alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file
Matching passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / process_creation. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet id: 435e10e4-992a-4281-96f3-38b11106adde related: - id: db885529-903f-4c5d-9864-28fe199e6370 type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - 'Get-ADComputer ' - ' -Filter \*' CommandLine|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: all of selection_* falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Near-miss passage: Sigma rule: Detects exploitation attempt using the JNDI-Exploit-Kit. Logsource: webserver. Rule: title: JNDIExploit Pattern id: 412d55bc-7737-4d25-9542-5b396867ce55 status: test description: Detects exploitation attempt using the JNDI-Exploit-Kit references: - https://github.com/pimps/JNDI-Exploit-Kit - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit author: Florian Roth (Nextron Systems) date: 2021-12-12 modified: 2022-12-25 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - /Basic/Command/Base64/ - /Basic/ReverseShell/ - /Basic/TomcatMemshell - /Basic/JettyMemshell - /Basic/WeblogicMemshell - /Basic/JBossMemshell - /Basic/WebsphereMemshell - /Basic/SpringMemshell - /Deserialization/URLDNS/ - /Deserialization/CommonsCollections1/Dnslog/ - /Deserialization/CommonsCollections2/Command/Base64/ - /Deserialization/CommonsBeanutils1/ReverseShell/ - /Deserialization/Jre8u20/TomcatMemshell - /TomcatBypass/Dnslog/ - /TomcatBypass/Command/ - /TomcatBypass/ReverseShell/ - /TomcatBypass/TomcatMemshell - /TomcatBypass/SpringMemshell - /GroovyBypass/Command/ - /WebsphereBypass/Upload/ condition: keywords falsepositives: - Legitimate apps the use these paths level: high
Query: exploit Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5
Matching passage: CVE-2015-5369. CWE: CWE-17. CVSS: 4.300000190734863. Pulse Connect Secure (aka PCS and formerly Juniper PCS) PSC6000, PCS6500, and MAG PSC360 8.1 before 8.1r5, 8.0 before 8.0r13, 7.4 before 7.4r13.5, and 7.1 before 7.1r22.2 and PPS 5.1 before 5.1R5 and 5.0 before 5.0R13, when Hardware Acceleration is enabled, does not properly validate the Finished TLS handshake message, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted Finished message.
Near-miss passage: CVE-2015-5176. CWE: CWE-17. CVSS: 5.800000190734863. The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource.
Query: exploit IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruptio
Matching passage: CVE-2015-6996. CWE: CWE-119. CVSS: 6.800000190734863. IOAcceleratorFamily in Apple iOS before 9.1, OS X before 10.11.1, and watchOS before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-8221. CWE: CWE-119. CVSS: 10.0. Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
Query: patch priority for CVE-2015-4760
Matching passage: CVE-2015-4760. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Near-miss passage: CVE-2015-0465. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Infrastructure.
Query: rule covering Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow co
Matching passage: Sigma rule: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow co. Logsource: windows / security. Rule: title: Enabled User Right in AD to Control User Objects id: 311b6ce2-7890-4383-a8c2-663a9f6b43cd status: test description: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects. references: - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ author: '@neu5ron' date: 2017-07-30 modified: 2021-12-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change' detection: selection_base: EventID: 4704 selection_keywords: PrivilegeList|contains: SeEnableDelegationPrivilege condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this tech. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Rundll32.EXE Execution of UDL File id: 0ea52357-cd59-4340-9981-c46c7e900428 status: test description: 'Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data. ' references: - https://trustedsec.com/blog/oops-i-udld-it-again author: '@kostastsale' date: 2024-08-16 tags: - attack.execution - attack.command-and-control - attack.stealth - attack.t1218.011 - attack.t1071 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - oledb32.dll - ',OpenDSLFile ' - \\Users\\*\\Downloads\\ CommandLine|endswith: .udl condition: all of selection_* falsepositives: - UDL files serve as a convenient and flexible tool for managing and testing database connections in various development and administrative scenarios. level: medium
Query: vulnerability: Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecif
Matching passage: CVE-2015-1277. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the accessibility implementation in Google Chrome before 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.
Near-miss passage: CVE-2015-1294. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.
Query: risk of Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before
Matching passage: CVE-2015-3077. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3084 and CVE-2015-3086.
Near-miss passage: CVE-2015-1671. CWE: UNKNOWN. CVSS: 7.800000190734863. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2; Live Meeting 2007 Console; Lync 2010; Lync 2010 Attendee; Lync 2013 SP1; Lync Basic 2013 SP1; Silverlight 5 before 5.1.40416.00; and Silverlight 5 Developer Runtime before 5.1.40416.00, allows remote attackers to execute arbitrary code via a crafted TrueType font, aka "TrueType Font Parsing Vulnerability."
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of
Matching passage: CVE-2015-8152. CWE: CWE-352. CVSS: 8.0. Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Query: exploit Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a d
Matching passage: CVE-2015-7203. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font-family name.
Near-miss passage: CVE-2015-3749. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: vulnerability: The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Matching passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Near-miss passage: CVE-2015-9330. CWE: CWE-89. CVSS: 9.800000190734863. The wp-all-import plugin before 3.2.5 for WordPress has blind SQL injection.
Query: Sigma rule for Detects inline execution of PowerShell code from a file
Matching passage: Sigma rule: Detects inline execution of PowerShell code from a file. Logsource: windows / process_creation. Rule: title: Powershell Inline Execution From A File id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2 status: test description: Detects inline execution of PowerShell code from a file references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_exec: CommandLine|contains: - 'iex ' - 'Invoke-Expression ' - 'Invoke-Command ' - 'icm ' selection_read: CommandLine|contains: - 'cat ' - 'get-content ' - 'type ' selection_raw: CommandLine|contains: ' -raw' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.. Logsource: windows / process_creation. Rule: title: AspNetCompiler Execution id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 type: similar status: test description: Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: frack113 date: 2021-11-24 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe condition: selection falsepositives: - Unknown level: medium
Query: rule covering Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container
Matching passage: Sigma rule: Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container. Logsource: kubernetes / application / audit. Rule: title: Potential Sidecar Injection Into Running Deployment id: ad9012a6-e518-4432-9890-f3b82b8fc71f status: test description: 'Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster. ' references: - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: patch apiGroup: apps objectRef.resource: deployments condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi. Logsource: windows / process_creation. Rule: title: Renamed AutoIt Execution id: f4264e47-f522-4c38-a420-04525d5b880f status: test description: 'Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious. ' references: - https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w - https://www.autoitscript.com/site/ author: Florian Roth (Nextron Systems) date: 2023-06-04 modified: 2024-11-23 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - ' /AutoIt3ExecuteScript' - ' /ErrorStdOut' selection_2: Hashes|contains: - IMPHASH=FDC554B3A8683918D731685855683DDF - IMPHASH=CD30A61B60B3D60CECDB034C8C83C290 - IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000 selection_3: OriginalFileName: - AutoIt3.exe - AutoIt2.exe - AutoIt.exe filter_main_legit_name: Image|endswith: - \AutoIt.exe - \AutoIt2.exe - \AutoIt3_x64.exe - \AutoIt3.exe condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Sigma YAML for proxy
Matching passage: Sigma rule: Detects download of certain file types from hosts with dynamic DNS names (selected list). Logsource: proxy. Rule: title: Download from Suspicious Dyndns Hosts id: 195c1119-ef07-4909-bb12-e66f5e07bf3c status: test description: Detects download of certain file types from hosts with dynamic DNS names (selected list) references: - https://www.alienvault.com/blogs/security-essentials/dynamic-dns-security-and-potential-threats author: Florian Roth (Nextron Systems) date: 2017-11-08 modified: 2023-05-18 tags: - attack.command-and-control - attack.t1105 - attack.t1568 logsource: category: proxy detection: selection: c-uri-extension: - exe - vbs - bat - rar - ps1 - doc - docm - xls - xlsm - pptm - rtf - hta - dll - ws - wsf - sct - zip cs-host|endswith: - .hopto.org - .no-ip.org - .no-ip.info - .no-ip.biz - .no-ip.com - .noip.com - .ddns.name - .myftp.org - .myftp.biz - .serveblog.net - .servebeer.com - .servemp3.com - .serveftp.com - .servequake.com - .servehalflife.com - .servehttp.com - .servegame.com - .servepics.com - .myvnc.com - .ignorelist.com - .jkub.com - .dlinkddns.com - .jumpingcrab.com - .ddns.info - .mooo.com - .dns-dns.com - .strangled.net - .adultdns.net - .craftx.biz - .ddns01.com - .dns53.biz - .dnsapi.info - .dnsd.info - .dnsdynamic.com - .dnsdynamic.net - .dnsget.org - .fe100.net - .flashserv.net - .ftp21.net - .http01.com - .http80.info - .https443.com - .imap01.com - .kadm5.com - .mysq1.net - .ns360.info - .ntdll.net - .ole32.com - .proxy8080.com - .sql01.com - .ssh01.com - .ssh22.net - .tempors.com - .tftpd.net - .ttl60.com - .ttl60.org - .user32.com - .voip01.com - .wow64.net - .x64.me - .xns01.com - .dyndns.org - .dyndns.info - .dyndns.tv - .dyndns-at-home.com - .dnsomatic.com - .zapto.org - .webhop.net - .25u.com - .slyip.net condition: selection falsepositives: - Software downloads level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / system. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - System id: 11b52f18-aaec-4d60-9143-5dd8cc4706b9 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-0835
Matching passage: CVE-2015-0835. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-1188. CWE: UNKNOWN. CVSS: 7.5. The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
Query: exploit Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when 
Matching passage: CVE-2015-2263. CWE: CWE-264. CVSS: 3.299999952316284. Cloudera Manager 4.x, 5.0.x before 5.0.6, 5.1.x before 5.1.5, 5.2.x before 5.2.5, and 5.3.x before 5.3.3 uses global read permissions for files in its configuration directory when starting YARN NodeManager, which allows local users to obtain sensitive information by reading the files, as demonstrated by yarn.keytab or ssl-server.xml in /var/run/cloudera-scm-agent/process.
Near-miss passage: CVE-2015-2828. CWE: CWE-264. CVSS: 9.0. CA Spectrum 9.2.x and 9.3.x before 9.3 H02 does not properly validate serialized Java objects, which allows remote authenticated users to obtain administrative privileges via crafted object data.
Query: CVE similar to CVE-2015-10010
Matching passage: CVE-2015-10010. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
Near-miss passage: CVE-2015-2182. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322.
Query: risk of IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote
Matching passage: CVE-2015-1994. CWE: CWE-200. CVSS: 5.0. IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.
Near-miss passage: CVE-2015-3720. CWE: CWE-200. CVSS: 4.300000190734863. The kernel in Apple OS X before 10.10.4 does not properly manage memory in kernel-extension APIs, which allows attackers to obtain sensitive memory-layout information via a crafted app.
Query: patch priority for CVE-2015-0413
Matching passage: CVE-2015-0413. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Java SE 7u72 and 8u25 allows local users to affect integrity via unknown vectors related to Serviceability.
Near-miss passage: CVE-2015-0303. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0306.