alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: explain CWE-805
Matching passage: CWE-805 Buffer Access with Incorrect Length Value. The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
Near-miss passage: CWE-165 Improper Neutralization of Multiple Internal Special Elements. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes multiple internal special elements that could be interpreted in unexpected ways when they are sent to a downstream component.
Query: patch priority for CVE-2015-8531
Matching passage: CVE-2015-8531. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-1866. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Ember.js 1.10.x before 1.10.1 and 1.11.x before 1.11.2.
Query: exploit Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH key
Matching passage: CVE-2015-7511. CWE: CWE-200. CVSS: 2.0. Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: vulnerability: The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability 
Matching passage: CVE-2015-9282. CWE: CWE-79. CVSS: 6.099999904632568. The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.
Near-miss passage: CVE-2015-3005. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Dynamic VPN in Juniper Junos 12.1X44 before 12.1X44-D45, 12.1X46 before 12.1X46-D30, 12.1X47 before 12.1X47-D20, and 12.3X48 before 12.3X48-D10 on SRX series devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-4864
Matching passage: CVE-2015-4864. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-0395. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot.
Query: explain T1587 Develop Capabilities
Matching passage: T1587 Develop Capabilities. Tactics: resource development. Description: Adversaries may build capabilities that can be used during targeting. Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house. This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates. Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: Bitdefender StrongPity June 2020)(Citation: Talos Promethium June 2020) As with legitimate development efforts, different skill sets may be required for developing capabilities. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.
Near-miss passage: T1587.004 Exploits. Tactics: resource development. Description: Adversaries may develop exploits that can be used during targeting. An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software. Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.(Citation: NYTStuxnet) Adversaries may use information acquired via [Vulnerabilities](https://attack.mitre.org/techniques/T1588/006) to focus exploit development efforts. As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.(Citation: Irongeek Sims BSides 2017) As with legitimate development efforts, different skill sets may be required for developing exploits. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit. Adversaries may use exploits during various phases of the adversary lifecycle (i.e. [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190), [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203), [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068), [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211), [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212), [Exploitation of Remote Services](https://attack.mitre.org/techniques/T1210), and [Application or System Exploitation](https://attack.mitre.org/techniques/T1499/004)).
Query: exploit Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML 
Matching passage: CVE-2015-1366. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the image_user parameter.
Near-miss passage: CVE-2015-0727. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the HTTP module in Cisco Security Manager (CSM) 4.7(0)SP1(1) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCut27789.
Query: risk of Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Matching passage: CVE-2015-7935. CWE: CWE-200. CVSS: 7.5. Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-6127. CWE: CWE-200. CVSS: 4.300000190734863. Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary files via a crafted .mcl file, aka "Windows Media Center Information Disclosure Vulnerability."
Query: detection rule: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
Matching passage: Sigma rule: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script. Logsource: linux / process_creation. Rule: title: Triple Cross eBPF Rootkit Install Commands id: 22236d75-d5a0-4287-bf06-c93b1770860f status: test description: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 tags: - attack.stealth - attack.t1014 logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains|all: - ' tc ' - ' enp0s3 ' CommandLine|contains: - ' qdisc ' - ' filter ' condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unus. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed From A Suspicious Location id: 424273ea-7cf8-43a6-b712-375f925e481f status: test description: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|contains: - C:\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - C:\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: exploit Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks vi
Matching passage: CVE-2015-3393. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter.
Near-miss passage: CVE-2015-6470. CWE: UNKNOWN. CVSS: 5.5. Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
Query: patch priority for CVE-2015-0674
Matching passage: CVE-2015-0674. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Near-miss passage: CVE-2015-10119. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in View All Posts Page Plugin up to 0.9.0 on WordPress. This issue affects the function action_admin_notices_activation of the file view-all-posts-pages.php. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 0.9.1 is able to address this issue. The patch is named bf914f3a59063fa4df8fd4925ae18a5d852396d7. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-233363.
Query: patch priority for CVE-2015-2210
Matching passage: CVE-2015-2210. CWE: CWE-77. CVSS: 7.800000190734863. The help window in Epicor CRS Retail Store before 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.
Near-miss passage: CVE-2015-6912. CWE: CWE-77. CVSS: 10.0. Synology Video Station before 1.5-0763 allows remote attackers to execute arbitrary shell commands via shell metacharacters in the subtitle_codepage parameter to subtitle.cgi.
Query: rule covering Detects different hacktools used for relay attacks on Windows for privilege escalation
Matching passage: Sigma rule: Detects different hacktools used for relay attacks on Windows for privilege escalation. Logsource: windows / process_creation. Rule: title: Potential SMB Relay Attack Tool Execution id: 5589ab4f-a767-433c-961d-c91f3f704db1 status: test description: Detects different hacktools used for relay attacks on Windows for privilege escalation references: - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://pentestlab.blog/2017/04/13/hot-potato/ - https://github.com/ohpe/juicy-potato - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire - https://www.localpotato.com/ author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection_pe: Image|contains: - PetitPotam - RottenPotato - HotPotato - JuicyPotato - \just_dce_ - Juicy Potato - \temp\rot.exe - \Potato.exe - \SpoolSample.exe - \Responder.exe - \smbrelayx - \ntlmrelayx - \LocalPotato selection_script: CommandLine|contains: - Invoke-Tater - ' smbrelay' - ' ntlmrelay' - 'cme smb ' - ' /ntlm:NTLMhash ' - Invoke-PetitPotam - '.exe -t * -p ' selection_juicypotato_enum: CommandLine|contains: .exe -c "{ CommandLine|endswith: '}" -z' filter_hotpotatoes: Image|contains: - HotPotatoes6 - HotPotatoes7 - 'HotPotatoes ' condition: 1 of selection_* and not 1 of filter_* falsepositives: - Legitimate files with these rare hacktool names level: critical
Near-miss passage: Sigma rule: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permission. Logsource: windows / ps_script. Rule: title: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript id: e2812b49-bae0-4b21-b366-7c142eafcde2 status: test description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script references: - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85) author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-13 tags: - attack.defense-impairment logsource: category: ps_script product: windows definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_class: ScriptBlockText|contains: Win32_NTEventlogFile selection_function: ScriptBlockText|contains: - .BackupEventlog( - .ChangeSecurityPermissions( - .ChangeSecurityPermissionsEx( - .ClearEventLog( - .Delete( - .DeleteEx( - .Rename( - .TakeOwnerShip( - .TakeOwnerShipEx( condition: all of selection_* falsepositives: - Legitimate administration and backup scripts level: medium
Query: Sigma rule for Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port
Matching passage: Sigma rule: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon port. Logsource: windows / network_connection. Rule: title: Office Application Initiated Network Connection Over Uncommon Ports id: 3b5ba899-9842-4bc2-acc2-12308498bf42 status: test description: Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-12 modified: 2025-10-17 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \excel.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wordview.exe filter_main_common_ports: DestinationPort: - 53 - 80 - 139 - 389 - 443 - 445 - 3268 filter_main_outlook_ports: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \OUTLOOK.EXE DestinationPort: - 143 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / file_event. Rule: title: UAC Bypass Using Windows Media Player - File id: 68578b43-65df-4f81-9a9b-92f32711a951 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection1: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\OskSupport.dll selection2: Image: C:\Windows\system32\DllHost.exe TargetFilename: C:\Program Files\Windows Media Player\osk.exe condition: 1 of selection* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0081
Matching passage: CVE-2015-0081. CWE: CWE-19. CVSS: 9.300000190734863. Windows Text Services (WTS) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "WTS Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-0274. CWE: CWE-19. CVSS: 7.199999809265137. The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
Query: common weakness: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
Matching passage: CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking. The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.
Near-miss passage: CWE-1051 Initialization with Hard-Coded Network Resource Configuration Data. The product initializes data using hard-coded values that act as network resource identifiers.
Query: vulnerability: SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Pr
Matching passage: CVE-2015-8157. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5, Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1, Critical System Protection (SCSP) before 5.2.9 MP6, Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1, and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-10054. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in githuis P2Manage. This affects the function Execute of the file PTwoManage/Database.cs. The manipulation of the argument sql leads to sql injection. The identifier of the patch is 717380aba80002414f82d93c770035198b7858cc. It is recommended to apply a patch to fix this issue. The identifier VDB-218397 was assigned to this vulnerability.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that del
Matching passage: CVE-2015-4353. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors.
Near-miss passage: CVE-2015-2134. CWE: CWE-352. CVSS: 6.0. Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.5.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that ma. Logsource: windows / ps_script. Rule: title: Suspicious Invoke-Item From Mount-DiskImage id: 902cedee-0398-4e3a-8183-6f3a89773a96 status: test description: Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps author: frack113 date: 2022-02-01 tags: - attack.defense-impairment - attack.t1553.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Mount-DiskImage ' - '-ImagePath ' - Get-Volume - .DriveLetter - 'invoke-item ' - ):\ condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-2192
Matching passage: CVE-2015-2192. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_osd2_cdb_continuation function in epan/dissectors/packet-scsi-osd.c in the SCSI OSD dissector in Wireshark 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Near-miss passage: CVE-2015-3809. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.