alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-9102
Matching passage: CVE-2015-9102. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station 6.0 before 6.0-2638 and 6.3 before 6.3-2962 allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) album name, (2) file name of uploaded photos, (3) description of photos, or (4) tag of the photos.
Near-miss passage: CVE-2015-10073. CWE: CWE-79. CVSS: 9.600000381469727. A vulnerability, which was classified as problematic, was found in tinymighty WikiSEO 1.2.1 on MediaWiki. This affects the function modifyHTML of the file WikiSEO.body.php of the component Meta Property Tag Handler. The manipulation of the argument content leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.2.2 is able to address this issue. The patch is named 089a5797be612b18a820f9f1e6593ad9a91b1dba. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220215.
Query: patch priority for CVE-2015-1164
Matching passage: CVE-2015-1164. CWE: UNKNOWN. CVSS: 4.300000190734863. Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.
Near-miss passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Query: exploit Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified 
Matching passage: CVE-2015-1392. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.5 allow remote administrators to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-6433. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in Cisco Unified Communications Manager 11.0(0.98000.225) allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCut66767.
Query: risk of Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Matching passage: CVE-2015-1265. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 43.0.2357.65 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-0455. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the XDB - XML Database component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors.
Query: CVE similar to CVE-2015-8451
Matching passage: CVE-2015-8451. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8455.
Near-miss passage: CVE-2015-5156. CWE: CWE-119. CVSS: 6.099999904632568. The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel before 4.2 attempts to support a FRAGLIST feature without proper memory allocation, which allows guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets.
Query: vulnerability: Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and
Matching passage: CVE-2015-3247. CWE: CWE-119. CVSS: 6.900000095367432. Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors.
Near-miss passage: CVE-2015-3286. CWE: CWE-119. CVSS: 4.599999904632568. Buffer overflow in the Solaris kernel extension in OpenAFS before 1.6.13 allows local users to cause a denial of service (panic or deadlock) or possibly have other unspecified impact via a large group list when joining a PAG.
Query: mitigate Add-ins
Matching passage: T1137.006 Add-ins. Tactics: persistence. Description: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system. Office add-ins can be used to add functionality to Office programs. (Citation: Microsoft Office Add-ins) There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins. (Citation: MRWLabs Office Persistence Add-ins)(Citation: FireEye Mail CDS 2018) Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.
Near-miss passage: T1137.002 Office Test. Tactics: persistence. Description: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system. An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started. This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications. This Registry key is not created by default during an Office installation.(Citation: Hexacorn Office Test)(Citation: Palo Alto Office Test Sofacy) There exist user and global Registry keys for the Office Test feature, such as: * <code>HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf</code> * <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf</code> Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.
Query: EDR alert: possible Server (T1583.004)
Matching passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Near-miss passage: T1583.006 Web Services. Tactics: resource development. Description: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Query: detection rule: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Matching passage: Sigma rule: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.. Logsource: windows / process_creation. Rule: title: Dumping of Sensitive Hives Via Reg.EXE id: fd877b94-9bb5-4191-bb25-d79cbd93c167 related: - id: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e type: obsolete - id: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0 type: obsolete status: test description: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives. references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 date: 2019-10-22 modified: 2023-12-13 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - car.2013-07-001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_flag: CommandLine|contains: - ' save ' - ' export ' - ' ˢave ' - ' eˣport ' selection_cli_hklm: CommandLine|contains: - hklm - hk˪m - hkey_local_machine - hkey_˪ocal_machine - hkey_loca˪_machine - hkey_˪oca˪_machine selection_cli_hive: CommandLine|contains: - \system - \sam - \security - \ˢystem - \syˢtem - \ˢyˢtem - \ˢam - \ˢecurity condition: all of selection_* falsepositives: - Dumping hives for legitimate purpouse i.e. backup or forensic investigation level: high
Near-miss passage: Sigma rule: Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitr. Logsource: linux / auditd. Rule: title: Modification of ld.so.preload id: 4b3cb710-5e83-4715-8c45-8b2b5b3e5751 status: test description: Identifies modification of ld.so.preload for shared object injection. This technique is used by attackers to load arbitrary code into processes. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md - https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.006 logsource: product: linux service: auditd detection: selection: type: PATH name: /etc/ld.so.preload condition: selection falsepositives: - Unknown level: high
Query: detect Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with p in logs
Matching passage: Sigma rule: Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with p. Logsource: windows / system. Rule: title: Active Directory Certificate Services Denied Certificate Enrollment Request id: 994bfd6d-0a2e-481e-a861-934069fcf5f5 status: test description: 'Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/ author: '@SerkinValery' date: 2024-03-07 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-CertificationAuthority EventID: 53 condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects when a secret scanning allowlist rule is added for projects.. Logsource: bitbucket / audit. Rule: title: Bitbucket Project Secret Scanning Allowlist Added id: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 status: test description: Detects when a secret scanning allowlist rule is added for projects. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Projects auditType.action: Project secret scanning allowlist rule added condition: selection falsepositives: - Legitimate user activity. level: low
Query: describe CVE-2015-2295
Matching passage: CVE-2015-2295. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in system_firmware_restorefullbackup.php in the WebGUI in pfSense before 2.2.1 allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deletefile parameter.
Near-miss passage: CVE-2015-8624. CWE: CWE-352. CVSS: 8.800000190734863. The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623.
Query: secure coding against Insufficient Technical Documentation
Matching passage: CWE-1059 Insufficient Technical Documentation. The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
Near-miss passage: CWE-1351 Improper Handling of Hardware Behavior in Exceptionally Cold Environments. A hardware device, or the firmware running on it, is missing or has incorrect protection features to maintain goals of security primitives when the device is cooled below standard operating temperatures.
Query: CVE similar to CVE-2015-9190
Matching passage: CVE-2015-9190. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, if start_addr + size is too large in boot_clobber_check_local_address_range(), an integer overflow occurs, resulting in clobber protection check being bypassed and SBL memory corruption.
Near-miss passage: CVE-2015-5108. CWE: CWE-190. CVSS: 10.0. Integer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5097 and CVE-2015-5109.
Query: exploit Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a sy
Matching passage: CVE-2015-3627. CWE: CWE-59. CVSS: 7.199999809265137. Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Near-miss passage: CVE-2015-3759. CWE: CWE-59. CVSS: 4.599999904632568. Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Query: patch priority for CVE-2015-3050
Matching passage: CVE-2015-3050. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-9161, CVE-2015-3046, CVE-2015-3049, CVE-2015-3051, CVE-2015-3052, CVE-2015-3056, CVE-2015-3057, CVE-2015-3070, and CVE-2015-3076.
Near-miss passage: CVE-2015-7768. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Konica Minolta FTP Utility 1.0 allows remote attackers to execute arbitrary code via a long CWD command.
Query: CVE similar to CVE-2015-0090
Matching passage: CVE-2015-0090. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Near-miss passage: CVE-2015-0088. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0090, CVE-2015-0091, CVE-2015-0092, and CVE-2015-0093.
Query: patch priority for CVE-2015-8325
Matching passage: CVE-2015-8325. CWE: CWE-264. CVSS: 7.800000190734863. The do_setup_env function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read .pam_environment files in user home directories, allows local users to gain privileges by triggering a crafted environment for the /bin/login program, as demonstrated by an LD_PRELOAD environment variable.
Near-miss passage: CVE-2015-6133. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
Query: risk of Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote
Matching passage: CVE-2015-0231. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.
Near-miss passage: CVE-2015-4297. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
Query: incident response steps for Encoded PowerShell / command-line abuse matching TFTP Boot
Matching passage: Playbook for T1542.005 TFTP Boot. 1) Validate alert telemetry against T1542.005. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth, persistence. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server. TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server. Netbooting is one option in the boot sequence and can be used to centralize, manage, and control de
Near-miss passage: Playbook for T1542.003 Bootkit. Different response path focused on stealth, persistence.
Query: explain CWE-705
Matching passage: CWE-705 Incorrect Control Flow Scoping. The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
Near-miss passage: CWE-163 Improper Neutralization of Multiple Trailing Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple trailing special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: describe CVE-2015-9230
Matching passage: CVE-2015-9230. CWE: CWE-79. CVSS: 4.800000190734863. In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible for remote authenticated administrators via the DBTablePrefix parameter.
Near-miss passage: CVE-2015-3268. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element.