alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain CWE-620
Matching passage: CWE-620 Unverified Password Change. When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
Near-miss passage: CWE-91 XML Injection (aka Blind XPath Injection). The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Query: describe CVE-2015-7716
Matching passage: CVE-2015-7716. CWE: CWE-119. CVSS: 10.0. libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.
Near-miss passage: CVE-2015-7085. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Query: describe CVE-2015-4945
Matching passage: CVE-2015-4945. CWE: CWE-200. CVSS: 5.0. Unspecified vulnerability in the IBM Maximo Anywhere application 7.5.1 through 7.5.1.2 for Android allows attackers to bypass a passcode protection mechanism and obtain sensitive information via a crafted application.
Near-miss passage: CVE-2015-3236. CWE: CWE-200. CVSS: 5.0. cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Query: write Sigma for Detects when an Policy Rule is Modified or Deleted.
Matching passage: Sigma rule: Detects when an Policy Rule is Modified or Deleted.. Logsource: okta / okta. Rule: title: Okta Policy Rule Modified or Deleted id: 0c97c1d3-4057-45c9-b148-1de94b631931 status: test description: Detects when an Policy Rule is Modified or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.rule.update - policy.rule.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120. Logsource: windows / process_creation. Rule: title: HackTool - SysmonEOP Execution id: 8a7e90c5-fe6e-45dc-889e-057fe4378bd9 status: test description: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120 references: - https://github.com/Wh04m1001/SysmonEoP author: Florian Roth (Nextron Systems) date: 2022-12-04 modified: 2024-11-23 tags: - cve.2022-41120 - attack.t1068 - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \SysmonEOP.exe selection_hash: Hashes|contains: - IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5 - IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC condition: 1 of selection_* falsepositives: - Unlikely level: critical
Query: patch priority for CVE-2015-4624
Matching passage: CVE-2015-4624. CWE: CWE-284. CVSS: 7.5. Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Near-miss passage: CVE-2015-5116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.
Query: CWE for Path Equivalence: '//multiple/leading/slash'
Matching passage: CWE-50 Path Equivalence: '//multiple/leading/slash'. The product accepts path input in the form of multiple leading slash ('//multiple/leading/slash') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-654 Reliance on a Single Factor in a Security Decision. A protection mechanism relies exclusively, or to a large extent, on the evaluation of a single condition or the integrity of a single object or entity in order to make a decision about granting access to restricted resources or functionality.
Query: describe CVE-2015-9039
Matching passage: CVE-2015-9039. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Near-miss passage: CVE-2015-1611. CWE: CWE-20. CVSS: 7.5. OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to "fake LLDP injection."
Query: risk of WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted we
Matching passage: CVE-2015-7050. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.
Near-miss passage: CVE-2015-5898. CWE: CWE-200. CVSS: 2.0999999046325684. CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
Query: patch priority for CVE-2015-2680
Matching passage: CVE-2015-2680. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
Near-miss passage: CVE-2015-7281. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.
Query: CVE similar to CVE-2015-2091
Matching passage: CVE-2015-2091. CWE: CWE-310. CVSS: 5.0. The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.
Near-miss passage: CVE-2015-1010. CWE: CWE-310. CVSS: 4.900000095367432. Rockwell Automation RSView32 7.60.00 (aka CPR9 SR4) and earlier does not properly encrypt credentials, which allows local users to obtain sensitive information by reading a file and conducting a decryption attack.
Query: patch priority for CVE-2015-7786
Matching passage: CVE-2015-7786. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9438. CWE: CWE-79. CVSS: 5.400000095367432. The display-widgets plugin before 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.
Query: describe CVE-2015-5938
Matching passage: CVE-2015-5938. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted metadata in an image.
Near-miss passage: CVE-2015-2666. CWE: CWE-119. CVSS: 6.900000095367432. Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.
Query: patch priority for CVE-2015-1869
Matching passage: CVE-2015-1869. CWE: CWE-59. CVSS: 7.800000190734863. The default event handling scripts in Automatic Bug Reporting Tool (ABRT) allow local users to gain privileges as demonstrated by a symlink attack on a var_log_messages file.
Near-miss passage: CVE-2015-7723. CWE: CWE-59. CVSS: 7.800000190734863. AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.
Query: risk of Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain 
Matching passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-0314. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Query: vulnerability: The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding 
Matching passage: CVE-2015-8845. CWE: CWE-284. CVSS: 5.5. The tm_reclaim_thread function in arch/powerpc/kernel/process.c in the Linux kernel before 4.4.1 on powerpc platforms does not ensure that TM suspend mode exists before proceeding with a tm_reclaim call, which allows local users to cause a denial of service (TM Bad Thing exception and panic) via a crafted application.
Near-miss passage: CVE-2015-6552. CWE: CWE-284. CVSS: 9.800000190734863. The management-services protocol implementation in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance through 2.5.4, 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, and 2.7.x before 2.7.2 allows remote attackers to make arbitrary RPC calls via unspecified vectors.
Query: exploit Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Matching passage: CVE-2015-9375. CWE: CWE-79. CVSS: 6.099999904632568. Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Near-miss passage: CVE-2015-2068. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the (1) profile parameter to web/magmi.php or (2) QUERY_STRING to web/magmi_import_run.php.
Query: CVE similar to CVE-2015-5066
Matching passage: CVE-2015-5066. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) content or (2) title field in an add action in the posts page to index.php or the (3) q parameter in the posts page to index.php.
Near-miss passage: CVE-2015-7451. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5 before 7.5.0.9 IF2 and 7.6 before 7.6.0.3 FP3 and Maximo Asset Management 7.5 before 7.5.0.9 IF2, 7.5.1, and 7.6 before 7.6.0.3 FP3 for SmartCloud Control Desk allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: exploit Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Matching passage: CVE-2015-1627. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4533. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.
Query: vulnerability: Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X a
Matching passage: CVE-2015-0302. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to obtain sensitive keystroke information via unspecified vectors.
Near-miss passage: CVE-2015-0250. CWE: UNKNOWN. CVSS: 6.400000095367432. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Query: exploit Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large
Matching passage: CVE-2015-8230. CWE: CWE-399. CVSS: 7.5. Memory leak in Huawei eSpace 8950 IP phones with software before V200R003C00SPC300 allows remote attackers to cause a denial of service (memory consumption and restart) via a large number of crafted ARP packets.
Near-miss passage: CVE-2015-6432. CWE: CWE-399. CVSS: 7.5. Cisco IOS XR 4.2.0, 4.3.0, 5.0.0, 5.1.0, 5.2.0, 5.2.2, 5.2.4, 5.3.0, and 5.3.2 does not properly restrict the number of Path Computation Elements (PCEs) for OSPF LSA opaque area updates, which allows remote attackers to cause a denial of service (device reload) via a crafted update, aka Bug ID CSCuw83486.
Query: exploit ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to
Matching passage: CVE-2015-7255. CWE: CWE-200. CVSS: 7.5. ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
Near-miss passage: CVE-2015-1426. CWE: CWE-200. CVSS: 2.0999999046325684. Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Query: common weakness: Declaration of Catch for Generic Exception
Matching passage: CWE-396 Declaration of Catch for Generic Exception. Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
Near-miss passage: CWE-211 Externally-Generated Error Message Containing Sensitive Information. The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified
Matching passage: CVE-2015-3061. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Near-miss passage: CVE-2015-3073. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, and CVE-2015-3074.
Query: describe CVE-2015-7965
Matching passage: CVE-2015-7965. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service Windows Logon Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module, a different vulnerability than CVE-2015-7966.
Near-miss passage: CVE-2015-0149. CWE: CWE-264. CVSS: 5.5. The developer portal in IBM API Management 3.0 before 3.0.4.1 does not properly restrict access to the public and private APIs, which allows remote authenticated users to obtain sensitive information or modify data via unspecified API calls.
Query: threat report mentioning Component Firmware
Matching passage: T1542.002 Component Firmware. Tactics: stealth, persistence. Description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking. Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
Near-miss passage: T1542.004 ROMMONkit. Tactics: stealth, persistence. Description: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect. (Citation: Cisco Synful Knock Evolution)(Citation: Cisco Blog Legacy Device Attacks) ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset. Similar to [TFTP Boot](https://attack.mitre.org/techniques/T1542/005), an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image. This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.
Query: detection rule: Detects when an application is modified or deleted.
Matching passage: Sigma rule: Detects when an application is modified or deleted.. Logsource: okta / okta. Rule: title: Okta Application Modified or Deleted id: 7899144b-e416-4c28-b0b5-ab8f9e0a541d status: test description: Detects when an application is modified or deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - application.lifecycle.update - application.lifecycle.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects AWS Config Service disabling. Logsource: aws / cloudtrail. Rule: title: AWS Config Disabling Channel/Recorder id: 07330162-dba1-4746-8121-a9647d49d297 status: test description: Detects AWS Config Service disabling references: - https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-log-files-for-aws-config.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection: eventSource: config.amazonaws.com eventName: - DeleteDeliveryChannel - StopConfigurationRecorder condition: selection falsepositives: - Valid change in AWS Config Service level: high