alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL 
Matching passage: CVE-2015-0941. CWE: CWE-310. CVSS: 4.300000190734863. The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
Near-miss passage: CVE-2015-7756. CWE: CWE-310. CVSS: 5.0. The encryption implementation in Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r16 before 6.3.0r16b, 6.3.0r17 before 6.3.0r17b, 6.3.0r18 before 6.3.0r18b, 6.3.0r19 before 6.3.0r19b, and 6.3.0r20 before 6.3.0r21 makes it easier for remote attackers to discover the plaintext content of VPN sessions by sniffing the network for ciphertext data and conducting an unspecified decryption attack.
Query: exploit Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the 
Matching passage: CVE-2015-1287. CWE: CWE-17. CVSS: 4.300000190734863. Blink, as used in Google Chrome before 44.0.2403.89, enables a quirks-mode exception that limits the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site, related to core/fetch/CSSStyleSheetResource.cpp.
Near-miss passage: CVE-2015-7192. CWE: CWE-17. CVSS: 7.5. The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.
Query: vulnerability: Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root p
Matching passage: CVE-2015-2016. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unknown vectors.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: vulnerability: Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecifi
Matching passage: CVE-2015-1929. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-8221. CWE: CWE-119. CVSS: 10.0. Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
Query: CVE similar to CVE-2015-2756
Matching passage: CVE-2015-2756. CWE: CWE-264. CVSS: 4.900000095367432. QEMU, as used in Xen 3.3.x through 4.5.x, does not properly restrict access to PCI command registers, which might allow local HVM guest users to cause a denial of service (non-maskable interrupt and host crash) by disabling the (1) memory or (2) I/O decoding for a PCI Express device and then accessing the device, which triggers an Unsupported Request (UR) response.
Near-miss passage: CVE-2015-3003. CWE: CWE-264. CVSS: 7.199999809265137. Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, 12.3 before 12.3R9, 12.3X48 before 12.3X48-D10, 13.2 before 13.2R6, 13.3 before 13.3R5, 14.1 before 14.1R3, and 14.2 before 14.2R1 allows local users to gain privileges via crafted combinations of CLI commands and arguments.
Query: patch priority for CVE-2015-7202
Matching passage: CVE-2015-7202. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5783. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3770.
Query: patch priority for CVE-2015-9049
Matching passage: CVE-2015-9049. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of certain responses from the USIM.
Near-miss passage: CVE-2015-9061. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.
Query: CVE similar to CVE-2015-5295
Matching passage: CVE-2015-5295. CWE: CWE-119. CVSS: 5.400000095367432. The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote authenticated users to cause a denial of service (memory consumption) or determine the existence of local files via the resource type in a template, as demonstrated by file:///dev/zero.
Near-miss passage: CVE-2015-6989. CWE: CWE-119. CVSS: 6.800000190734863. Grand Central Dispatch in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted package that is mishandled during dispatch calls.
Query: exploit eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possi
Matching passage: CVE-2015-4594. CWE: CWE-284. CVSS: 9.800000190734863. eClinicalWorks Population Health (CCMR) suffers from a session fixation vulnerability. When authenticating a user, the application does not assign a new session ID, making it possible to use an existent session ID.
Near-miss passage: CVE-2015-2509. CWE: CWE-284. CVSS: 9.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted Media Center link (mcl) file, aka "Windows Media Center RCE Vulnerability."
Query: patch priority for CVE-2015-2132
Matching passage: CVE-2015-2132. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
Near-miss passage: CVE-2015-9067. CWE: UNKNOWN. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.
Query: exploit The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Matching passage: CVE-2015-9435. CWE: CWE-338. CVSS: 9.800000190734863. The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Near-miss passage: CVE-2015-4633. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Query: write Sigma for Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo
Matching passage: Sigma rule: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload abo. Logsource: linux / process_creation. Rule: title: Linux Base64 Encoded Shebang In CLI id: fe2f9663-41cb-47e2-b954-8a228f3b9dff status: test description: Detects the presence of a base64 version of the shebang in the commandline, which could indicate a malicious payload about to be decoded references: - https://www.trendmicro.com/pl_pl/research/20/i/the-evolution-of-malicious-shell-scripts.html - https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth - attack.t1140 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - IyEvYmluL2Jhc2 - IyEvYmluL2Rhc2 - IyEvYmluL3pza - IyEvYmluL2Zpc2 - IyEvYmluL3No condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...). Logsource: windows / file_event. Rule: title: DLL Search Order Hijackig Via Additional Space in Path id: b6f91281-20aa-446a-b986-38a92813a18f status: test description: 'Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack ' references: - https://twitter.com/cyb3rops/status/1552932770464292864 - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-30 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: - C:\Windows \ - C:\Program Files \ - C:\Program Files (x86) \ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: alert when Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN
Matching passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Activity Invoking Sys File id: 731231b9-0b5d-4219-94dd-abb6959aa7ea status: test description: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: rundll32.exe selection2: CommandLine|contains: - .sys, - '.sys ' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / process_creation. Rule: title: Potential COM Objects Download Cradles Usage - Process Creation id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf related: - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: '[Type]::GetTypeFromCLSID(' selection_2: CommandLine|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium
Query: Sigma rule for Detects when there is a interruption in the authentication process.
Matching passage: Sigma rule: Detects when there is a interruption in the authentication process.. Logsource: azure / signinlogs. Rule: title: Azure Unusual Authentication Interruption id: 8366030e-7216-476b-9927-271d79f13cf3 status: test description: Detects when there is a interruption in the authentication process. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_50097: ResultType: 50097 ResultDescription: Device authentication is required selection_50155: ResultType: 50155 ResultDescription: DeviceAuthenticationFailed selection_50158: ResultType: 50158 ResultDescription: ExternalSecurityChallenge - External security challenge was not satisfied condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes. Logsource: windows / process_creation. Rule: title: PUA- IOX Tunneling Tool Execution id: d7654f02-e04b-4934-9838-65c46f187ebc status: test description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes references: - https://github.com/EddieIvan01/iox author: Florian Roth (Nextron Systems) date: 2022-10-08 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection: Image|endswith: \iox.exe selection_commandline: CommandLine|contains: - '.exe fwd -l ' - '.exe fwd -r ' - '.exe proxy -l ' - '.exe proxy -r ' selection_hashes: Hashes|contains: - MD5=9DB2D314DD3F704A02051EF5EA210993 - SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD - SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731 condition: 1 of selection* falsepositives: - Legitimate use level: high
Query: CVE similar to CVE-2015-1259
Matching passage: CVE-2015-1259. CWE: CWE-17. CVSS: 7.5. PDFium, as used in Google Chrome before 43.0.2357.65, does not properly initialize memory, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-2987. CWE: CWE-17. CVSS: 2.5999999046325684. Type74 ED before 4.0 misuses 128-bit ECB encryption for small files, which makes it easier for attackers to obtain plaintext data via differential cryptanalysis of a file with an original length smaller than 128 bits.
Query: patch priority for CVE-2015-0406
Matching passage: CVE-2015-0406. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-1120. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Query: Lateral movement indicators for Multiband Communication
Matching passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Near-miss passage: T1665 Hide Infrastructure. Tactics: command and control. Description: Adversaries may manipulate network traffic in order to hide and evade detection of their C2 infrastructure. This can be accomplished by identifying and filtering traffic from defensive tools,(Citation: TA571) masking malicious domains to obfuscate the true destination from both automated scanning tools and security researchers,(Citation: Schema-abuse)(Citation: Facad1ng)(Citation: Browser-updates) and otherwise hiding malicious artifacts to delay discovery and prolong the effectiveness of adversary infrastructure that could otherwise be identified, blocked, or taken down entirely. C2 networks may include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections. For example, an adversary may use a virtual private cloud to spoof their IP address to closer align with a victim's IP address ranges. This may also bypass security measures relying on geolocation of the source IP address.(Citation: sysdig)(Citation: Orange Residential Proxies) Adversaries may also attempt to filter network traffic in order to evade defensive tools in numerous ways, including blocking/redirecting common incident responder or security appliance user agents.(Citation: mod_rewrite)(Citation: SocGholish-update) Filtering traffic based on IP and geo-fencing may also avoid automated sandboxing or researcher activity (i.e., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)).(Citation: TA571)(Citation: mod_rewrite) Hiding C2 infrastructure may also be supported by [Resource Development](https://attack.mitre.org/tactics/TA0042) activities such as [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) and [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584). For example, using widely trusted hosting services or domains such as prominent URL shortening providers or marketing ser
Query: risk of Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader
Matching passage: CVE-2015-5093. CWE: CWE-120. CVSS: 10.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6458. CWE: CWE-120. CVSS: 8.800000190734863. Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1, 2015, to address the vulnerability.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject a
Matching passage: CVE-2015-5036. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Connections 3.x before 3.0.1.1 CR3, 4.0 before CR4, 4.5 before CR5, and 5.0 before CR3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL, a different vulnerability than CVE-2015-5035.
Near-miss passage: CVE-2015-0131. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-5746
Matching passage: CVE-2015-5746. CWE: CWE-284. CVSS: 5.0. AppleFileConduit in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via an afc command that leverages symlink mishandling.
Near-miss passage: CVE-2015-4526. CWE: CWE-284. CVSS: 7.199999809265137. EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installation Manager Boxmgmt CLI interface.
Query: describe CVE-2015-5351
Matching passage: CVE-2015-5351. CWE: CWE-352. CVSS: 8.800000190734863. The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
Near-miss passage: CVE-2015-2293. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote attackers to hijack the authentication of certain users for requests that conduct SQL injection attacks via the (1) order_by or (2) order parameter in the wpseo_bulk-editor page.
Query: risk of OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service
Matching passage: CVE-2015-1881. CWE: CWE-399. CVSS: 4.0. OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.
Near-miss passage: CVE-2015-4240. CWE: CWE-399. CVSS: 5.0. Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Query: vulnerability: A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
Matching passage: CVE-2015-7542. CWE: CWE-319. CVSS: 5.300000190734863. A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
Near-miss passage: CVE-2015-5051. CWE: CWE-264. CVSS: 4.300000190734863. IBM Maximo Asset Management 7.5 before 7.5.0.8 IF6 and 7.6 before 7.6.0.2 IF1 and Maximo Asset Management 7.5 before 7.5.0.8 IF6, 7.5.1, and 7.6 before 7.6.0.2 IF1 for SmartCloud Control Desk allow remote authenticated users to bypass intended access restrictions on query results via unspecified vectors.