alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7668
Matching passage: CVE-2015-7668. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in includes/MapPinImageSave.php in the Easy2Map plugin before 1.3.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map_id parameter.
Near-miss passage: CVE-2015-8350. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the Calls to Action plugin before 2.5.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) open-tab parameter in a wp_cta_global_settings action to wp-admin/edit.php or (2) wp-cta-variation-id parameter to ab-testing-call-to-action-example/.
Query: patch priority for CVE-2015-1828
Matching passage: CVE-2015-1828. CWE: CWE-200. CVSS: 5.900000095367432. The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Near-miss passage: CVE-2015-3400. CWE: CWE-200. CVSS: 4.300000190734863. sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
Query: patch priority for CVE-2015-6411
Matching passage: CVE-2015-6411. CWE: CWE-200. CVSS: 5.0. Cisco FirePOWER Management Center 5.4.1.3, 6.0.0, and 6.0.1 provides verbose responses to requests for help files, which allows remote attackers to obtain potentially sensitive version information by reading an unspecified field, aka Bug ID CSCux37061.
Near-miss passage: CVE-2015-5906. CWE: CWE-200. CVSS: 5.0. The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which might make it easier for remote attackers to discover a password by leveraging a later prediction containing that character.
Query: CVE similar to CVE-2015-4479
Matching passage: CVE-2015-4479. CWE: CWE-189. CVSS: 10.0. Multiple integer overflows in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.
Near-miss passage: CVE-2015-4625. CWE: CWE-189. CVSS: 4.599999904632568. Integer overflow in the authentication_agent_new_cookie function in PolicyKit (aka polkit) before 0.113 allows local users to gain privileges by creating a large number of connections, which triggers the issuance of a duplicate cookie value.
Query: write Sigma for Detects potentially suspicious child processes of "aspnet_compiler.exe".
Matching passage: Sigma rule: Detects potentially suspicious child processes of "aspnet_compiler.exe".. Logsource: windows / process_creation. Rule: title: Suspicious Child Process of AspNetCompiler id: 9ccba514-7cb6-4c5c-b377-700758f2f120 related: - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects potentially suspicious child processes of "aspnet_compiler.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \aspnet_compiler.exe selection_child: - Image|endswith: - \calc.exe - \notepad.exe - Image|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog. Logsource: windows / process_creation. Rule: title: Suspicious ScreenSave Change by Reg.exe id: 0fc35fc3-efe6-4898-8a37-0b233339524f status: test description: 'Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: frack113 date: 2021-08-19 modified: 2022-06-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: process_creation product: windows detection: selection_reg: Image|endswith: \reg.exe CommandLine|contains: - HKEY_CURRENT_USER\Control Panel\Desktop - HKCU\Control Panel\Desktop selection_option_1: CommandLine|contains|all: - /v ScreenSaveActive - /t REG_SZ - /d 1 - /f selection_option_2: CommandLine|contains|all: - /v ScreenSaveTimeout - /t REG_SZ - '/d ' - /f selection_option_3: CommandLine|contains|all: - /v ScreenSaverIsSecure - /t REG_SZ - /d 0 - /f selection_option_4: CommandLine|contains|all: - /v SCRNSAVE.EXE - /t REG_SZ - '/d ' - .scr - /f condition: selection_reg and 1 of selection_option_* falsepositives: - GPO level: medium
Query: exploit Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to af
Matching passage: CVE-2015-0495. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Workbench.
Near-miss passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Query: common weakness: Context Switching Race Condition
Matching passage: CWE-368 Context Switching Race Condition. A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
Near-miss passage: CWE-804 Guessable CAPTCHA. The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
Query: alert when Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat
Matching passage: Sigma rule: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gat. Logsource: windows / file_event. Rule: title: GatherNetworkInfo.VBS Reconnaissance Script Output id: f92a6f1e-a512-4a15-9735-da09e78d7273 related: - id: 575dce0c-8139-4e30-9295-1ee75969f7fe type: similar - id: 07aa184a-870d-413d-893a-157f317f6f58 type: similar status: test description: Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". references: - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.discovery logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config TargetFilename|endswith: - \Hotfixinfo.txt - \netiostate.txt - \sysportslog.txt - \VmSwitchLog.evtx condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of Msiexec.exe to install packages hosted remotely quietly. Logsource: windows / process_creation. Rule: title: Suspicious Msiexec Quiet Install From Remote Location id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c related: - id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f type: similar status: test description: Detects usage of Msiexec.exe to install packages hosted remotely quietly references: - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-28 modified: 2025-10-07 tags: - attack.stealth - attack.t1218.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msiexec.exe - OriginalFileName: msiexec.exe selection_cli: CommandLine|contains|windash: - -i - -package - -a - -j selection_quiet: CommandLine|contains|windash: -q selection_remote: CommandLine|contains: - http - \\\\ filter_optional_openoffice: CommandLine|contains|all: - \AppData\Local\Temp\OpenOffice - Installation Files\openoffice condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: containment actions for Encoded PowerShell / command-line abuse matching Steganography
Matching passage: Playbook for T1027.003 Steganography. 1) Validate alert telemetry against T1027.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: stealth. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hi
Near-miss passage: Playbook for T1027.010 Command Obfuscation. Different response path focused on stealth.
Query: risk of The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
Matching passage: CVE-2015-9465. CWE: CWE-89. CVSS: 8.800000190734863. The yet-another-stars-rating plugin before 0.9.1 for WordPress has yasr_get_multi_set_values_and_field SQL injection via the set_id parameter.
Near-miss passage: CVE-2015-2066. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in DLGuard 4.5 allows remote attackers to execute arbitrary SQL commands via the c parameter to index.php.
Query: exploit MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might all
Matching passage: CVE-2015-8627. CWE: CWE-284. CVSS: 5.300000190734863. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Near-miss passage: CVE-2015-8838. CWE: CWE-284. CVSS: 5.900000095367432. ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
Query: vulnerability: The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensiti
Matching passage: CVE-2015-8253. CWE: CWE-200. CVSS: 3.700000047683716. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network.
Near-miss passage: CVE-2015-7680. CWE: CWE-200. CVSS: 5.300000190734863. Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, A
Matching passage: CVE-2015-7661. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via a crafted getBounds call, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Near-miss passage: CVE-2015-4800. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Optimizer.
Query: CVE similar to CVE-2015-6714
Matching passage: CVE-2015-6714. CWE: UNKNOWN. CVSS: 6.800000190734863. The Function bind implementation in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-1414. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Query: CWE for Incorrect Short Circuit Evaluation
Matching passage: CWE-768 Incorrect Short Circuit Evaluation. The product contains a conditional statement with multiple logical expressions in which one of the non-leading expressions may produce side effects. This may lead to an unexpected state in the program after the execution of the conditional, because short-circuiting logic may prevent the side effects from occurring.
Near-miss passage: CWE-138 Improper Neutralization of Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
Query: risk of Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File V
Matching passage: CVE-2015-2545. CWE: UNKNOWN. CVSS: 7.800000190734863. Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted EPS image, aka "Microsoft Office Malformed EPS File Vulnerability."
Near-miss passage: CVE-2015-0126. CWE: UNKNOWN. CVSS: 6.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension.
Query: CVE similar to CVE-2015-1547
Matching passage: CVE-2015-1547. CWE: CWE-119. CVSS: 6.5. The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Near-miss passage: CVE-2015-3746. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: patch priority for CVE-2015-7208
Matching passage: CVE-2015-7208. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information by reading HTTP Cookie headers.
Near-miss passage: CVE-2015-0089. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0087.
Query: common weakness: Use of Hard-coded Credentials
Matching passage: CWE-798 Use of Hard-coded Credentials. The product contains hard-coded credentials, such as a password or cryptographic key.
Near-miss passage: CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG). A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Query: patch priority for CVE-2015-0893
Matching passage: CVE-2015-0893. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4268. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.
Query: alert when setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all
Matching passage: Sigma rule: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions all. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Setupapi.dll Activity id: 285b85b1-a555-4095-8652-a8a4106af63f status: test description: setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file. references: - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/ - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf - https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20 author: Konstantin Grishchenko, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: Image|endswith: \runonce.exe ParentImage|endswith: \rundll32.exe ParentCommandLine|contains|all: - setupapi.dll - InstallHinfSection condition: selection falsepositives: - Scripts and administrative tools that use INF files for driver installation with setupapi.dll level: medium
Near-miss passage: Sigma rule: Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that c. Logsource: windows / process_creation. Rule: title: Potential SSH Tunnel Persistence Install Using A Scheduled Task id: 2daa93a0-a5fb-41c5-8cd8-3c11294bfd1f status: experimental description: Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server. references: - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection author: Rory Duncan date: 2025-07-14 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 - attack.command-and-control logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_sshd: CommandLine|contains|all: - ' /create ' - sshd.exe - -f selection_cli_ssh: CommandLine|contains|all: - ' /create ' - ssh.exe - -i condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Query: CWE for Class Instance Self Destruction Control Element
Matching passage: CWE-1082 Class Instance Self Destruction Control Element. The code contains a class instance that calls the method or function to delete or destroy itself.
Near-miss passage: CWE-1245 Improper Finite State Machines (FSMs) in Hardware Logic. Faulty finite state machines (FSMs) in the hardware logic allow an attacker to put the system in an undefined state, to cause a denial of service (DoS) or gain privileges on the victim's system.