alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-5630
Matching passage: CVE-2015-5630. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the NTT Broadband Platform Japan Connected-free Wi-Fi application 1.6.0 and earlier for Android and 1.0.2 and earlier for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted SSID.
Near-miss passage: CVE-2015-3440. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.1 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type.
Query: risk of SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL com
Matching passage: CVE-2015-5078. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the insert function in application/controllers/admin/dataentry.php in LimeSurvey 2.06+ allows remote authenticated users to execute arbitrary SQL commands via the closedate parameter.
Near-miss passage: CVE-2015-4066. CWE: CWE-89. CVSS: 6.5. Multiple SQL injection vulnerabilities in admin/handlers.php in the GigPress plugin before 2.3.9 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) show_artist_id or (2) show_venue_id parameter in an add action in the gigpress.php page to wp-admin/admin.php.
Query: telemetry for T1074.001
Matching passage: T1074.001 Local Data Staging. Tactics: collection. Description: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.(Citation: Prevailion DarkWatchman 2021)
Near-miss passage: T1074.002 Remote Data Staging. Tactics: collection. Description: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration. Data may be kept in separate files or combined into one file through techniques such as [Archive Collected Data](https://attack.mitre.org/techniques/T1560). Interactive command shells may be used, and common functionality within [cmd](https://attack.mitre.org/software/S0106) and bash may be used to copy data into a staging location. In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and stage data in that instance.(Citation: Mandiant M-Trends 2020) By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.
Query: describe CVE-2015-0886
Matching passage: CVE-2015-0886. CWE: CWE-190. CVSS: 5.0. Integer overflow in the crypt_raw method in the key-stretching implementation in jBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
Near-miss passage: CVE-2015-8933. CWE: CWE-190. CVSS: 5.5. Integer overflow in the archive_read_format_tar_skip function in archive_read_support_format_tar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (crash) via a crafted tar file.
Query: detection rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Matching passage: Sigma rule: Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.. Logsource: windows / security. Rule: title: Startup/Logon Script Added to Group Policy Object id: 123e4e6d-b123-48f8-b261-7214938acaf0 status: test description: 'Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. ' references: - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html author: Elastic, Josh Nickels, Marius Rothenbücher date: 2024-09-06 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 - attack.t1547 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_eventid: EventID: - 5136 - 5145 selection_attributes_main: AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3 selection_attributes_optional: AttributeValue|contains: - 40B6664F-4972-11D1-A7CA-0000F87571E3 - 40B66650-4972-11D1-A7CA-0000F87571E3 selection_share: ShareName|endswith: \SYSVOL RelativeTargetName|endswith: - \scripts.ini - \psscripts.ini AccessList|contains: '%%4417' condition: selection_eventid and (all of selection_attributes_* or selection_share) falsepositives: - Legitimate execution by system administrators. level: medium
Near-miss passage: Sigma rule: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unus. Logsource: windows / taskscheduler. Rule: title: Scheduled Task Executed From A Suspicious Location id: 424273ea-7cf8-43a6-b712-375f925e481f status: test description: Detects the execution of Scheduled Tasks where the Program being run is located in a suspicious location or it's an unusale program to be run from a Scheduled Task references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-02-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 logsource: product: windows service: taskscheduler definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger' detection: selection: EventID: 129 Path|contains: - C:\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - C:\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: actor TTPs: SVG Smuggling
Matching passage: T1027.017 SVG Smuggling. Tactics: stealth. Description: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign SVG files.(Citation: Trustwave SVG Smuggling 2025) SVGs, or Scalable Vector Graphics, are vector-based image files constructed using XML. As such, they can legitimately include `<script>` tags that enable adversaries to include malicious JavaScript payloads. However, SVGs may appear less suspicious to users than other types of executable files, as they are often treated as image files. SVG smuggling can take a number of forms. For example, threat actors may include content that: * Assembles malicious payloads(Citation: Talos SVG Smuggling 2022) * Downloads malicious payloads(Citation: Cofense SVG Smuggling 2024) * Redirects users to malicious websites(Citation: Bleeping Computer SVG Smuggling 2024) * Displays interactive content to users, such as fake login forms and download buttons.(Citation: Bleeping Computer SVG Smuggling 2024) SVG Smuggling may be used in conjunction with [HTML Smuggling](https://attack.mitre.org/techniques/T1027/006) where an SVG with a malicious payload is included inside an HTML file.(Citation: Talos SVG Smuggling 2022) SVGs may also be included in other types of documents, such as PDFs.
Near-miss passage: T1027.012 LNK Icon Smuggling. Tactics: stealth. Description: Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory. Adversaries may abuse this LNK metadata to download malicious payloads. For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded. These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation: Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017) LNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads.
Query: CVE similar to CVE-2015-3104
Matching passage: CVE-2015-3104. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-2470. CWE: CWE-189. CVSS: 9.300000190734863. Integer underflow in Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office for Mac 2011, and Word Viewer allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Integer Underflow Vulnerability."
Query: describe CVE-2015-4824
Matching passage: CVE-2015-4824. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-2646. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Enterprise Manager Grid Control EM Base Platform: 11.1.0.1; EM Plugin for DB: 12.1.0.5, 12.1.0.6, 12.1.0.7; EM DB Control: 11.1.0.7, 11.2.0.3, and 11.2.0.4 allows remote attackers to affect integrity via unknown vectors related to Content Management.
Query: vulnerability: Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated us
Matching passage: CVE-2015-7999. CWE: CWE-89. CVSS: 8.100000381469727. Multiple SQL injection vulnerabilities in the Administration Web UI servlets in Citrix Command Center before 5.1 Build 36.7 and 5.2 before Build 44.11 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-1513. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in SIPhone Enterprise PBX allows remote attackers to execute arbitrary SQL commands via the Username.
Query: risk of XSS in filedownload v1.4 wordpress plugin
Matching passage: CVE-2015-1000004. CWE: CWE-79. CVSS: 6.099999904632568. XSS in filedownload v1.4 wordpress plugin
Near-miss passage: CVE-2015-6402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
Query: CVE similar to CVE-2015-2255
Matching passage: CVE-2015-2255. CWE: CWE-19. CVSS: 5.900000095367432. Huawei AR1220 routers with software before V200R005SPH006 allow remote attackers to cause a denial of service (board reset) via vectors involving a large amount of traffic from the GE port to the FE port.
Near-miss passage: CVE-2015-6429. CWE: CWE-19. CVSS: 5.0. The IKEv1 state machine in Cisco IOS 15.4 through 15.6 and IOS XE 3.15 through 3.17 allows remote attackers to cause a denial of service (IPsec connection termination) via a crafted IKEv1 packet to a tunnel endpoint, aka Bug ID CSCuw08236.
Query: CVE similar to CVE-2015-3870
Matching passage: CVE-2015-3870. CWE: CWE-119. CVSS: 10.0. libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132.
Near-miss passage: CVE-2015-1845. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewal
Matching passage: CVE-2015-2639. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect integrity via unknown vectors related to Server : Security : Firewall.
Near-miss passage: CVE-2015-4906. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX, a different vulnerability than CVE-2015-4908 and CVE-2015-4916.
Query: CVE similar to CVE-2015-4368
Matching passage: CVE-2015-4368. CWE: UNKNOWN. CVSS: 5.0. The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors.
Near-miss passage: CVE-2015-1255. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in content/renderer/media/webaudio_capturer_source.cc in the WebAudio implementation in Google Chrome before 43.0.2357.65 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact by leveraging improper handling of a stop action for an audio track.
Query: patch priority for CVE-2015-8456
Matching passage: CVE-2015-8456. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-8439.
Near-miss passage: CVE-2015-1545. CWE: UNKNOWN. CVSS: 5.0. The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Query: risk of Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a 
Matching passage: CVE-2015-3950. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in XZERES 442SR OS on 442SR wind turbines allows remote attackers to hijack the authentication of admins for requests that select a different default admin user via a GET request.
Near-miss passage: CVE-2015-2009. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the xmlrpc.cgi service in IBM QRadar SIEM 7.1 before MR2 Patch 11 Interim Fix 02 and 7.2.x before 7.2.5 Patch 4 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences via vectors related to webmin. IBM X-Force ID: 103921.
Query: patch priority for CVE-2015-7034
Matching passage: CVE-2015-7034. CWE: CWE-119. CVSS: 6.800000190734863. The Apple iWork application before 2.6 for iOS and Apple Pages before 5.6 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Pages document.
Near-miss passage: CVE-2015-1817. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.. Logsource: windows / process_creation. Rule: title: PUA - CleanWipe Execution id: f44800ac-38ec-471f-936e-3fa7d9c53100 status: test description: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: Image|endswith: \SepRemovalToolNative_x64.exe selection2: Image|endswith: \CATClean.exe CommandLine|contains: --uninstall selection3: Image|endswith: \NetInstaller.exe CommandLine|contains: -r selection4: Image|endswith: \WFPUnins.exe CommandLine|contains|all: - /uninstall - /enterprise condition: 1 of selection* falsepositives: - Legitimate administrative use (Should be investigated either way) level: high
Near-miss passage: Sigma rule: Detects potential RDP Session Hijacking activity on Windows systems. Logsource: windows / process_creation. Rule: title: Potential RDP Session Hijacking Activity id: 224f140f-3553-4cd1-af78-13d81bf9f7cc status: test description: Detects potential RDP Session Hijacking activity on Windows systems references: - https://twitter.com/Moti_B/status/909449115477659651 author: '@juju4' date: 2022-12-27 modified: 2024-12-01 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \tscon.exe - OriginalFileName: tscon.exe selection_integrity: IntegrityLevel: - System - S-1-16-16384 condition: all of selection_* falsepositives: - Administrative activity level: medium
Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions. Logsource: windows / ps_script. Rule: title: Windows Defender Exclusions Added - PowerShell id: c1344fa2-323b-4d2e-9176-84b4d4821c88 related: - id: 17769c90-230e-488b-a463-e05c08e9d48f type: similar status: test description: Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions references: - https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-16 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1685 - attack.execution - attack.t1059 logsource: category: ps_script product: windows definition: 'Requirements: Script Block Logging must be enabled' detection: selection_args_exc: ScriptBlockText|contains: - ' -ExclusionPath ' - ' -ExclusionExtension ' - ' -ExclusionProcess ' - ' -ExclusionIpAddress ' selection_args_pref: ScriptBlockText|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' condition: all of selection* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale. Logsource: windows / security. Rule: title: Persistence and Execution at Scale via GPO Scheduled Task id: a8f29a7b-b137-4446-80a0-b804272f3da2 status: test description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale references: - https://twitter.com/menasec1/status/1106899890377052160 - https://www.secureworks.com/blog/ransomware-as-a-distraction - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-09-04 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.lateral-movement - attack.t1053.005 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_5136: EventID: 5136 AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: - CAB54552-DEEA-4691-817E-ED4A4D1AFC72 - AADCED64-746C-4633-A97C-D61349046527 selection_5145: EventID: 5145 ShareName|endswith: \SYSVOL RelativeTargetName|endswith: ScheduledTasks.xml AccessList|contains: - WriteData - '%%4417' condition: 1 of selection_* falsepositives: - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks. level: high
Query: vulnerability: The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers t
Matching passage: CVE-2015-6316. CWE: CWE-255. CVSS: 6.5. The default configuration of sshd_config in Cisco Mobility Services Engine (MSE) through 8.0.120.7 allows logins by the oracle account, which makes it easier for remote attackers to obtain access by entering this account's hardcoded password in an SSH session, aka Bug ID CSCuv40501.
Near-miss passage: CVE-2015-6424. CWE: CWE-255. CVSS: 7.199999809265137. The boot manager in Cisco Application Policy Infrastructure Controller (APIC) 1.1(0.920a) allows local users to bypass intended access restrictions and obtain single-user-mode root access via unspecified vectors, aka Bug ID CSCuu83985.
Query: explain CWE-36
Matching passage: CWE-36 Absolute Path Traversal. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-1427 Improper Neutralization of Input Used for LLM Prompting. The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way these prompts are constructed causes the LLM to fail to distinguish between user-supplied inputs and developer provided system directives.