alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-0094
Matching passage: CVE-2015-0094. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly restrict the availability of address information during a function call, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability."
Near-miss passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: actor TTPs: Gatekeeper Bypass
Matching passage: T1553.001 Gatekeeper Bypass. Tactics: defense impairment. Description: Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apple’s security model to ensure only trusted applications are executed on a host. Gatekeeper was built on top of File Quarantine in Snow Leopard (10.6, 2009) and has grown to include Code Signing, security policy compliance, Notarization, and more. Gatekeeper also treats applications running for the first time differently than reopened applications.(Citation: TheEclecticLightCompany Quarantine and the flag)(Citation: TheEclecticLightCompany apple notarization ) Based on an opt-in system, when files are downloaded an extended attribute (xattr) called `com.apple.quarantine` (also known as a quarantine flag) can be set on the file by the application performing the download. Launch Services opens the application in a suspended state. For first run applications with the quarantine flag set, Gatekeeper executes the following functions: 1. Checks extended attribute – Gatekeeper checks for the quarantine flag, then provides an alert prompt to the user to allow or deny execution.(Citation: OceanLotus for OS X)(Citation: 20 macOS Common Tools and Techniques) 2. Checks System Policies - Gatekeeper checks the system security policy, allowing execution of apps downloaded from either just the App Store or the App Store and identified developers. 3. Code Signing – Gatekeeper checks for a valid code signature from an Apple Developer ID. 4. Notarization - Using the `api.apple-cloudkit.com` API, Gatekeeper reaches out to Apple servers to verify or pull down the notarization ticket and ensure the ticket is not revoked. Users can override notarization, which will result in a prompt of executing an “unauthorized app” and the security policy will be modified. Adversaries can subvert one or multiple security controls within Gatekeeper checks through logic errors (e.g. [Exploitation for Stealth](https://a
Near-miss passage: T1553.002 Code Signing. Tactics: defense impairment. Description: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. (Citation: Wikipedia Code Signing) The certificates used during an operation may be created, acquired, or stolen by the adversary. (Citation: Securelist Digital Certificates) (Citation: Symantec Digital Certificates) Unlike [Invalid Code Signature](https://attack.mitre.org/techniques/T1036/001), this activity will result in a valid signature. Code signing to verify software on first run can be used on modern Windows and macOS systems. It is not used on Linux due to the decentralized nature of the platform. (Citation: Wikipedia Code Signing)(Citation: EclecticLightChecksonEXECodeSigning) Code signing certificates may be used to bypass security policies that require signed code to execute on a system.
Query: secure coding against Authorization Bypass Through User-Controlled Key
Matching passage: CWE-639 Authorization Bypass Through User-Controlled Key. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Near-miss passage: CWE-28 Path Traversal: '..filedir'. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize .. sequences that can resolve to a location that is outside of that directory.
Query: CWE for ASP.NET Misconfiguration: Not Using Input Validation Framework
Matching passage: CWE-554 ASP.NET Misconfiguration: Not Using Input Validation Framework. The ASP.NET application does not use an input validation framework.
Near-miss passage: CWE-669 Incorrect Resource Transfer Between Spheres. The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
Query: secure coding against Cross-Site Request Forgery (CSRF)
Matching passage: CWE-352 Cross-Site Request Forgery (CSRF). The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Near-miss passage: CWE-777 Regular Expression without Anchors. The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may allow malicious or malformed data to slip through.
Query: risk of NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.
Matching passage: CVE-2015-7886. CWE: CWE-200. CVSS: 3.700000047683716. NetApp Data ONTAP before 8.2.4P1, when 7-Mode and HTTP access are enabled, allows remote attackers to obtain sensitive volume information via unspecified vectors.
Near-miss passage: CVE-2015-8553. CWE: CWE-200. CVSS: 6.5. Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
Query: exploit The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspe
Matching passage: CVE-2015-6355. CWE: CWE-200. CVSS: 5.0. The web interface in Cisco Unified Computing System (UCS) 2.2(5b)A on blade servers allows remote attackers to obtain potentially sensitive version information by visiting an unspecified URL, aka Bug ID CSCuw87226.
Near-miss passage: CVE-2015-7827. CWE: CWE-200. CVSS: 7.5. Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time differences, related to decoding of PKCS#1 padding.
Query: explain CWE-432
Matching passage: CWE-432 Dangerous Signal Handler not Disabled During Sensitive Operations. The product uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.
Near-miss passage: CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection'). The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
Query: risk of A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview o
Matching passage: CVE-2015-10077. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in webbuilders-group silverstripe-kapost-bridge 0.3.3. It has been declared as critical. Affected by this vulnerability is the function index/getPreview of the file code/control/KapostService.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 0.4.0 is able to address this issue. The patch is named 2e14b0fd0ea35034f90890f364b130fb4645ff35. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220471.
Near-miss passage: CVE-2015-4118. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in monitor/show_sys_state.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2.
Query: risk of Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200R005SPH008; S2350EI a
Matching passage: CVE-2015-8677. CWE: CWE-399. CVSS: 6.5. Memory leak in Huawei S5300EI, S5300SI, S5310HI, and S6300EI Campus series switches with software V200R003C00 before V200R003SPH011 and V200R005C00 before V200R005SPH008; S2350EI and S5300LI Campus series switches with software V200R003C00 before V200R003SPH011, V200R005C00 before V200R005SPH008, and V200R006C00 before V200R006SPH002; S9300, S7700, and S9700 Campus series switches with software V200R003C00 before V200R003SPH011, V200R005C00 before V200R005SPH009, and V200R006C00 before V200R006SPH003; S5720HI and S5720EI Campus series switches with software V200R006C00 before V200R006SPH002; and S2300 and S3300 Campus series switches with software V100R006C05 before V100R006SPH022 allows remote authenticated users to cause a denial of service (memory consumption and device restart) by logging in and out of the (1) HTTPS or (2) SFTP server, related to SSL session information.
Near-miss passage: CVE-2015-0202. CWE: CWE-399. CVSS: 7.800000190734863. The mod_dav_svn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.
Query: describe CVE-2015-7512
Matching passage: CVE-2015-7512. CWE: CWE-120. CVSS: 9.0. Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of service (guest OS crash) or execute arbitrary code via a large packet.
Near-miss passage: CVE-2015-10065. CWE: CWE-120. CVSS: 9.800000190734863. A vulnerability classified as critical was found in AenBleidd FiND. This vulnerability affects the function init_result of the file validator/my_validator.cpp. The manipulation leads to buffer overflow. The patch is identified as ee2eef34a83644f286c9adcaf30437f92e9c48f1. It is recommended to apply a patch to fix this issue. VDB-218458 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-8416
Matching passage: CVE-2015-8416. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.
Near-miss passage: CVE-2015-1000. CWE: CWE-119. CVSS: 6.800000190734863. Stack-based buffer overflow in the OpenForIPCamTest method in the RTSPVIDEO.rtspvideoCtrl.1 (aka SStreamVideo) ActiveX control in Moxa SoftCMS before 1.3 allows remote attackers to execute arbitrary code via the StrRtspPath parameter.
Query: vulnerability: Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechan
Matching passage: CVE-2015-6358. CWE: CWE-295. CVSS: 5.900000095367432. Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
Near-miss passage: CVE-2015-7785. CWE: CWE-295. CVSS: 5.900000095367432. GANMA! App for iOS does not verify SSL certificates.
Query: CVE similar to CVE-2015-10070
Matching passage: CVE-2015-10070. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in copperwall Twiddit. It has been rated as critical. This issue affects some unknown processing of the file index.php. The manipulation leads to sql injection. The identifier of the patch is 2203d4ce9810bdaccece5c48ff4888658a01acfc. It is recommended to apply a patch to fix this issue. The identifier VDB-218897 was assigned to this vulnerability.
Near-miss passage: CVE-2015-4658. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in admin/login.php in Milw0rm Clone Script 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) usr or (2) pwd parameter.
Query: weakness Use of Singleton Pattern Without Synchronization in a Multithreaded Context
Matching passage: CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
Near-miss passage: CWE-827 Improper Control of Document Type Definition. The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
Query: rule covering Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Matching passage: Sigma rule: Detects instances where an SNMP service on an OpenCanary node has had an OID request.. Logsource: opencanary / application. Rule: title: OpenCanary - SNMP OID Request id: e9856028-fd4e-46e6-b3d1-10f7ceb95078 status: test description: Detects instances where an SNMP service on an OpenCanary node has had an OID request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.discovery - attack.lateral-movement - attack.t1016 - attack.t1021 logsource: category: application product: opencanary detection: selection: logtype: 13001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system pe. Logsource: windows / ps_module. Rule: title: Suspicious Get Local Groups Information id: cef24b90-dddc-4ae1-a09a-8764872f69fc related: - id: fa6a5a45-3ee2-4529-aa14-ee5edc9e29cb type: similar status: test description: 'Detects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md author: frack113 date: 2021-12-12 modified: 2025-08-22 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_localgroup: - Payload|contains: - 'get-localgroup ' - 'get-localgroupmember ' - ContextInfo|contains: - 'get-localgroup ' - 'get-localgroupmember ' selection_wmi_module: - Payload|contains: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' - ContextInfo|contains|all: - 'get-wmiobject ' - 'gwmi ' - 'get-ciminstance ' - 'gcim ' selection_wmi_class: - Payload|contains: win32_group - ContextInfo|contains: win32_group condition: selection_localgroup or all of selection_wmi_* falsepositives: - Administrator script level: low
Query: exploit TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of other editors via unspecified vectors.
Matching passage: CVE-2015-2821. CWE: CWE-264. CVSS: 6.5. TYPO3 Neos 1.1.x before 1.1.3 and 1.2.x before 1.2.3 allows remote editors to access, create, and modify content nodes in the workspace of other editors via unspecified vectors.
Near-miss passage: CVE-2015-3083. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3085.
Query: alert when Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory
Matching passage: Sigma rule: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory. Logsource: windows / process_creation. Rule: title: HackTool - Dumpert Process Dumper Execution id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 status: test description: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2025-01-22 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690 - CommandLine|contains: Dumpert.dll condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. In it's default mode, it builds a self. Logsource: windows / file_event. Rule: title: HackTool - Powerup Write Hijack DLL id: 602a1f13-c640-4d73-b053-be9a2fa58b96 status: test description: 'Powerup tool''s Write Hijack DLL exploits DLL hijacking for privilege escalation. In it''s default mode, it builds a self deleting .bat file which executes malicious command. The detection rule relies on creation of the malicious bat file (debug.bat by default). ' references: - https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/ author: Subhash Popuri (@pbssubhash) date: 2021-08-21 modified: 2024-06-27 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe TargetFilename|endswith: .bat condition: selection falsepositives: - Any powershell script that creates bat files level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the displa
Matching passage: CVE-2015-7242. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message.
Near-miss passage: CVE-2015-7796. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7797, CVE-2015-7798, CVE-2016-1149, and CVE-2016-1150.
Query: exploit The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE elem
Matching passage: CVE-2015-0803. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
Near-miss passage: CVE-2015-8577. CWE: CWE-264. CVSS: 2.5999999046325684. The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Query: vulnerability: Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unknown vectors.
Matching passage: CVE-2015-3048. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-5950. CWE: CWE-119. CVSS: 6.900000095367432. The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.