.com/mrd0x/status/1460597833917251595 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: - \TrolleyExpress.exe - \ProcessDump.exe - \dump64.exe GrantedAccess|endswith: - '10' - '30' - '50' - '70' - '90' - B0 - D0 - F0 - '18' - '38' - '58' - '78' - '98' - B8 - D8 - F8 - 1A - 3A - 5A - 7A - 9A - BA - DA - FA - '0x14C2' - FF condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use. Logsource: windows / process_creation. Rule: title: Query Usage To Exfil Data id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2 status: test description: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-01-19 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: :\Windows\System32\query.exe CommandLine|contains: - session > - process > condition: selection falsepositives: - Unknown level: medium
Query: detect Potential threat actor tampering with Sysmon manifest and eventually disabling it in logs
Matching passage: Sigma rule: Potential threat actor tampering with Sysmon manifest and eventually disabling it. Logsource: windows / security. Rule: title: Sysmon Channel Reference Deletion id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc status: test description: Potential threat actor tampering with Sysmon manifest and eventually disabling it references: - https://twitter.com/Flangvik/status/1283054508084473861 - https://twitter.com/SecurityJosh/status/1283027365770276866 - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-07-14 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows service: security detection: selection1: EventID: 4657 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational ObjectValueName: Enabled NewValue: 0 selection2: EventID: 4663 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational AccessMask: '0x10000' condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Access to LSASS Process. Logsource: windows / windefend. Rule: title: LSASS Access Detected via Attack Surface Reduction id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 status: test description: Detects Access to LSASS Process references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction author: Markus Neis date: 2018-08-26 modified: 2022-08-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)' detection: selection: EventID: 1121 Path|endswith: \lsass.exe filter_thor: ProcessName|startswith: C:\Windows\Temp\asgard2-agent\ ProcessName|endswith: - \thor64.exe - \thor.exe filter_exact: ProcessName: - C:\Windows\System32\atiesrxx.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\msiexec.exe - C:\Windows\System32\nvwmi64.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\Taskmgr.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\msiexec.exe filter_begins: ProcessName|startswith: - C:\Windows\System32\DriverStore\ - C:\WINDOWS\Installer\ - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_* falsepositives: - Google Chrome GoogleUpdate.exe - Some Taskmgr.exe related activity level: high
Query: secure coding against Insecure Security Identifier Mechanism
Matching passage: CWE-1294 Insecure Security Identifier Mechanism. The System-on-Chip (SoC) implements a Security Identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Identifiers are not correctly implemented.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Query: weakness Missing Source Correlation of Multiple Independent Data
Matching passage: CWE-1293 Missing Source Correlation of Multiple Independent Data. The product relies on one source of data, preventing the ability to detect if an adversary has compromised a data source.
Near-miss passage: CWE-1059 Insufficient Technical Documentation. The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
Query: patch priority for CVE-2015-1064
Matching passage: CVE-2015-1064. CWE: CWE-200. CVSS: 1.899999976158142. Springboard in Apple iOS before 8.2 allows physically proximate attackers to bypass an intended activation requirement and read the home screen by leveraging an application crash during the activation process.
Near-miss passage: CVE-2015-6632. CWE: CWE-200. CVSS: 5.0. libstagefright in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via unknown vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 24346430.
Query: vulnerability: Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploa
Matching passage: CVE-2015-2825. CWE: UNKNOWN. CVSS: 7.5. Unrestricted file upload vulnerability in sam-ajax-admin.php in the Simple Ads Manager plugin before 2.5.96 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the path parameter.
Near-miss passage: CVE-2015-2663. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, and 6.3.0 through 6.3.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Business Process Automation.
Query: vulnerability: Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5111. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5113, and CVE-2015-5114.
Near-miss passage: CVE-2015-7618. CWE: CWE-416. CVSS: 6.800000190734863. The CBAutoConfigCommentRepository method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Query: CVE similar to CVE-2015-9397
Matching passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Near-miss passage: CVE-2015-4706. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.