alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4148
Matching passage: CVE-2015-4148. CWE: CWE-20. CVSS: 5.0. The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data type, related to a "type confusion" issue.
Near-miss passage: CVE-2015-1609. CWE: CWE-20. CVSS: 5.0. MongoDB before 2.4.13 and 2.6.x before 2.6.8 allows remote attackers to cause a denial of service via a crafted UTF-8 string in a BSON request.
Query: patch priority for CVE-2015-2651
Matching passage: CVE-2015-2651. CWE: UNKNOWN. CVSS: 3.799999952316284. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver.
Near-miss passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Query: patch priority for CVE-2015-9271
Matching passage: CVE-2015-9271. CWE: CWE-434. CVSS: 9.800000190734863. The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress allows remote attackers to execute arbitrary code because vc/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code, a different vulnerability than CVE-2014-1905.
Near-miss passage: CVE-2015-4455. CWE: CWE-434. CVSS: 9.800000190734863. Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in wp-content/uploads/gform_aviary.
Query: risk of hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted da
Matching passage: CVE-2015-8947. CWE: CWE-119. CVSS: 7.599999904632568. hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
Near-miss passage: CVE-2015-1521. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.
Query: risk of Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, 
Matching passage: CVE-2015-4685. CWE: CWE-264. CVSS: 7.0. Polycom RealPresence Resource Manager (aka RPRM) before 8.4 allows local users with access to the plcm account to gain privileges via a script in /var/polycom/cma/upgrade/scripts, related to a sudo misconfiguration.
Near-miss passage: CVE-2015-9012. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2985. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in guide-park.com BBS X102 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-3447. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in macIpSpoofView.html in Dell SonicWall SonicOS 7.5.0.12 and 6.x allow remote attackers to inject arbitrary web script or HTML via the (1) searchSpoof or (2) searchSpoofIpDet parameter.
Query: Sigma YAML for cisco / aaa
Matching passage: Sigma rule: Collect pertinent data from the configuration files. Logsource: cisco / aaa. Rule: title: Cisco Collect Data id: cd072b25-a418-4f98-8ebc-5093fb38fe1a status: test description: Collect pertinent data from the configuration files references: - https://blog.router-switch.com/2013/11/show-running-config/ - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.discovery - attack.credential-access - attack.collection - attack.t1087.001 - attack.t1552.001 - attack.t1005 logsource: product: cisco service: aaa detection: keywords: - show running-config - show startup-config - show archive config - more condition: keywords falsepositives: - Commonly run by administrators level: low
Near-miss passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened id: 00ba9da1-b510-4f6b-b258-8d338836180f status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename filter: TargetName|contains: \Temporary Internet Files\Content.Outlook condition: selection and not filter falsepositives: - Legitimate used of encrypted ZIP files level: medium
Query: alert when Detects potential RDP connection via Mstsc using a local ".rdp" file
Matching passage: Sigma rule: Detects potential RDP connection via Mstsc using a local ".rdp" file. Logsource: windows / process_creation. Rule: title: Mstsc.EXE Execution With Local RDP File id: 5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af status: test description: Detects potential RDP connection via Mstsc using a local ".rdp" file references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock date: 2023-04-18 modified: 2023-04-30 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|endswith: - .rdp - .rdp" filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Likely with legitimate usage of ".rdp" files level: low
Near-miss passage: Sigma rule: Detects a ProcessHacker tool that elevated privileges to a very high level. Logsource: windows / system. Rule: title: ProcessHacker Privilege Elevation id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 status: test description: Detects a ProcessHacker tool that elevated privileges to a very high level references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-12-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName|startswith: ProcessHacker AccountName: LocalSystem condition: selection falsepositives: - Unlikely level: high
Query: risk of Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memo
Matching passage: CVE-2015-6134. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6141.
Near-miss passage: CVE-2015-5579. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5567.
Query: risk of content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated wi
Matching passage: CVE-2015-1266. CWE: CWE-254. CVSS: 5.0. content/browser/webui/content_web_ui_controller_factory.cc in Google Chrome before 43.0.2357.130 does not properly consider the scheme in determining whether a URL is associated with a WebUI SiteInstance, which allows remote attackers to bypass intended access restrictions via a similar URL, as demonstrated by use of http://gpu when there is a WebUI class for handling chrome://gpu requests.
Near-miss passage: CVE-2015-3900. CWE: CWE-254. CVSS: 5.0. RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Query: CVE similar to CVE-2015-0708
Matching passage: CVE-2015-0708. CWE: CWE-399. CVSS: 6.099999904632568. Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.
Near-miss passage: CVE-2015-2339. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338.
Query: weakness Integer Coercion Error
Matching passage: CWE-192 Integer Coercion Error. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Near-miss passage: CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation. The product performs a power save/restore operation, but it does not ensure that the integrity of the configuration state is maintained and/or verified between the beginning and ending of the operation.
Query: vulnerability: The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Matching passage: CVE-2015-8747. CWE: CWE-20. CVSS: 10.0. The multifilesystem storage backend in Radicale before 1.1 allows remote attackers to read or write to arbitrary files via a crafted component name.
Near-miss passage: CVE-2015-8742. CWE: CWE-20. CVSS: 5.5. The dissect_CPMSetBindings function in epan/dissectors/packet-mswsp.c in the MS-WSP dissector in Wireshark 2.0.x before 2.0.1 does not validate the column size, which allows remote attackers to cause a denial of service (memory consumption or application crash) via a crafted packet.
Query: patch priority for CVE-2015-4947
Matching passage: CVE-2015-4947. CWE: CWE-119. CVSS: 9.0. Stack-based buffer overflow in the Administration Server in IBM HTTP Server 6.1.0.x through 6.1.0.47, 7.0.0.x before 7.0.0.39, 8.0.0.x before 8.0.0.12, and 8.5.x before 8.5.5.7, as used in WebSphere Application Server and other products, allows remote authenticated users to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-6585. CWE: CWE-119. CVSS: 7.800000190734863. hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray, and by leveraging a "type confusion" via an HWPX file containing a crafted para text tag.
Query: patch priority for CVE-2015-8269
Matching passage: CVE-2015-8269. CWE: CWE-287. CVSS: 7.5. The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence in an 802.11 network's coverage area and entering an account number.
Near-miss passage: CVE-2015-5298. CWE: CWE-287. CVSS: 6.5. The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
Query: alert when Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi
Matching passage: Sigma rule: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi. Logsource: windows / process_creation. Rule: title: Suspicious Recursive Takeown id: 554601fb-9b71-4bcc-abf4-21a611be4fde status: test description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility author: frack113 date: 2022-01-30 modified: 2022-11-21 tags: - attack.defense-impairment - attack.t1222.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \takeown.exe CommandLine|contains|all: - '/f ' - /r condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Existing Service Tampering id: 38879043-7e1e-47a9-8d46-6bec88e201df status: test description: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence. references: - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/ author: Sreeman date: 2020-09-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1543.003 - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_sc: - CommandLine|contains|all: - 'sc ' - 'config ' - binpath= - CommandLine|contains|all: - 'sc ' - failure - command= selection_reg_img: - CommandLine|contains|all: - 'reg ' - 'add ' - FailureCommand - CommandLine|contains|all: - 'reg ' - 'add ' - ImagePath selection_reg_ext: CommandLine|contains: - .sh - .exe - .dll - .bin$ - .bat - .cmd - .js - .msh$ - .reg$ - .scr - .ps - .vb - .jar - .pl condition: selection_sc or all of selection_reg_* falsepositives: - Unknown level: medium
Query: exploit Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vec
Matching passage: CVE-2015-0425. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Siebel Core - Unix/Windows.
Near-miss passage: CVE-2015-0340. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
Query: SOC alert related to Startup Items
Matching passage: T1037.005 Startup Items. Tactics: persistence, privilege escalation. Description: Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.(Citation: Startup Items) This is technically a deprecated technology (superseded by [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)), and thus the appropriate folder, <code>/Library/StartupItems</code> isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra. A startup item is a directory whose executable and configuration property list (plist), <code>StartupParameters.plist</code>, reside in the top-level directory. An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.(Citation: Methods of Mac Malware Persistence) Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.
Near-miss passage: T1037.001 Logon Script (Windows). Tactics: persistence, privilege escalation. Description: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence. Windows allows logon scripts to be run whenever a specific user or group of users log into a system.(Citation: TechNet Logon Scripts) This is done via adding a path to a script to the <code>HKCU\Environment\UserInitMprLogonScript</code> Registry key.(Citation: Hexacorn Logon Scripts) Adversaries may use these scripts to maintain persistence on a single system. Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.
Query: patch priority for CVE-2015-6165
Matching passage: CVE-2015-6165. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a different vulnerability than CVE-2015-6114.
Near-miss passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: Sigma YAML for linux / auditd
Matching passage: Sigma rule: Detects the start, reload or restart of a service.. Logsource: linux / auditd. Rule: title: Service Reload or Start - Linux id: 2625cc59-0634-40d0-821e-cb67382a3dd7 status: test description: Detects the start, reload or restart of a service. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.002/T1543.002.md author: Jakob Weinzettl, oscd.community, CheraghiMilad date: 2019-09-23 modified: 2025-03-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: - systemctl - service a1|contains: - reload - start condition: selection falsepositives: - Installation of legitimate service. - Legitimate reconfiguration of service. - Command line contains daemon-reload. level: low
Near-miss passage: Sigma rule: Detects when an attacker register a new SIP provider for persistence and defense evasion. Logsource: windows / registry_set. Rule: title: Persistence Via New SIP Provider id: 5a2b21ee-6aaa-4234-ac9d-59a59edf90a1 status: test description: Detects when an attacker register a new SIP provider for persistence and defense evasion references: - https://persistence-info.github.io/Data/codesigning.html - https://github.com/gtworek/PSBits/tree/master/SIP - https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1553.003 logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: - \SOFTWARE\Microsoft\Cryptography\Providers\ - \SOFTWARE\Microsoft\Cryptography\OID\EncodingType - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\ - \SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType selection_dll: TargetObject|contains: - \Dll - \$DLL filter: Details: - WINTRUST.DLL - mso.dll filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|contains: \CryptSIPDll Details: C:\Windows\System32\PsfSip.dll condition: all of selection_* and not 1 of filter* falsepositives: - Legitimate SIP being registered by the OS or different software. level: medium
Query: exploit Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect confidentiality via unknown vectors related to Login.
Matching passage: CVE-2015-0436. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect confidentiality via unknown vectors related to Login.
Near-miss passage: CVE-2015-0431. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0 6.3.1, 6.3.2, 6.3.4, and 6.3.5 allows remote attackers to affect integrity via unknown vectors related to UI Infrastructure.