alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-9166
Matching passage: CVE-2015-9166. CWE: CWE-19. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, DRM provisioning mechanisms used in QSEE applications have a feature to prevent further provisioning. This is done by creating an SFS file called 'finalize_prov_flag.data' at the end of provisioning. When this feature is enabled, provisioning calls check for the existence of the file in order to decide whether to do provisioning or not. Current implementation allows provisioning without sufficient checks.
Near-miss passage: CVE-2015-0819. CWE: CWE-19. CVSS: 4.300000190734863. The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site.
Query: exploit Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office 
Matching passage: CVE-2015-2477. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-3192. CWE: CWE-119. CVSS: 5.5. Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Query: patch priority for CVE-2015-6807
Matching passage: CVE-2015-6807. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label.
Near-miss passage: CVE-2015-0766. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface in the Management Center component in Cisco FireSIGHT System Software 6.0.0 allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug IDs CSCus93566, CSCut31557, and CSCut47196.
Query: detection rule: Detects usage of the SysInternals Procdump utility
Matching passage: Sigma rule: Detects usage of the SysInternals Procdump utility. Logsource: windows / process_creation. Rule: title: Procdump Execution id: 2e65275c-8288-4ab4-aeb7-6274f58b6b20 status: test description: Detects usage of the SysInternals Procdump utility references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump author: Florian Roth (Nextron Systems) date: 2021-08-16 modified: 2026-06-29 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection: Image|endswith: - \procdump.exe - \procdump64.exe - \procdump64a.exe condition: selection falsepositives: - Legitimate use of procdump by a developer or administrator level: medium
Near-miss passage: Sigma rule: Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ. Logsource: azure / signinlogs. Rule: title: Application Using Device Code Authentication Flow id: 248649b7-d64f-46f0-9fb2-a52774166fb5 status: test description: 'Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: Device Code condition: selection falsepositives: - Applications that are input constrained will need to use device code flow and are valid authentications. level: medium
Query: secure coding against Permissive List of Allowed Inputs
Matching passage: CWE-183 Permissive List of Allowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Near-miss passage: CWE-331 Insufficient Entropy. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Query: patch priority for CVE-2015-9280
Matching passage: CVE-2015-9280. CWE: CWE-611. CVSS: 10.0. MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.
Near-miss passage: CVE-2015-7241. CWE: CWE-611. CVSS: 9.800000190734863. XML External Entity (XXE) vulnerability in SAP Netweaver before 7.01.
Query: Sigma rule for Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been
Matching passage: Sigma rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been. Logsource: aws / cloudtrail. Rule: title: New Network ACL Entry Added id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd status: test description: 'Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateNetworkAclEntry condition: selection falsepositives: - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC level: low
Near-miss passage: Sigma rule: Detects the use of Replace.exe which can be used to replace file with another file. Logsource: windows / process_creation. Rule: title: Replace.exe Usage id: 9292293b-8496-4715-9db6-37028dcda4b3 status: test description: Detects the use of Replace.exe which can be used to replace file with another file references: - https://lolbas-project.github.io/lolbas/Binaries/Replace/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace author: frack113 date: 2022-03-06 modified: 2024-03-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \replace.exe argument: CommandLine|contains|windash: -a condition: selection and argument falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-9192
Matching passage: CVE-2015-9192. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, out of bounds memory access vulnerability may occur in the content protection manager due to improper validation of incoming messages.
Near-miss passage: CVE-2015-5944. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file.
Query: risk of The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted 
Matching passage: CVE-2015-5965. CWE: CWE-20. CVSS: 5.0. The SSL-VPN feature in Fortinet FortiOS before 4.3.13 only checks the first byte of the TLS MAC in finished messages, which makes it easier for remote attackers to spoof encrypted content via a crafted MAC field.
Near-miss passage: CVE-2015-5401. CWE: CWE-20. CVSS: 7.5. Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.10.00.01-1 and TD Express before 15.00.02.08_Sles10 and 15.00.02.08_Sles11 allow remote attackers to cause a denial of service (database crash) via a malformed CONFIG REQUEST message.
Query: detection rule: Detects the execution of a system command via the ScreenConnect RMM service.
Matching passage: Sigma rule: Detects the execution of a system command via the ScreenConnect RMM service.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Remote Command Execution id: b1f73849-6329-4069-bc8f-78a604bb8b23 status: test description: Detects the execution of a system command via the ScreenConnect RMM service. references: - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 modified: 2024-02-26 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \ScreenConnect.ClientService.exe selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains: \TEMP\ScreenConnect\ condition: all of selection_* falsepositives: - Legitimate use of ScreenConnect. Disable this rule if ScreenConnect is heavily used. level: low
Near-miss passage: Sigma rule: Detects Windows executables that write files with suspicious extensions. Logsource: windows / file_event. Rule: title: Windows Binaries Write Suspicious Extensions id: b8fd0e93-ff58-4cbd-8f48-1c114e342e62 related: - id: 1277f594-a7d1-4f28-a2d3-73af5cbeab43 type: derived status: test description: Detects Windows executables that write files with suspicious extensions references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2025-10-07 tags: - attack.stealth - attack.t1036 logsource: category: file_event product: windows detection: selection_generic: Image|endswith: - \csrss.exe - \lsass.exe - \RuntimeBroker.exe - \sihost.exe - \smss.exe - \wininit.exe - \winlogon.exe TargetFilename|endswith: - .bat - .dll - .exe - .hta - .iso - .ps1 - .txt - .vbe - .vbs selection_special: Image|endswith: - \dllhost.exe - \rundll32.exe - \svchost.exe TargetFilename|endswith: - .bat - .hta - .iso - .ps1 - .vbe - .vbs filter_main_AppLockerPolicyTest: Image: C:\Windows\System32\dllhost.exe TargetFilename|contains|all: - :\Users\ - \AppData\Local\Temp\__PSScriptPolicyTest_ TargetFilename|endswith: .ps1 filter_main_script_gpo_machine: Image: C:\Windows\system32\svchost.exe TargetFilename|contains|all: - C:\Windows\System32\GroupPolicy\DataStore\ - \sysvol\ - \Policies\ - \Machine\Scripts\Startup\ TargetFilename|endswith: - .ps1 - .bat filter_main_clipchamp: Image: C:\Windows\system32\svchost.exe TargetFilename|contains|all: - C:\Program Files\WindowsApps\Clipchamp - .ps1 filter_main_powershell_preview: Image: - C:\Windows\system32\svchost.exe - C:\Windows\SysWOW64\svchost.exe TargetFilename|startswith: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - C:\Program Files (x86)\WindowsApps\Microsoft.PowerShellPreview TargetFilename|endswith: .ps1 condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: exploit The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denia
Matching passage: CVE-2015-6825. CWE: CWE-20. CVSS: 7.5. The ff_frame_thread_init function in libavcodec/pthread_frame.c in FFmpeg before 2.7.2 mishandles certain memory-allocation failures, which allows remote attackers to cause a denial of service (invalid pointer access) or possibly have unspecified other impact via a crafted file, as demonstrated by an AVI file.
Near-miss passage: CVE-2015-9246. CWE: CWE-20. CVSS: 9.800000190734863. An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The WAR file is sent to /skyboxview-softwareupdate/services/CollectorSoftwareUpdate and the JSP file is reached at /opt/skyboxview/thirdparty/jboss/server/web/work/jboss.web/localhost.
Query: CVE similar to CVE-2015-7449
Matching passage: CVE-2015-7449. CWE: CWE-200. CVSS: 3.299999952316284. IBM Rational Collaborative Lifecycle Management (CLM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Quality Manager (RQM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Team Concert (RTC) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Requirements Composer (RRC) 4.0.x before 4.0.7 iFix10; Rational DOORS Next Generation (RDNG) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Engineering Lifecycle Manager (RELM) 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7 before iFix1, 5.0.x before 5.0.2 iFix1, and 6.0.x before 6.0.2; Rational Rhapsody Design Manager (Rhapsody DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2; Rational Software Architect Design Manager (RSA DM) 4.0.x before 4.0.7 iFix10, 5.0.x before 5.0.2 iFix15, 6.0.x before 6.0.1 iFix5, and 6.0.2 before iFix2 allow local users to obtain sensitive information by leveraging weak encryption. IBM X-Force ID: 108221.
Near-miss passage: CVE-2015-1357. CWE: CWE-200. CVSS: 5.0. Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allow context-dependent attackers to discover password hashes by reading (1) files or (2) security logs.
Query: risk of Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before
Matching passage: CVE-2015-5723. CWE: CWE-264. CVSS: 7.800000190734863. Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.
Near-miss passage: CVE-2015-1673. CWE: CWE-264. CVSS: 9.300000190734863. The Windows Forms (aka WinForms) libraries in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allow user-assisted remote attackers to execute arbitrary code via a crafted partial-trust application, aka "Windows Forms Elevation of Privilege Vulnerability."
Query: exploit The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does n
Matching passage: CVE-2015-8725. CWE: CWE-20. CVSS: 5.5. The dissect_diameter_base_framed_ipv6_prefix function in epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the IPv6 prefix length, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-9147. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, userspace-provided pointer arguments are not validated.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML via the txtUserID par
Matching passage: CVE-2015-2082. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Login.aspx in UNIT4 Prosoft HRMS before 8.14.330.43 allows remote attackers to inject arbitrary web script or HTML via the txtUserID parameter.
Near-miss passage: CVE-2015-9303. CWE: CWE-79. CVSS: 6.099999904632568. The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.
Query: write Sigma for Detects registry changes to Office trust records where the path is located in a potentially suspicious location
Matching passage: Sigma rule: Detects registry changes to Office trust records where the path is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Macro Enabled In A Potentially Suspicious Document id: a166f74e-bf44-409d-b9ba-ea4b2dd8b3cd related: - id: 295a59c1-7b79-4b47-a930-df12c15fc9c2 type: derived status: test description: Detects registry changes to Office trust records where the path is located in a potentially suspicious location references: - https://twitter.com/inversecos/status/1494174785621819397 - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-21 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_value: TargetObject|contains: \Security\Trusted Documents\TrustRecords selection_paths: TargetObject|contains: - /AppData/Local/Microsoft/Windows/INetCache/ - /AppData/Local/Temp/ - /PerfLogs/ - C:/Users/Public/ - file:///D:/ - file:///E:/ condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g. Logsource: windows / file_event. Rule: title: Potential Persistence Via Notepad++ Plugins id: 54127bd4-f541-4ac3-afdb-ea073f63f692 status: test description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence references: - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2025-09-01 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Notepad++\plugins\ TargetFilename|endswith: .dll filter_gup: Image|endswith: \Notepad++\updater\gup.exe filter_install: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Temp\ Image|endswith: - \target.exe - Installer.x64.exe filter_main_installer: Image|contains: \npp. Image|endswith: .exe TargetFilename: - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll condition: selection and not 1 of filter_* falsepositives: - Possible FPs during first installation of Notepad++ - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities level: medium
Query: detection rule: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or netwo
Matching passage: Sigma rule: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or netwo. Logsource: windows / security. Rule: title: Failed Logon From Public IP id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1 status: test description: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 author: NVISO date: 2020-05-06 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1190 - attack.t1133 logsource: product: windows service: security detection: selection: EventID: 4625 filter_main_ip_unknown: IpAddress|contains: '-' filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 condition: selection and not 1 of filter_main_* falsepositives: - Legitimate logon attempts over the internet - IPv4-to-IPv6 mapped IPs level: medium
Near-miss passage: Sigma rule: Detects possible command execution by web application/web shell. Logsource: linux / auditd. Rule: title: Webshell Remote Command Execution id: c0d3734d-330f-4a03-aae2-65dacc6a8222 status: test description: Detects possible command execution by web application/web shell references: - Personal Experience of the Author - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ author: Ilyas Ochkov, Beyu Denis, oscd.community date: 2019-10-12 modified: 2025-12-05 tags: - attack.persistence - attack.t1505.003 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 ' detection: selection: type: SYSCALL SYSCALL: - execve - execveat euid: 33 condition: selection falsepositives: - Admin activity - Crazy web applications level: critical
Query: vulnerability: Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary
Matching passage: CVE-2015-0781. CWE: CWE-22. CVSS: 9.800000190734863. Directory traversal vulnerability in the doPost method of the Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to upload and execute arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-2965. CWE: CWE-22. CVSS: 4.0. Directory traversal vulnerability in osCommerce Japanese 2.2ms1j-R8 and earlier allows remote authenticated administrators to read arbitrary files via unspecified vectors.