alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: secure coding against Use of sizeof() on a Pointer Type
Matching passage: CWE-467 Use of sizeof() on a Pointer Type. The code calls sizeof() on a pointer type, which can be an incorrect calculation if the programmer intended to determine the size of the data that is being pointed to.
Near-miss passage: CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Query: exploit Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffi
Matching passage: CVE-2015-6675. CWE: CWE-284. CVSS: 4.300000190734863. Siemens RUGGEDCOM ROS 3.8.0 through 4.1.x permanently enables the IP forwarding feature, which allows remote attackers to bypass a VLAN isolation protection mechanism via IP traffic.
Near-miss passage: CVE-2015-1376. CWE: CWE-284. CVSS: 4.0. pixabay-images.php in the Pixabay Images plugin before 2.4 for WordPress does not validate hostnames, which allows remote authenticated users to write to arbitrary files via an upload URL with a host other than pixabay.com.
Query: exploit A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file courseb
Matching passage: CVE-2015-10049. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Overdrive Eletrônica course-builder up to 1.7.x and classified as problematic. Affected by this issue is some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is e39645fd714adb7e549908780235911ae282b21b. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218372.
Near-miss passage: CVE-2015-7439. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in InfoSphere Data Architect (IDA), as distributed in IBM Rational Software Architect 8.5 through 9.5, Rational Software Architect for WebSphere Software (RSA4WS) 8.5 through 9.5, and Rational Software Architect RealTime (RSART) 8.5 through 9.5, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Query: vulnerability: The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
Matching passage: CVE-2015-5888. CWE: CWE-264. CVSS: 7.199999809265137. The Install Framework Legacy component in Apple OS X before 10.11 allows local users to obtain root privileges via vectors involving a privileged executable file.
Near-miss passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Query: patch priority for CVE-2015-0651
Matching passage: CVE-2015-0651. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
Near-miss passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Query: describe CVE-2015-4450
Matching passage: CVE-2015-4450. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-5088, CVE-2015-5089, and CVE-2015-5092.
Near-miss passage: CVE-2015-2374. CWE: CWE-200. CVSS: 3.299999952316284. The Netlogon service in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly implement domain-controller communication, which allows remote attackers to discover credentials by leveraging certain PDC access and spoofing the BDC role in a PDC communication channel, aka "Elevation of Privilege Vulnerability in Netlogon."
Query: detect Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o in logs
Matching passage: Sigma rule: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o. Logsource: windows / process_creation. Rule: title: Sysmon Configuration Update id: 87911521-7098-470b-a459-9a57fc80bdfd status: test description: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -c condition: all of selection_* falsepositives: - Legitimate administrators might use this command to update Sysmon configuration. level: medium
Near-miss passage: Sigma rule: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged pro. Logsource: windows / process_creation. Rule: title: Bypass UAC via Fodhelper.exe id: 7f741dcf-fc22-4759-87b4-9ae8376676a2 status: test description: Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes. references: - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \fodhelper.exe condition: selection falsepositives: - Legitimate use of fodhelper.exe utility by legitimate user level: high
Query: detect Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g in logs
Matching passage: Sigma rule: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g. Logsource: windows / file_event. Rule: title: Potential Persistence Via Notepad++ Plugins id: 54127bd4-f541-4ac3-afdb-ea073f63f692 status: test description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence references: - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2025-09-01 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Notepad++\plugins\ TargetFilename|endswith: .dll filter_gup: Image|endswith: \Notepad++\updater\gup.exe filter_install: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Temp\ Image|endswith: - \target.exe - Installer.x64.exe filter_main_installer: Image|contains: \npp. Image|endswith: .exe TargetFilename: - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll condition: selection and not 1 of filter_* falsepositives: - Possible FPs during first installation of Notepad++ - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities level: medium
Near-miss passage: Sigma rule: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: EventLog EVTX File Deleted id: 63c779ba-f638-40a0-a593-ddd45e8b1ddc status: test description: Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|startswith: C:\Windows\System32\winevt\Logs\ TargetFilename|endswith: .evtx condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for cisco / aaa
Matching passage: Sigma rule: Show when private keys are being exported from the device, or when new certificates are installed. Logsource: cisco / aaa. Rule: title: Cisco Crypto Commands id: 1f978c6a-4415-47fb-aca5-736a44d7ca3d status: test description: Show when private keys are being exported from the device, or when new certificates are installed references: - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 - attack.t1552.004 logsource: product: cisco service: aaa detection: keywords: - crypto pki export - crypto pki import - crypto pki trustpoint condition: keywords falsepositives: - Not commonly run by administrators. Also whitelist your known good certificates level: high
Near-miss passage: Sigma rule: Detects execution of binaries located in potentially suspicious locations via "nohup". Logsource: linux / process_creation. Rule: title: Suspicious Nohup Execution id: 457df417-8b9d-4912-85f3-9dbda39c3645 related: - id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2 type: derived status: test description: Detects execution of binaries located in potentially suspicious locations via "nohup" references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: Image|endswith: /nohup CommandLine|contains: /tmp/ condition: selection falsepositives: - Unknown level: high
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.
Matching passage: CVE-2015-8594. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.
Near-miss passage: CVE-2015-8386. CWE: CWE-119. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: exploit The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code
Matching passage: CVE-2015-7541. CWE: CWE-77. CVSS: 10.0. The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.
Near-miss passage: CVE-2015-20107. CWE: CWE-77. CVSS: 7.599999904632568. In Python (aka CPython) up to 3.10.8, the mailcap module does not add escape characters into commands discovered in the system mailcap file. This may allow attackers to inject shell commands into applications that call mailcap.findmatch with untrusted input (if they lack validation of user-provided filenames or arguments). The fix is also back-ported to 3.7, 3.8, 3.9
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
Matching passage: CVE-2015-5395. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
Near-miss passage: CVE-2015-2680. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via a request in the users page to gxadmin/index.php.
Query: CVE similar to CVE-2015-1005
Matching passage: CVE-2015-1005. CWE: CWE-200. CVSS: 2.0999999046325684. IniNet embeddedWebServer (aka eWebServer) before 2.02 for Windows CE uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7929. CWE: CWE-200. CVSS: 4.300000190734863. eWON devices with firmware through 10.1s0 support unspecified GET requests, which might allow remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Query: alert when Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised ac
Matching passage: Sigma rule: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised ac. Logsource: windows / ps_script. Rule: title: Clearing Windows Console History id: bde47d4b-9987-405c-94c7-b080410e8ea7 status: test description: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. references: - https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/ - https://www.shellhacks.com/clear-history-powershell/ - https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-25 tags: - attack.stealth - attack.t1070 - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains: Clear-History selection2a: ScriptBlockText|contains: - Remove-Item - rm selection2b: ScriptBlockText|contains: - ConsoleHost_history.txt - (Get-PSReadlineOption).HistorySavePath condition: selection1 or selection2a and selection2b falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.. Logsource: windows / process_creation. Rule: title: Raccine Uninstall id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc status: test description: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool. references: - https://github.com/Neo23x0/Raccine author: Florian Roth (Nextron Systems) date: 2021-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - 'taskkill ' - RaccineSettings.exe selection2: CommandLine|contains|all: - reg.exe - delete - Raccine Tray selection3: CommandLine|contains|all: - schtasks - /DELETE - Raccine Rules Updater condition: 1 of selection* falsepositives: - Legitimate deinstallation by administrative staff level: high
Query: vulnerability: The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Matching passage: CVE-2015-9457. CWE: CWE-89. CVSS: 7.199999809265137. The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
Near-miss passage: CVE-2015-2196. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a spiderbigcalendar_month action to wp-admin/admin-ajax.php.
Query: explain T1688 Safe Mode Boot
Matching passage: T1688 Safe Mode Boot. Tactics: defense impairment. Description: Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Windows Startup Settings)(Citation: Sophos Safe Mode Boot) Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit) Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason safe mode boot)(Citation: BleepingComputer REvil 2021)
Near-miss passage: T1553 Subvert Trust Controls. Tactics: defense impairment. Description: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs. Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust. Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site. Adversaries may attempt to subvert these trust mechanisms. The method adversaries use will depend on the specific mechanism they seek to subvert. Adversaries may conduct [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [Modify Registry](https://attack.mitre.org/techniques/T1112) in support of subverting these controls.(Citation: SpectorOps Subverting Trust Sept 2017) Adversaries may also create or steal code signing certificates to acquire trust on target systems.(Citation: Securelist Digital Certificates)(Citation: Symantec Digital Certificates)
Query: describe CVE-2015-2755
Matching passage: CVE-2015-2755. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the AB Google Map Travel (AB-MAP) plugin before 4.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) lat (Latitude), (2) long (Longitude), (3) map_width, (4) map_height, or (5) zoom (Map Zoom) parameter in the ab_map_options page to wp-admin/admin.php.
Near-miss passage: CVE-2015-2878. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijack the authentication of administrators for requests that (1) add arbitrary accounts via the name parameter to interface/rest/accounts/json; turn off the (2) Url matching, (3) DNS Inject, or (4) IP Redirect Sensor in a request to interface/rest/dpi/setEnabled/1; or (5) perform whitelisting of malware MD5 hash IDs via the id parameter to interface/rest/md5-threats/whitelist.
Query: vulnerability: validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Matching passage: CVE-2015-5145. CWE: CWE-399. CVSS: 7.800000190734863. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Near-miss passage: CVE-2015-0688. CWE: CWE-399. CVSS: 7.099999904632568. Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module, when NAT is enabled, allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets, aka Bug ID CSCup21070.