alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (su
Matching passage: CVE-2015-5343. CWE: CWE-119. CVSS: 7.599999904632568. Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.
Near-miss passage: CVE-2015-2498. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, and CVE-2015-2499.
Query: detection rule: Detects the download of suspicious file type from URLs with IP
Matching passage: Sigma rule: Detects the download of suspicious file type from URLs with IP. Logsource: windows / create_stream_hash. Rule: title: Unusual File Download from Direct IP Address id: 025bd229-fd1f-4fdb-97ab-20006e1a5368 status: test description: Detects the download of suspicious file type from URLs with IP references: - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md - https://labs.withsecure.com/publications/detecting-onenote-abuse author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-10 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Contents|re: http[s]?://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} TargetFilename|contains: - .ps1:Zone - .bat:Zone - .exe:Zone - .vbe:Zone - .vbs:Zone - .dll:Zone - .one:Zone - .cmd:Zone - .hta:Zone - .xll:Zone - .lnk:Zone condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe t. Logsource: windows / registry_set. Rule: title: Execution DLL of Choice Using WAB.EXE id: fc014922-5def-4da9-a0fc-28c973f41bfb status: test description: This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry. references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml - https://twitter.com/Hexacorn/status/991447379864932352 - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ author: oscd.community, Natalia Shornikova date: 2020-10-13 modified: 2023-08-17 tags: - attack.stealth - attack.t1218 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\WAB\DLLPath filter: Details: '%CommonProgramFiles%\System\wab32.dll' condition: selection and not filter falsepositives: - Unknown level: high
Query: rule covering Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.
Matching passage: Sigma rule: Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.. Logsource: windows / ps_script. Rule: title: Active Directory Computers Enumeration With Get-AdComputer id: 36bed6b2-e9a0-4fff-beeb-413a92b86138 status: test description: Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory. references: - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md author: frack113 date: 2022-03-17 modified: 2023-07-08 tags: - attack.discovery - attack.t1018 - attack.t1087.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Get-AdComputer ' selection_option: ScriptBlockText|contains: - '-Filter ' - '-LDAPFilter ' - '-Properties ' condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting. Logsource: windows / process_creation. Rule: title: Potential Meterpreter/CobaltStrike Activity id: 15619216-e993-4721-b590-4c520615a67d status: test description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/ author: Teymur Kheirkhabarov, Ecco, Florian Roth date: 2019-10-26 modified: 2023-02-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.002 logsource: category: process_creation product: windows detection: selection_img: ParentImage|endswith: \services.exe selection_technique_1: CommandLine|contains|all: - /c - echo - \pipe\ CommandLine|contains: - cmd - '%COMSPEC%' selection_technique_2: CommandLine|contains|all: - rundll32 - .dll,a - '/p:' filter_defender: CommandLine|contains: MpCmdRun condition: selection_img and 1 of selection_technique_* and not 1 of filter_* falsepositives: - Commandlines containing components like cmd accidentally - Jobs and services started with cmd level: high
Query: Sigma YAML for linux
Matching passage: Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Logsource: linux. Rule: title: Commands to Clear or Remove the Syslog - Builtin id: e09eb557-96d2-4de9-ba2d-30f712a5afd3 status: test description: Detects specific commands commonly used to remove or empty the syslog references: - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474 author: Max Altgelt (Nextron Systems) date: 2021-09-10 modified: 2022-11-26 tags: - attack.impact - attack.t1565.001 logsource: product: linux detection: selection: - rm /var/log/syslog - rm -r /var/log/syslog - rm -f /var/log/syslog - rm -rf /var/log/syslog - mv /var/log/syslog - ' >/var/log/syslog' - ' > /var/log/syslog' falsepositives: - /syslog. condition: selection and not falsepositives falsepositives: - Log rotation level: high
Near-miss passage: Sigma rule: Detects suspicious PowerShell download command. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Download - PoshModule id: de41232e-12e8-49fa-86bc-c05c7e722df9 related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: Detects suspicious PowerShell download command references: - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0 - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0 author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-01-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_webclient_: ContextInfo|contains: System.Net.WebClient selection_function: ContextInfo|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - PowerShell scripts that download content from the Internet level: medium
Query: Sigma rule for Detects RemCom service installation and execution events
Matching passage: Sigma rule: Detects RemCom service installation and execution events. Logsource: windows / system. Rule: title: RemCom Service Installation id: 9e36ed87-4986-482e-8e3b-5c23ffff11bf status: test description: Detects RemCom service installation and execution events references: - https://github.com/kavika13/RemCom/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: RemComSvc - ImagePath|endswith: \RemComSvc.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.. Logsource: windows / process_creation. Rule: title: CobaltStrike Load by Rundll32 id: ae9c6a7c-9521-42a6-915e-5aaa8689d529 status: test description: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line. references: - https://www.cobaltstrike.com/help-windows-executable - https://redcanary.com/threat-detection-report/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ author: Wojciech Lesicki date: 2021-06-01 modified: 2022-09-16 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_rundll: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: - rundll32.exe - 'rundll32 ' selection_params: CommandLine|contains: .dll CommandLine|endswith: - ' StartW' - ',StartW' condition: all of selection* falsepositives: - Unknown level: high
Query: vulnerability: Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Matching passage: CVE-2015-0979. CWE: CWE-119. CVSS: 9.0. Heap-based buffer overflow in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via a crafted packet.
Near-miss passage: CVE-2015-8317. CWE: CWE-119. CVSS: 5.0. The xmlParseXMLDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive information via an (1) unterminated encoding value or (2) incomplete XML declaration in XML data, which triggers an out-of-bounds heap read.
Query: patch priority for CVE-2015-2084
Matching passage: CVE-2015-2084. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the image_file parameter in an edit action in the cnss_social_icon_add page to wp-admin/admin.php.
Near-miss passage: CVE-2015-4010. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Encrypted Contact Form plugin before 1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the iframe_url parameter in an Update Page action in the conformconf page to wp-admin/options-general.php.
Query: describe CVE-2015-1588
Matching passage: CVE-2015-1588. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server 6 and OX AppSuite before 7.4.2-rev43, 7.6.0-rev38, and 7.6.1-rev21.
Near-miss passage: CVE-2015-6588. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in login-fsp.html in MODX Revolution before 1.9.1 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
Query: CVE similar to CVE-2015-4001
Matching passage: CVE-2015-4001. CWE: CWE-189. CVSS: 9.0. Integer signedness error in the oz_hcd_get_desc_cnf function in drivers/staging/ozwpan/ozhcd.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted packet.
Near-miss passage: CVE-2015-3809. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: CVE similar to CVE-2015-5882
Matching passage: CVE-2015-5882. CWE: CWE-284. CVSS: 7.199999809265137. The processor_set_tasks API implementation in Apple iOS before 9 allows local users to bypass an entitlement protection mechanism and obtain access to the task ports of arbitrary processes by leveraging root privileges.
Near-miss passage: CVE-2015-2816. CWE: CWE-284. CVSS: 7.5. The XcListener in SAP Afaria 7.0.6001.5 does not properly restrict access, which allows remote attackers to have unspecified impact via a crafted request, aka SAP Security Note 2134905.
Query: risk of The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS comma
Matching passage: CVE-2015-4237. CWE: CWE-78. CVSS: 4.599999904632568. The CLI parser in Cisco NX-OS 4.1(2)E1(1), 6.2(11b), 6.2(12), 7.2(0)ZZ(99.1), 7.2(0)ZZ(99.3), and 9.1(1)SV1(3.1.8) on Nexus devices allows local users to execute arbitrary OS commands via crafted characters in a filename, aka Bug IDs CSCuv08491, CSCuv08443, CSCuv08480, CSCuv08448, CSCuu99291, CSCuv08434, and CSCuv08436.
Near-miss passage: CVE-2015-7774. CWE: CWE-78. CVSS: 6.5. PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role.
Query: CVE similar to CVE-2015-1149
Matching passage: CVE-2015-1149. CWE: CWE-189. CVSS: 7.5. Integer overflow in the simulator in Swift in Apple Xcode before 6.3 allows context-dependent attackers to cause a denial of service or possibly have unspecified other impact by triggering an incorrect result of a type conversion.
Near-miss passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Query: patch priority for CVE-2015-8426
Matching passage: CVE-2015-8426. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-0471. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libelfsign.
Query: secure coding against Improper Validation of Specified Quantity in Input
Matching passage: CWE-1284 Improper Validation of Specified Quantity in Input. The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Near-miss passage: CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime. During runtime, the hardware allows for test or debug logic (feature) to be activated, which allows for changing the state of the hardware. This feature can alter the intended behavior of the system and allow for alteration and leakage of sensitive data by an adversary.
Query: risk of A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[
Matching passage: CVE-2015-7494. CWE: CWE-284. CVSS: 2.799999952316284. A vulnerability has been identified in IBM Cloud Orchestrator services/[action]/launch API. An authenticated domain admin user might modify cross domain resources via a /services/[action]/launch API call, provided it would have been possible for the domain admin user to gain access to a resource identifier of the other domain.
Near-miss passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Query: Sigma YAML for macos / process_creation
Matching passage: Sigma rule: Detecting attempts to extract passwords with grep and laZagne. Logsource: macos / process_creation. Rule: title: Credentials In Files id: 53b1b378-9b06-4992-b972-dde6e423d2b4 status: test description: Detecting attempts to extract passwords with grep and laZagne references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.001 logsource: product: macos category: process_creation detection: selection1: Image|endswith: /grep CommandLine|contains: password selection2: CommandLine|contains: laZagne condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects various execution patterns of the CrackMapExec pentesting framework. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution Patterns id: 058f4380-962d-40a5-afce-50207d36d7e2 status: stable description: Detects various execution patterns of the CrackMapExec pentesting framework references: - https://github.com/byt3bl33d3r/CrackMapExec author: Thomas Patzke date: 2020-05-22 modified: 2023-11-06 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.s0106 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - cmd.exe /Q /c * 1> \\\\*\\*\\* 2>&1 - cmd.exe /C * > \\\\*\\*\\* 2>&1 - cmd.exe /C * > *\\Temp\\* 2>&1 - powershell.exe -exec bypass -noni -nop -w 1 -C " - 'powershell.exe -noni -nop -w 1 -enc ' condition: selection falsepositives: - Unknown level: high
Query: exploit Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.
Matching passage: CVE-2015-5650. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in AjaXplorer 2.0 allows remote attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-2071. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in cm/newui/blog/export.jsp in eTouch SamePage Enterprise Edition 4.4.0.0.239 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the filepath parameter.
Query: Sigma rule for Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim
Matching passage: Sigma rule: Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim. Logsource: windows / registry_set. Rule: title: New TimeProviders Registered With Uncommon DLL Name id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85 status: test description: 'Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md author: frack113 date: 2022-06-19 modified: 2024-03-26 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\W32Time\TimeProviders TargetObject|endswith: \DllName filter_main_w32time: Details: - '%SystemRoot%\System32\vmictimeprovider.dll' - '%systemroot%\system32\w32time.dll' - C:\Windows\SYSTEM32\w32time.DLL condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Query: exploit The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, whi
Matching passage: CVE-2015-8623. CWE: CWE-352. CVSS: 8.800000190734863. The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624.
Near-miss passage: CVE-2015-9455. CWE: CWE-352. CVSS: 8.100000381469727. The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php bpfb_photos[] parameter in a bpfb_remove_temp_images action.
Query: CVE similar to CVE-2015-2785
Matching passage: CVE-2015-2785. CWE: CWE-119. CVSS: 7.5. The GIF encoder in Byzanz allows remote attackers to cause a denial of service (out-of-bounds heap write and crash) or possibly execute arbitrary code via a crafted Byzanz debug data recording (ByzanzRecording file) to the byzanz-playback command.
Near-miss passage: CVE-2015-9036. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.