alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects a remote DLL load event via "rundll32.exe".
Matching passage: Sigma rule: Detects a remote DLL load event via "rundll32.exe".. Logsource: windows / image_load. Rule: title: Remote DLL Load Via Rundll32.EXE id: f40017b3-cb2e-4335-ab5d-3babf679c1de status: test description: Detects a remote DLL load event via "rundll32.exe". references: - https://github.com/gabe-k/themebleed - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-18 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: \rundll32.exe ImageLoaded|startswith: \\\\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin at. Logsource: windows / process_creation. Rule: title: Suspicious Usage Of ShellExec_RunDLL id: d87bd452-6da1-456e-8155-7dc988157b7d related: - id: 36c5146c-d127-4f85-8e21-01bf62355d5a type: obsolete - id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 type: similar status: test description: Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2022-12-30 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_openasrundll: CommandLine|contains: ShellExec_RunDLL selection_suspcli: CommandLine|contains: - \Desktop\ - \Temp\ - \Users\Public\ - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 condition: all of selection_* falsepositives: - Unknown level: high
Query: Sigma rule for Adversaries may log user keystrokes to intercept credentials as the user types them.
Matching passage: Sigma rule: Adversaries may log user keystrokes to intercept credentials as the user types them.. Logsource: windows / ps_script. Rule: title: Powershell Keylogging id: 34f90d3c-c297-49e9-b26d-911b05a4866c status: test description: Adversaries may log user keystrokes to intercept credentials as the user types them. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1 author: frack113 date: 2021-07-30 modified: 2022-07-11 tags: - attack.credential-access - attack.collection - attack.t1056.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_basic: ScriptBlockText|contains: Get-Keystrokes selection_high: ScriptBlockText|contains|all: - Get-ProcAddress user32.dll GetAsyncKeyState - Get-ProcAddress user32.dll GetForegroundWindow condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects usage of bitsadmin downloading a file to a suspicious target folder. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin To A Suspicious Target Folder id: 2ddef153-167b-4e89-86b6-757a9e65dcac related: - id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248 type: obsolete - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 type: similar status: test description: Detects usage of bitsadmin downloading a file to a suspicious target folder references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2025-12-10 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_folder: CommandLine|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - '%ProgramData%' - '%public%' - '%temp%' - '%tmp%' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Query: patch priority for CVE-2015-1261
Matching passage: CVE-2015-1261. CWE: CWE-20. CVSS: 5.0. android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading popup content via crafted text.
Near-miss passage: CVE-2015-0561. CWE: CWE-20. CVSS: 5.0. asn1/lpp/lpp.cnf in the LPP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not validate a certain index value, which allows remote attackers to cause a denial of service (out-of-bounds memory access and application crash) via a crafted packet.
Query: CVE similar to CVE-2015-7281
Matching passage: CVE-2015-7281. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability on ReadyNet WRT300N-DD devices with firmware 1.0.26 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-3388. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.
Query: patch priority for CVE-2015-7189
Matching passage: CVE-2015-7189. CWE: CWE-119. CVSS: 6.800000190734863. Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: alert when Detects the malicious use of a control panel item
Matching passage: Sigma rule: Detects the malicious use of a control panel item. Logsource: windows / process_creation. Rule: title: Control Panel Items id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4 status: test description: Detects the malicious use of a control panel item references: - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) date: 2020-06-22 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1218.002 - attack.persistence - attack.t1546 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cli: CommandLine|contains|all: - add - CurrentVersion\Control Panel\CPLs selection_cpl: CommandLine|endswith: .cpl filter_cpl_sys: CommandLine|contains: - \System32\ - '%System%' - '|C:\Windows\system32|' filter_cpl_igfx: CommandLine|contains|all: - 'regsvr32 ' - ' /s ' - igfxCPL.cpl condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the modification of the findings on SecurityHub.. Logsource: aws / cloudtrail. Rule: title: AWS SecurityHub Findings Evasion id: a607e1fe-74bf-4440-a3ec-b059b9103157 status: stable description: Detects the modification of the findings on SecurityHub. references: - https://docs.aws.amazon.com/cli/latest/reference/securityhub/ author: Sittikorn S date: 2021-06-28 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventSource: securityhub.amazonaws.com eventName: - BatchUpdateFindings - DeleteInsight - UpdateFindings - UpdateInsight condition: selection falsepositives: - System or Network administrator behaviors - DEV, UAT, SAT environment. You should apply this rule with PROD environment only. level: high
Query: patch priority for CVE-2015-2012
Matching passage: CVE-2015-2012. CWE: CWE-200. CVSS: 4.0. The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8669. CWE: CWE-200. CVSS: 5.300000190734863. libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.. Logsource: windows / process_creation. Rule: title: SyncAppvPublishingServer Execute Arbitrary PowerShell Code id: fbd7c32d-db2a-4418-b92c-566eb8911133 related: - id: fde7929d-8beb-4a4c-b922-be9974671667 type: obsolete status: test description: Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/ author: frack113 date: 2021-07-12 modified: 2022-10-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SyncAppvPublishingServer.exe - OriginalFileName: syncappvpublishingserver.exe selection_cli: CommandLine|contains: '"n; ' condition: all of selection_* falsepositives: - App-V clients level: medium
Near-miss passage: Sigma rule: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection packag. Logsource: windows / driver_load. Rule: title: WinDivert Driver Load id: 679085d5-f427-4484-9f58-1dc30a7c426d status: test description: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows references: - https://reqrypt.org/windivert-doc.html - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-07-30 modified: 2024-11-23 tags: - attack.credential-access - attack.collection - attack.defense-impairment - attack.t1599.001 - attack.t1557.001 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|contains: - \WinDivert.sys - \WinDivert64.sys - \NordDivert.sys - \lingtiwfp.sys - \eswfp.sys - Hashes|contains: - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087 - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276 - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76 - IMPHASH=58623490691babe8330adc81cd04a663 - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96 - IMPHASH=a1b2e245acd47e4a348e1a552a02859a - IMPHASH=2a5f85fe4609461c6339637594fa9b0a - IMPHASH=6b2c6f95233c2914d1d488ee27531acc - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342 - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88 - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38 - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6 - IMPHASH=a74929edfc3289895e3f2885278947ae - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4 - IMPHASH=c28cd6ccd83179e79dac132a553693d9 condition: selection falsepositives: - Legitimate WinDivert driver usage level: high
Query: adversary uses NTDS
Matching passage: T1003.003 NTDS. Tactics: credential access. Description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights. By default, the NTDS file (NTDS.dit) is located in <code>%SystemRoot%\NTDS\Ntds.dit</code> of a domain controller.(Citation: Wikipedia Active Directory) In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.(Citation: Metcalf 2015) The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes. * Volume Shadow Copy * secretsdump.py * Using the in-built Windows tool, ntdsutil.exe * Invoke-NinjaCopy
Near-miss passage: T1003 OS Credential Dumping. Tactics: credential access. Description: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password. Credentials can be obtained from OS caches, memory, or structures.(Citation: Brining MimiKatz to Unix) Credentials can then be used to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0008) and access restricted information. Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers. Additional custom tools likely exist as well.
Query: vulnerability: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclosed in 2015)
Matching passage: CVE-2015-8534. CWE: CWE-269. CVSS: 7.800000190734863. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.
Near-miss passage: CVE-2015-8032. CWE: CWE-269. CVSS: 5.300000190734863. In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
Query: Persistence mechanism resembling Compute Hijacking
Matching passage: T1496.001 Compute Hijacking. Tactics: impact. Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: Persistence mechanism resembling Compromise Software Dependencies and Development Tools
Matching passage: T1195.001 Compromise Software Dependencies and Development Tools. Tactics: initial access. Description: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise. Applications often depend on external software to function properly. Popular open source projects that are used as dependencies in many applications, such as pip and NPM packages, may be targeted as a means to add malicious code to users of the dependency.(Citation: Trendmicro NPM Compromise)(Citation: Bitdefender NPM Repositories Compromised 2021)(Citation: MANDVI Malicious npm and PyPI Packages Disguised) This may also include abandoned packages, which in some cases could be re-registered by threat actors after being removed by adversaries.(Citation: The Hacker News PyPi Revival Hijack 2024) Adversaries may also employ "typosquatting" or name-confusion by choosing names similar to existing popular libraries or packages in order to deceive a user.(Citation: Ahmed Backdoors in Python and NPM Packages)(Citation: Meyer PyPI Supply Chain Attack Uncovered)(Citation: Checkmarx-oss-seo) Additionally, CI/CD pipeline components, such as GitHub Actions, may be targeted in order to gain access to the building, testing, and deployment cycles of an application.(Citation: Unit 42 Palo Alto GitHub Actions Supply Chain Attack 2025) By adding malicious code into a GitHub action, a threat actor may be able to collect runtime credentials (e.g., via [Proc Filesystem](https://attack.mitre.org/techniques/T1003/007)) or insert further malicious components into the build pipelines for a second-order supply chain compromise.(Citation: OWASP CICD-SEC-4) As GitHub Actions are often dependent on other GitHub Actions, threat actors may be able to infect a large number of repositories via the compromise of a single Action.(Citation: Palo Alto Networks GitHub Actions Worm 2023) Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.
Near-miss passage: T1195.002 Compromise Software Supply Chain. Tactics: initial access. Description: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version. Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.(Citation: Avast CCleaner3 2018)(Citation: Command Five SK 2011)
Query: vulnerability: The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbit
Matching passage: CVE-2015-8761. CWE: CWE-94. CVSS: 9.0. The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import.
Near-miss passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Query: vulnerability: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0
Matching passage: CVE-2015-8070. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-2473. CWE: UNKNOWN. CVSS: 9.300000190734863. Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .rdp file, aka "Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability."
Query: CVE similar to CVE-2015-5819
Matching passage: CVE-2015-5819. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-5689. CWE: CWE-119. CVSS: 6.800000190734863. ghostexp.exe in Ghost Explorer Utility in Symantec Ghost Solutions Suite (GSS) before 3.0 HF2 12.0.0.8010 and Symantec Deployment Solution (DS) before 7.6 HF4 12.0.0.7045 performs improper sign-extend operations before array-element accesses, which allows remote attackers to execute arbitrary code, cause a denial of service (application crash), or possibly obtain sensitive information via a crafted Ghost image.