alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Unspecified vulnerability in the Oracle Retail Open Commerce Platform component in Oracle Retail Applications 3.0 allows remote attackers to affect confidentiality and integrity vi
Matching passage: CVE-2015-4827. CWE: UNKNOWN. CVSS: 6.400000095367432. Unspecified vulnerability in the Oracle Retail Open Commerce Platform component in Oracle Retail Applications 3.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Framework.
Near-miss passage: CVE-2015-6983. CWE: UNKNOWN. CVSS: 8.800000190734863. Double free vulnerability in Apple iOS before 9.1 and OS X before 10.11.1 allows attackers to write to arbitrary files via a crafted app that accesses AtomicBufferedFile descriptors.
Query: patch priority for CVE-2015-2548
Matching passage: CVE-2015-2548. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
Near-miss passage: CVE-2015-8069. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: what is T1120
Matching passage: T1120 Peripheral Device Discovery. Tactics: discovery. Description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.(Citation: Peripheral Discovery Linux)(Citation: Peripheral Discovery macOS) Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Near-miss passage: T1016 System Network Configuration Discovery. Tactics: discovery. Description: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include [Arp](https://attack.mitre.org/software/S0099), [ipconfig](https://attack.mitre.org/software/S0100)/[ifconfig](https://attack.mitre.org/software/S0101), [nbtstat](https://attack.mitre.org/software/S0102), and [route](https://attack.mitre.org/software/S0103). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes (e.g. <code>show ip route</code>, <code>show ip interface</code>).(Citation: US-CERT-TA18-106A)(Citation: Mandiant APT41 Global Intrusion ) On ESXi, adversaries may leverage esxcli to gather network configuration information. For example, the command `esxcli network nic list` will retrieve the MAC address, while `esxcli network ip interface ipv4 get` will retrieve the local IPv4 address.(Citation: Trellix Rnasomhouse 2024) Adversaries may use the information from [System Network Configuration Discovery](https://attack.mitre.org/techniques/T1016) during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.
Query: weakness Misinterpretation of Input
Matching passage: CWE-115 Misinterpretation of Input. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Near-miss passage: CWE-673 External Influence of Sphere Definition. The product does not prevent the definition of control spheres from external actors.
Query: vulnerability: Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to
Matching passage: CVE-2015-4861. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and 5.6.26 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server : InnoDB.
Near-miss passage: CVE-2015-4477. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the MediaStream playback feature in Mozilla Firefox before 40.0 allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API.
Query: exploit The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attac
Matching passage: CVE-2015-0830. CWE: CWE-399. CVSS: 5.0. The WebGL implementation in Mozilla Firefox before 36.0 does not properly allocate memory for copying an unspecified string to a shader's compilation log, which allows remote attackers to cause a denial of service (application crash) via crafted WebGL content.
Near-miss passage: CVE-2015-5001. CWE: CWE-399. CVSS: 4.300000190734863. IBM WebSphere Portal 6.1.0 through 6.1.0.6 CF27, 6.1.5 through 6.1.5.3 CF27, 7.0.0 through 7.0.0.2 CF29, 8.0.0 before 8.0.0.1 CF19, and 8.5.0 before CF08 allows remote authenticated users to cause a denial of service (memory consumption) via a crafted document.
Query: risk of Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attrib
Matching passage: CVE-2015-4289. CWE: CWE-22. CVSS: 6.400000095367432. Directory traversal vulnerability in Cisco AnyConnect Secure Mobility Client 4.0(2049) allows remote head-end systems to write to arbitrary files via a crafted configuration attribute, aka Bug ID CSCut93920.
Near-miss passage: CVE-2015-1000006. CWE: CWE-22. CVSS: 7.5. Remote file download vulnerability in recent-backups v0.7 wordpress plugin
Query: patch priority for CVE-2015-5692
Matching passage: CVE-2015-5692. CWE: CWE-264. CVSS: 7.900000095367432. admin_messages.php in the management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary code by uploading a file with a safe extension and content type, and then leveraging an improper Sudo configuration to make this a setuid-root file.
Near-miss passage: CVE-2015-3379. CWE: CWE-264. CVSS: 4.0. The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-1278
Matching passage: CVE-2015-1278. CWE: CWE-254. CVSS: 4.300000190734863. content/browser/web_contents/web_contents_impl.cc in Google Chrome before 44.0.2403.89 does not ensure that a PDF document's modal dialog is closed upon navigation to an interstitial page, which allows remote attackers to spoof URLs via a crafted document, as demonstrated by the alert_dialog.pdf document.
Near-miss passage: CVE-2015-3755. CWE: CWE-254. CVSS: 4.300000190734863. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to spoof the user interface via a malformed URL.
Query: secure coding against Path Equivalence: 'filename.' (Trailing Dot)
Matching passage: CWE-42 Path Equivalence: 'filename.' (Trailing Dot). The product accepts path input in the form of trailing dot ('filedir.') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-636 Not Failing Securely ('Failing Open'). When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.
Query: Sigma rule for Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Matching passage: Sigma rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe CommandLine|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Use Rundll32 - System id: 641a4bfb-c017-44f7-800c-2aee0184ce9b status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ImagePath|contains: - value - invoke - comspec - iex condition: selection falsepositives: - Unknown level: high
Query: rule covering Detects AWS root account usage
Matching passage: Sigma rule: Detects AWS root account usage. Logsource: aws / cloudtrail. Rule: title: AWS Root Credentials id: 8ad1600d-e9dc-4251-b0ee-a65268f29add status: test description: Detects AWS root account usage references: - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection_usertype: userIdentity.type: Root selection_eventtype: eventType: AwsServiceEvent condition: selection_usertype and not selection_eventtype falsepositives: - AWS Tasks That Require AWS Account Root User Credentials https://docs.aws.amazon.com/general/latest/gr/aws_tasks-that-require-root.html level: medium
Near-miss passage: Sigma rule: Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with p. Logsource: windows / system. Rule: title: Active Directory Certificate Services Denied Certificate Enrollment Request id: 994bfd6d-0a2e-481e-a861-934069fcf5f5 status: test description: 'Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/ author: '@SerkinValery' date: 2024-03-07 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-CertificationAuthority EventID: 53 condition: selection falsepositives: - Unknown level: low
Query: write Sigma for When configured with suitable command line arguments, w32tm can act as a delay mechanism
Matching passage: Sigma rule: When configured with suitable command line arguments, w32tm can act as a delay mechanism. Logsource: windows / process_creation. Rule: title: Use of W32tm as Timer id: 6da2c9f5-7c53-401b-aacb-92c040ce1215 status: test description: When configured with suitable command line arguments, w32tm can act as a delay mechanism references: - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains author: frack113 date: 2022-09-25 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_w32tm: - Image|endswith: \w32tm.exe - OriginalFileName: w32time.dll selection_cmd: CommandLine|contains|all: - /stripchart - '/computer:' - '/period:' - /dataonly - '/samples:' condition: all of selection_* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack.. Logsource: azure / pim. Rule: title: Roles Assigned Outside PIM id: b1bc08d1-8224-4758-a0e6-fbcfc98c73bb status: test description: Identifies when a privilege role assignment has taken place outside of PIM and may indicate an attack. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: rolesAssignedOutsidePrivilegedIdentityManagementAlertConfiguration condition: selection falsepositives: - Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there. level: high
Query: describe CVE-2015-1325
Matching passage: CVE-2015-1325. CWE: CWE-362. CVSS: 7.0. Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2.14.70ubuntu8.5 as packaged in Ubuntu 14.10, before 2.14.1-0ubuntu3.11 as packaged in Ubuntu 14.04 LTS, and before 2.0.1-0ubuntu17.9 as packaged in Ubuntu 12.04 LTS allow local users to write to arbitrary files and gain root privileges.
Near-miss passage: CVE-2015-7543. CWE: CWE-362. CVSS: 7.0. aRts 1.5.10 and kdelibs3 3.5.10 and earlier do not properly create temporary directories, which allows local users to hijack the IPC by pre-creating the temporary directory.
Query: vulnerability: Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous befo
Matching passage: CVE-2015-5090. CWE: CWE-269. CVSS: 7.199999809265137. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-4446 and CVE-2015-5106.
Near-miss passage: CVE-2015-3613. CWE: CWE-269. CVSS: 9.800000190734863. A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
Query: risk of mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafte
Matching passage: CVE-2015-8506. CWE: CWE-119. CVSS: 9.300000190734863. mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24441553, a different vulnerability than CVE-2015-6616, CVE-2015-8505, and CVE-2015-8507.
Near-miss passage: CVE-2015-3705. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
Query: exploit Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attacke
Matching passage: CVE-2015-4360. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors.
Near-miss passage: CVE-2015-4379. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors.
Query: describe CVE-2015-4089
Matching passage: CVE-2015-4089. CWE: CWE-352. CVSS: 8.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the optionsPageRequest function in admin.php in WP Fastest Cache plugin before 0.8.3.5 for WordPress allow remote attackers to hijack the authentication of unspecified victims for requests that call the (1) saveOption, (2) deleteCache, (3) deleteCssAndJsCache, or (4) addCacheTimeout method via the wpFastestCachePage parameter in the WpFastestCacheOptions/ page.
Near-miss passage: CVE-2015-7936. CWE: CWE-352. CVSS: 7.5. Cross-site request forgery (CSRF) vulnerability in Motorola Solutions MOSCAD IP Gateway allows remote attackers to hijack the authentication of administrators for requests that modify a password.
Query: patch priority for CVE-2015-3215
Matching passage: CVE-2015-3215. CWE: CWE-20. CVSS: 7.5. The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for the size of the IP options.
Near-miss passage: CVE-2015-2917. CWE: CWE-20. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
Query: patch priority for CVE-2015-1800
Matching passage: CVE-2015-1800. CWE: CWE-200. CVSS: 7.5. The samsung_extdisp driver in the Samsung S4 (GT-I9500) I9500XXUEMK8 kernel 3.4 and earlier allows attackers to potentially obtain sensitive information.
Near-miss passage: CVE-2015-4138. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not include the HTTPOnly flag in a Set-Cookie header for the administrator's cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, a different vulnerability than CVE-2015-2855.
Query: write Sigma for Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.. Logsource: linux / process_creation. Rule: title: ESXi VM Kill Via ESXCLI id: 2992ac4d-31e9-4325-99f2-b18a73221bb2 status: test description: Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.execution - attack.impact - attack.t1059.012 - attack.t1529 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains|all: - vm process - kill condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe. Logsource: windows / process_creation. Rule: title: Execution via stordiag.exe id: 961e0abb-1b1e-4c84-a453-aafe56ad0d34 status: test description: Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe references: - https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html - https://twitter.com/eral4m/status/1451112385041911809 author: Austin Songer (@austinsonger) date: 2021-10-21 modified: 2022-12-25 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \stordiag.exe Image|endswith: - \schtasks.exe - \systeminfo.exe - \fltmc.exe filter: ParentImage|startswith: - c:\windows\system32\ - c:\windows\syswow64\ condition: selection and not filter falsepositives: - Legitimate usage of stordiag.exe. level: high