alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-3111
Matching passage: CVE-2015-3111. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-0795. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.
Query: exploit Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.
Matching passage: CVE-2015-8636. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8645.
Near-miss passage: CVE-2015-7061. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Query: ATT&CK technique for System Language Discovery
Matching passage: T1614.001 System Language Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host. This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions. This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.(Citation: Malware System Language Check) There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts. Specific checks will vary based on the target and/or adversary, but may involve behaviors such as [Query Registry](https://attack.mitre.org/techniques/T1012) and calls to [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: CrowdStrike Ryuk January 2019) For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key <code>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language</code> or parsing the outputs of Windows API functions <code>GetUserDefaultUILanguage</code>, <code>GetSystemDefaultUILanguage</code>, <code>GetKeyboardLayoutList</code> and <code>GetUserDefaultLangID</code>.(Citation: Darkside Ransomware Cybereason)(Citation: Securelist JSWorm)(Citation: SecureList SynAck Doppelgänging May 2018) On a macOS or Linux system, adversaries may query <code>locale</code> to retrieve the value of the <code>$LANG</code> environment variable.
Near-miss passage: T1614 System Location Discovery. Tactics: discovery. Description: Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from [System Location Discovery](https://attack.mitre.org/techniques/T1614) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.(Citation: FBI Ragnar Locker 2020)(Citation: Sophos Geolocation 2016)(Citation: Bleepingcomputer RAT malware 2020) Windows API functions such as <code>GetLocaleInfoW</code> can also be used to determine the locale of the host.(Citation: FBI Ragnar Locker 2020) In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.(Citation: AWS Instance Identity Documents)(Citation: Microsoft Azure Instance Metadata 2021) Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.(Citation: Securelist Trasparent Tribe 2020)(Citation: Sophos Geolocation 2016)
Query: risk of Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-3948. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Advantech WebAccess before 8.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0668. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
Query: write Sigma for Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server acce
Matching passage: Sigma rule: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server acce. Logsource: windows / process_creation. Rule: title: Microsoft IIS Connection Strings Decryption id: 97dbf6e2-e436-44d8-abee-4261b24d3e41 status: test description: Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command. references: - https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html author: Tim Rauch, Elastic (idea) date: 2022-09-28 modified: 2022-12-30 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: \aspnet_regiis.exe - OriginalFileName: aspnet_regiis.exe selection_args: CommandLine|contains|all: - connectionStrings - ' -pdf' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3117. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, CVE-2015-3134, and CVE-2015-4431.
Near-miss passage: CVE-2015-5277. CWE: CWE-119. CVSS: 7.199999809265137. The get_contents function in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) before 2.20 might allow local users to cause a denial of service (heap corruption) or gain privileges via a long line in the NSS files database.
Query: CVE similar to CVE-2015-5206
Matching passage: CVE-2015-5206. CWE: UNKNOWN. CVSS: 9.800000190734863. Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
Near-miss passage: CVE-2015-4788. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect integrity and availability via unknown vectors, a different vulnerability than CVE-2015-4774 and CVE-2015-4779.
Query: patch priority for CVE-2015-7019
Matching passage: CVE-2015-7019. CWE: CWE-119. CVSS: 5.599999904632568. The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
Near-miss passage: CVE-2015-1845. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Query: patch priority for CVE-2015-2522
Matching passage: CVE-2015-2522. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 allows remote authenticated users to inject arbitrary web script or HTML via crafted content, aka "Microsoft SharePoint XSS Spoofing Vulnerability."
Near-miss passage: CVE-2015-6372. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web-based management interface in Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices allows remote attackers to inject arbitrary web script or HTML via a crafted value, aka Bug ID CSCux10614.
Query: risk of The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold an
Matching passage: CVE-2015-2476. CWE: CWE-310. CVSS: 2.5999999046325684. The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "WebDAV Client Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-0118. CWE: CWE-310. CVSS: 4.300000190734863. IBM WebSphere Message Broker Toolkit 7 before 7007 IF2 and 8 before 8005 IF1 and Integration Toolkit 9 before 9003 IF1 are distributed with MQ client JAR files that support only weak TLS ciphers, which might make it easier for remote attackers to obtain sensitive information by sniffing the network during a connection to an Integration Bus node.
Query: detection rule: Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo
Matching passage: Sigma rule: Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo. Logsource: windows / file_event. Rule: title: Files With System DLL Name In Unsuspected Locations id: 13c02350-4177-4e45-ac17-cf7ca628ff5e status: test description: 'Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \secur32.dll - \tdh.dll filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ condition: selection and not 1 of filter_main_* falsepositives: - Third party software might bundle specific versions of system DLLs. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml
Near-miss passage: Sigma rule: Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look fo. Logsource: azure / riskdetection. Rule: title: Unfamiliar Sign-In Properties id: 128faeef-79dd-44ca-b43c-a9e236a60f49 status: test description: Detects sign-in with properties that are unfamiliar to the user. The detection considers past sign-in history to look for anomalous sign-ins. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: unfamiliarFeatures condition: selection falsepositives: - User changing to a new device, location, browser, etc. level: high
Query: detection rule: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~"
Matching passage: Sigma rule: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~". Logsource: webserver. Rule: title: Successful IIS Shortname Fuzzing Scan id: 7cb02516-6d95-4ffc-8eee-162075e111ac status: test description: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~" references: - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml - https://www.exploit-db.com/exploits/19525 - https://github.com/lijiejie/IIS_shortname_Scanner author: frack113 date: 2021-10-06 modified: 2023-01-02 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: ~1 cs-uri-query|endswith: a.aspx cs-method: - GET - OPTIONS sc-status: - 200 - 301 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity. Logsource: windows / ps_script. Rule: title: Suspicious TCP Tunnel Via PowerShell Script id: bd33d2aa-497e-4651-9893-5c5364646595 status: test description: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity references: - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-08 tags: - attack.command-and-control - attack.t1090 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[System.Net.HttpWebRequest]' - System.Net.Sockets.TcpListener - AcceptTcpClient condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-1644
Matching passage: CVE-2015-1644. CWE: CWE-264. CVSS: 7.199999809265137. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."
Near-miss passage: CVE-2015-4650. CWE: CWE-264. CVSS: 9.800000190734863. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.
Query: risk of IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, 11.4, and 11.5 allow remote authenticated users to bypass intended access restrictions an
Matching passage: CVE-2015-7424. CWE: CWE-200. CVSS: 4.300000190734863. IBM InfoSphere Master Data Management (MDM) - Collaborative Edition 9.1, 10.1, 11.0, 11.3, 11.4, and 11.5 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information by leveraging Catalogs access. IBM X-Force ID: 107780.
Near-miss passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Query: vulnerability: Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element wit
Matching passage: CVE-2015-8789. CWE: UNKNOWN. CVSS: 9.600000381469727. Use-after-free vulnerability in the EbmlMaster::Read function in libEBML before 1.3.3 allows context-dependent attackers to have unspecified impact via a "deeply nested element with infinite size" followed by another element of an upper level in an EBML document.
Near-miss passage: CVE-2015-4916. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4908.
Query: alert when Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a. Logsource: windows / file_event. Rule: title: NTDS.DIT Creation By Uncommon Process id: 11b1ed55-154d-4e82-8ad7-83739298f720 related: - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d type: similar status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory references: - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/ - https://adsecurity.org/?p=2398 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2022-07-14 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 logsource: product: windows category: file_event detection: selection_ntds: TargetFilename|endswith: \ntds.dit selection_process_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wsl.exe - \wt.exe selection_process_paths: Image|contains: - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: selection_ntds and 1 of selection_process_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.. Logsource: windows / process_creation. Rule: title: PUA - DIT Snapshot Viewer id: d3b70aad-097e-409c-9df2-450f80dc476b status: test description: Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit. references: - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap author: Furkan Caliskan (@caliskanfurkan_) date: 2020-07-04 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \ditsnap.exe - CommandLine|contains: ditsnap.exe condition: selection falsepositives: - Legitimate admin usage level: high
Query: patch priority for CVE-2015-9337
Matching passage: CVE-2015-9337. CWE: CWE-284. CVSS: 7.5. The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Near-miss passage: CVE-2015-7315. CWE: CWE-284. CVSS: 5.900000095367432. Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET o
Matching passage: CVE-2015-0737. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco FireSIGHT System Software 5.3.1.1 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) GET or (2) POST parameter, aka Bug ID CSCuu11099.
Near-miss passage: CVE-2015-1653. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."
Query: risk of Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of se
Matching passage: CVE-2015-7189. CWE: CWE-119. CVSS: 6.800000190734863. Race condition in the JPEGEncoder function in Mozilla Firefox before 42.0 and Firefox ESR 38.x before 38.4 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via vectors involving a CANVAS element and crafted JavaScript code.
Near-miss passage: CVE-2015-3703. CWE: CWE-119. CVSS: 6.800000190734863. ImageIO in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image.
Query: exploit XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.
Matching passage: CVE-2015-0787. CWE: CWE-79. CVSS: 6.099999904632568. XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.
Near-miss passage: CVE-2015-7491. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.x before 8.0.0.1 CF20 and 8.5.x before 8.5.0.0 CF09 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.