alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availabil
Matching passage: CVE-2015-4759. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, and CVE-2015-4758.
Near-miss passage: CVE-2015-0338. CWE: UNKNOWN. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.
Query: patch priority for CVE-2015-10130
Matching passage: CVE-2015-10130. CWE: CWE-352. CVSS: 4.300000190734863. The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Near-miss passage: CVE-2015-5397. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload code via unknown vectors.
Query: describe CVE-2015-9431
Matching passage: CVE-2015-9431. CWE: CWE-352. CVSS: 6.5. The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Near-miss passage: CVE-2015-4397. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors.
Query: vulnerability: The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which allows attackers to gain privileges via a
Matching passage: CVE-2015-8938. CWE: CWE-264. CVSS: 7.800000190734863. The MSM camera driver in the Qualcomm components in Android before 2016-08-05 on Nexus 6 devices does not validate input parameters, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28804030 and Qualcomm internal bug CR766022.
Near-miss passage: CVE-2015-3164. CWE: CWE-264. CVSS: 3.5999999046325684. The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Query: alert when Identifies when DNS zone is modified or deleted.
Matching passage: Sigma rule: Identifies when DNS zone is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure DNS Zone Modified or Deleted id: af6925b0-8826-47f1-9324-337507a0babd status: test description: Identifies when DNS zone is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact - attack.t1565.001 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: MICROSOFT.NETWORK/DNSZONES operationName|endswith: - /WRITE - /DELETE condition: selection falsepositives: - DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / system. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - System id: 175997c5-803c-4b08-8bb0-70b099f47595 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - new-object - text.encoding]::ascii - readtoend ImagePath|contains: - :system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium
Query: risk of The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attacke
Matching passage: CVE-2015-3824. CWE: CWE-119. CVSS: 10.0. The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261.
Near-miss passage: CVE-2015-7177. CWE: CWE-119. CVSS: 7.5. The InitTextures function in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 might allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via unknown vectors.
Query: secure coding against Improper Resource Locking
Matching passage: CWE-413 Improper Resource Locking. The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
Near-miss passage: CWE-326 Inadequate Encryption Strength. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Query: patch priority for CVE-2015-0276
Matching passage: CVE-2015-0276. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
Near-miss passage: CVE-2015-3370. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors.
Query: describe CVE-2015-1578
Matching passage: CVE-2015-1578. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) pidvesa cookie to u5admin/pidvesa.php or (2) uri parameter to u5admin/meta2.php.
Near-miss passage: CVE-2015-0412. CWE: UNKNOWN. CVSS: 7.199999809265137. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS.
Query: CVE similar to CVE-2015-2141
Matching passage: CVE-2015-2141. CWE: CWE-200. CVSS: 5.0. The InvertibleRWFunction::CalculateInverse function in rw.cpp in libcrypt++ 5.6.2 does not properly blind private key operations for the Rabin-Williams digital signature algorithm, which allows remote attackers to obtain private keys via a timing attack.
Near-miss passage: CVE-2015-0527. CWE: CWE-200. CVSS: 2.0999999046325684. EMC Documentum xCelerated Management System (xMS) 1.1 before P14 stores cleartext Windows Service credentials in a batch file during Documentum Platform and xCelerated Composition Platform (xCP) provisioning, which allows local users to obtain sensitive information by reading a file.
Query: CVE similar to CVE-2015-6827
Matching passage: CVE-2015-6827. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentication of users for requests that change a password via a request to signup.php.
Near-miss passage: CVE-2015-0651. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
Query: exploit FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-7010. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Near-miss passage: CVE-2015-5094. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Query: detection rule: Detects persistence registry keys for Recycle Bin
Matching passage: Sigma rule: Detects persistence registry keys for Recycle Bin. Logsource: windows / registry_event. Rule: title: Registry Persistence Mechanisms in Recycle Bin id: 277efb8f-60be-4f10-b4d3-037802f37167 status: test description: Detects persistence registry keys for Recycle Bin references: - https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf - https://persistence-info.github.io/Data/recyclebin.html - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ author: frack113 date: 2021-11-18 modified: 2022-12-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection_create: EventType: RenameKey NewName|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open selection_set: EventType: SetValue TargetObject|contains: \CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\open\command\(Default) condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies user activities originating from geographically distant locations within a time period shorter than the time. Logsource: azure / riskdetection. Rule: title: Impossible Travel id: b2572bf9-e20a-4594-b528-40bde666525a status: test description: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: impossibleTravel condition: selection falsepositives: - Connecting to a VPN, performing activity and then dropping and performing additional activity. level: high
Query: risk of libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
Matching passage: CVE-2015-3886. CWE: CWE-295. CVSS: 9.800000190734863. libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-2330. CWE: CWE-295. CVSS: 7.5. Late TLS certificate verification in WebKitGTK+ prior to 2.6.6 allows remote attackers to view a secure HTTP request, including, for example, secure cookies.
Query: detect Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to o in logs
Matching passage: Sigma rule: Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to o. Logsource: windows / process_creation. Rule: title: Change Default File Association Via Assoc id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061 related: - id: ae6f14e6-14de-45b0-9f44-c0986f50dc89 type: similar status: test description: 'Detects file association changes using the builtin "assoc" command. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.001/T1546.001.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2023-03-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains: assoc condition: all of selection_* falsepositives: - Admin activity level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_assoc_execution/info.yml
Near-miss passage: Sigma rule: Detects an executable that isn't dropbox but communicates with the Dropbox API. Logsource: windows / network_connection. Rule: title: Suspicious Dropbox API Usage id: 25eabf56-22f0-4915-a1ed-056b8dae0a68 status: test description: Detects an executable that isn't dropbox but communicates with the Dropbox API references: - https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb - https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east author: Florian Roth (Nextron Systems) date: 2022-04-20 tags: - attack.command-and-control - attack.exfiltration - attack.t1105 - attack.t1567.002 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - api.dropboxapi.com - content.dropboxapi.com filter_main_legit_dropbox: Image|contains: \Dropbox condition: selection and not 1 of filter_main_* falsepositives: - Legitimate use of the API with a tool that the author wasn't aware of level: high
Query: risk of Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, in
Matching passage: CVE-2015-0392. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in the Siebel Core - Server BizLogic Script component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Config - Scripting.
Near-miss passage: CVE-2015-0497. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the PeopleSoft Enterprise Portal Interaction Hub component in Oracle PeopleSoft Products 9.1.00 allows remote attackers to affect integrity via unknown vectors related to Enterprise Portal.
Query: CVE similar to CVE-2015-9434
Matching passage: CVE-2015-9434. CWE: CWE-352. CVSS: 6.5. The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings tab or tab_flags_order parameter.
Near-miss passage: CVE-2015-5999. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DIR-816L Wireless Router with firmware before 2.06.B09_BETA allow remote attackers to hijack the authentication of administrators for requests that (1) change the admin password, (2) change the network policy, or (3) possibly have other unspecified impact via crafted requests to hedwig.cgi and pigwidgeon.cgi.
Query: rule covering Detects a service installed by a client which has PID 0 or whose parent has PID 0
Matching passage: Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / system. Rule: title: Service Installed By Unusual Client - System id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 related: - id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ProcessId: 0 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PowerShell scripts set ACL to of a file or a folder. Logsource: windows / ps_script. Rule: title: PowerShell Script Change Permission Via Set-Acl - PsScript id: cae80281-ef23-44c5-873b-fd48d2666f49 related: - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts set ACL to of a file or a folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-0116
Matching passage: CVE-2015-0116. CWE: CWE-74. CVSS: 3.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Near-miss passage: CVE-2015-3200. CWE: CWE-74. CVSS: 7.5. mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Query: patch priority for CVE-2015-8252
Matching passage: CVE-2015-8252. CWE: CWE-200. CVSS: 5.900000095367432. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sends a cleartext serial number, which allows remote attackers to determine a hardcoded key by sniffing the network and performing a "jumbled up" calculation with this number.
Near-miss passage: CVE-2015-5041. CWE: CWE-200. CVSS: 9.100000381469727. The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
Query: rule covering A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator
Matching passage: Sigma rule: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator. Logsource: zeek / http. Rule: title: WebDav Put Request id: 705072a5-bb6f-4ced-95b6-ecfa6602090b status: test description: A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/17 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-03-13 tags: - attack.exfiltration - attack.t1048.003 logsource: product: zeek service: http detection: selection: user_agent|contains: WebDAV method: PUT filter: id.resp_h|cidr: - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 condition: selection and not filter falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take. Logsource: windows / ps_script. Rule: title: Replace Desktop Wallpaper by Powershell id: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287 status: test description: 'An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md author: frack113 date: 2021-12-26 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_1: ScriptBlockText|contains|all: - Get-ItemProperty - 'Registry::' - HKEY_CURRENT_USER\Control Panel\Desktop\ - WallPaper selection_2: ScriptBlockText|contains: SystemParametersInfo(20,0,*,3) condition: 1 of selection_* falsepositives: - Unknown level: low
Query: exploit The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environmen
Matching passage: CVE-2015-1862. CWE: CWE-362. CVSS: 7.0. The crash reporting feature in Abrt allows local users to gain privileges by leveraging an execve by root after a chroot into a user-specified directory in a namedspaced environment.
Near-miss passage: CVE-2015-7543. CWE: CWE-362. CVSS: 7.0. aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.