alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Matching passage: CVE-2015-7571. CWE: CWE-434. CVSS: 7.800000190734863. Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
Near-miss passage: CVE-2015-9339. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.
Query: describe CVE-2015-0223
Matching passage: CVE-2015-0223. CWE: CWE-264. CVSS: 5.0. Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling.
Near-miss passage: CVE-2015-6607. CWE: CWE-264. CVSS: 6.800000190734863. SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
Query: vulnerability: The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with soft
Matching passage: CVE-2015-7843. CWE: CWE-254. CVSS: 8.800000190734863. The management interface on Huawei FusionServer rack servers RH2288 V3 with software before V100R003C00SPC603, RH2288H V3 with software before V100R003C00SPC503, XH628 V3 with software before V100R003C00SPC602, RH1288 V3 with software before V100R003C00SPC602, RH2288A V2 with software before V100R002C00SPC701, RH1288A V2 with software before V100R002C00SPC502, RH8100 V3 with software before V100R003C00SPC110, CH222 V3 with software before V100R001C00SPC161, CH220 V3 with software before V100R001C00SPC161, and CH121 V3 with software before V100R001C00SPC161 does not limit the number of query attempts, which allows remote authenticated users to obtain credentials of higher-level users via a brute force attack.
Near-miss passage: CVE-2015-5850. CWE: CWE-254. CVSS: 2.0999999046325684. AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device backup.
Query: exploit Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obt
Matching passage: CVE-2015-4928. CWE: CWE-200. CVSS: 4.300000190734863. Apache Ambari before 2.1, as used in IBM Infosphere BigInsights 4.x before 4.1, includes cleartext passwords on a Configs screen, which allows physically proximate attackers to obtain sensitive information by reading password fields.
Near-miss passage: CVE-2015-1800. CWE: CWE-200. CVSS: 7.5. The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects creation of a scheduled task with a GUID like name. Logsource: windows / process_creation. Rule: title: Suspicious Scheduled Task Name As GUID id: ff2fff64-4cd6-4a2b-ba7d-e28a30bbe66b status: test description: Detects creation of a scheduled task with a GUID like name references: - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: Image|endswith: \schtasks.exe CommandLine|contains: '/Create ' selection_tn: CommandLine|contains: - /TN "{ - /TN '{ - /TN { selection_end: CommandLine|contains: - '}"' - '}''' - '} ' condition: all of selection_* falsepositives: - Legitimate software naming their tasks as GUIDs level: medium
Near-miss passage: Sigma rule: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment. Logsource: windows / process_creation. Rule: title: PUA - AdFind.EXE Execution id: 514e7e3e-b3b4-4a67-af60-be20f139198b related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar status: experimental description: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment references: - https://www.joeware.net/freetools/tools/adfind/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-26 tags: - attack.discovery - attack.t1087.002 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \AdFind.exe - OriginalFileName: AdFind.exe - Hashes|contains: - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=bca5675746d13a1f246e2da3c2217492 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=53e117a96057eaf19c41380d0e87f1c2 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml
Query: describe CVE-2015-7259
Matching passage: CVE-2015-7259. CWE: CWE-255. CVSS: 8.800000190734863. ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs.
Near-miss passage: CVE-2015-8673. CWE: CWE-255. CVSS: 6.800000190734863. Huawei TE30, TE40, TE50, and TE60 multimedia video conferencing endpoints with software before V100R001C10SPC100 do not require entry of the old password when changing the password for the Debug account, which allows physically proximate attackers to change the password by leveraging an unattended workstation.
Query: exploit WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5794. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2493. CWE: CWE-119. CVSS: 9.300000190734863. The (1) VBScript and (2) JScript engines in Microsoft Internet Explorer 8 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and. Logsource: windows / ps_script. Rule: title: Potential Suspicious Windows Feature Enabled id: 55c925c1-7195-426b-a136-a9396800e29b related: - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918 type: similar status: test description: 'Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system - https://learn.microsoft.com/en-us/windows/wsl/install-on-server author: frack113 date: 2022-09-10 modified: 2022-12-29 tags: - attack.stealth logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Enable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - TelnetServer - Internet-Explorer-Optional-amd64 - TFTP - SMB1Protocol - Client-ProjFS - Microsoft-Windows-Subsystem-Linux condition: all of selection_* falsepositives: - Legitimate usage of the features listed in the rule. level: medium
Near-miss passage: Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Query: describe CVE-2015-5409
Matching passage: CVE-2015-5409. CWE: CWE-119. CVSS: 7.5. Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-3664. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
Query: intelligence brief on T1133
Matching passage: T1133 External Remote Services. Tactics: persistence, initial access. Description: Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006) and [VNC](https://attack.mitre.org/techniques/T1021/005) can also be used externally.(Citation: MacOS VNC software for Remote Desktop) Access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.(Citation: Volexity Virtual Private Keylogging) Access to remote services may be used as a redundant or persistent access mechanism during an operation. Access may also be gained through an exposed service that doesn’t require authentication. In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.(Citation: Trend Micro Exposed Docker Server)(Citation: Unit 42 Hildegard Malware) Adversaries may also establish persistence on network by configuring a Tor hidden service on a compromised system. Adversaries may utilize the tool `ShadowLink` to facilitate the installation and configuration of the Tor hidden service. Tor hidden service is then accessible via the Tor network because `ShadowLink` sets up a .onion address on the compromised system. `ShadowLink` may be used to forward any inbound connections to RDP, allowing the adversaries to have remote access.(Citation: The BadPilot campaign) Adversaries may get `ShadowLink` to persist on a system by masquerading it as an MS Defender application.(Citation: Russian threat actors dig in,
Near-miss passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Query: patch priority for CVE-2015-1834
Matching passage: CVE-2015-1834. CWE: CWE-22. CVSS: 6.5. A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic Runtime versions prior to 1.4.2. Path traversal is the 'outbreak' of a given directory structure through relative file paths in the user input. It aims at accessing files and directories that are stored outside the web root folder, for disallowed reading or even executing arbitrary system commands. An attacker could use a certain parameter of the file path for instance to inject '../' sequences in order to navigate through the file system. In this particular case a remote authenticated attacker can exploit the identified vulnerability in order to upload arbitrary files to the server running a Cloud Controller instance - outside the isolated application container.
Near-miss passage: CVE-2015-7780. CWE: CWE-22. CVSS: 6.5. Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0.
Query: CVE similar to CVE-2015-5943
Matching passage: CVE-2015-5943. CWE: CWE-254. CVSS: 4.300000190734863. SecurityAgent in Apple OS X before 10.11.1 does not prevent synthetic clicks from reaching keychain windows, which allows attackers to bypass intended access restrictions via a crafted app.
Near-miss passage: CVE-2015-8615. CWE: CWE-254. CVSS: 5.0. The hvm_set_callback_via function in arch/x86/hvm/irq.c in Xen 4.6 does not limit the number of printk console messages when logging the new callback method, which allows local HVM guest OS users to cause a denial of service via a large number of changes to the callback method (HVM_PARAM_CALLBACK_IRQ).
Query: Sigma rule for Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
Matching passage: Sigma rule: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.. Logsource: windows / file_event. Rule: title: Process Monitor Driver Creation By Non-Sysinternals Binary id: a05baa88-e922-4001-bc4d-8738135f27de status: test description: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \procmon TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procmon.exe - \procmon64.exe - \procmon64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process monitor binaries level: medium
Near-miss passage: Sigma rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto. Logsource: windows / file_access. Rule: title: Access To Crypto Currency Wallets By Uncommon Applications id: f41b0311-44f9-44f0-816d-dd45e39d4bc8 status: test description: 'Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2024-07-29 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: - FileName|contains: - \AppData\Roaming\Ethereum\keystore\ - \AppData\Roaming\EthereumClassic\keystore\ - \AppData\Roaming\monero\wallets\ - FileName|endswith: - \AppData\Roaming\Bitcoin\wallet.dat - \AppData\Roaming\BitcoinABC\wallet.dat - \AppData\Roaming\BitcoinSV\wallet.dat - \AppData\Roaming\DashCore\wallet.dat - \AppData\Roaming\DogeCoin\wallet.dat - \AppData\Roaming\Litecoin\wallet.dat - \AppData\Roaming\Ripple\wallet.dat - \AppData\Roaming\Zcash\wallet.dat filter_main_system: Image: System filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_optional_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\ Image|endswith: - \MpCopyAccelerator.exe - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Antivirus, Anti-Spyware, Anti-Malware Software - Backup software - Legitimate software installed on partitions other than "C:\" - Searching software such as "everything.exe" level: medium
Query: explain CWE-5
Matching passage: CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption. Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
Near-miss passage: CWE-1277 Firmware Not Updateable. The product does not provide its users with the ability to update or patch its firmware to address any vulnerabilities or weaknesses that may be present.
Query: patch priority for CVE-2015-1263
Matching passage: CVE-2015-1263. CWE: CWE-17. CVSS: 4.300000190734863. The Spellcheck API implementation in Google Chrome before 43.0.2357.65 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file.
Near-miss passage: CVE-2015-1224. CWE: CWE-17. CVSS: 5.0. The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.
Query: patch priority for CVE-2015-9250
Matching passage: CVE-2015-9250. CWE: CWE-22. CVSS: 7.5. An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmentdownload and /skyboxview/webskybox/filedownload via the tempFileName parameter.
Near-miss passage: CVE-2015-10024. CWE: CWE-22. CVSS: 9.800000190734863. A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
Query: CVE similar to CVE-2015-5548
Matching passage: CVE-2015-5548. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Near-miss passage: CVE-2015-5290. CWE: CWE-119. CVSS: 7.5. A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
Query: Encoded PowerShell / command-line abuse matching Domain Generation Algorithms
Matching passage: T1568.002 Domain Generation Algorithms. Tactics: command and control. Description: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains. This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Unit 42 DGA Feb 2019) DGAs can take the form of apparently random or “gibberish” strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter. Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net). Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc). Others incorporate a seed value as well to make predicting future domains more difficult for defenders.(Citation: Cybereason Dissecting DGAs)(Citation: Cisco Umbrella DGA)(Citation: Talos CCleanup 2017)(Citation: Akamai DGA Mitigation) Adversaries may use DGAs for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Near-miss passage: T1568 Dynamic Resolution. Tactics: command and control. Description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control. Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
Query: CVE similar to CVE-2015-6308
Matching passage: CVE-2015-6308. CWE: CWE-399. CVSS: 4.0. Cisco NX-OS 6.0(2)U6(0.46) on N3K devices allows remote authenticated users to cause a denial of service (temporary SNMP outage) via an SNMP request for an OID that does not exist, aka Bug ID CSCuw36684.
Near-miss passage: CVE-2015-8087. CWE: CWE-399. CVSS: 5.0. Huawei NE20E-S, NE40E-M, and NE40E-M2 routers with software before V800R007C10SPC100 and NE40E and NE80E routers with software before V800R007C00SPC100 allows remote attackers to send packets to other VPNs and conduct flooding attacks via a crafted MPLS forwarding packet, aka a "VPN routing and forwarding (VRF) hopping vulnerability."