alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/config.sh of the component
Matching passage: CVE-2015-10040. CWE: CWE-74. CVSS: 6.5. A vulnerability was found in gitlearn. It has been declared as problematic. This vulnerability affects the function getGrade/getOutOf of the file scripts/config.sh of the component Escape Sequence Handler. The manipulation leads to injection. The attack can be initiated remotely. The patch is identified as 3faa5deaa509012069afe75cd03c21bda5050a64. It is recommended to apply a patch to fix this issue. VDB-218302 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-1169. CWE: CWE-74. CVSS: 7.5. Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication.
Query: describe CVE-2015-0011
Matching passage: CVE-2015-0011. CWE: CWE-264. CVSS: 4.699999809265137. mrxdav.sys (aka the WebDAV driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to bypass an impersonation protection mechanism, and obtain privileges for redirection of WebDAV requests, via a crafted application, aka "WebDAV Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-1156. CWE: CWE-264. CVSS: 4.300000190734863. The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via a crafted web site.
Query: describe CVE-2015-4557
Matching passage: CVE-2015-4557. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.
Near-miss passage: CVE-2015-4671. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in OpenCart before 2.1.0.2 allows remote attackers to inject arbitrary web script or HTML via the zone_id parameter to index.php.
Query: detect Detects remote RPC calls to create or execute a scheduled task via ATSvc in logs
Matching passage: Sigma rule: Detects remote RPC calls to create or execute a scheduled task via ATSvc. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ATSvc id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb status: test description: Detects remote RPC calls to create or execute a scheduled task via ATSvc references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.lateral-movement - attack.execution - attack.persistence - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b OpNum: - 0 - 1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects unsigned module load by ClickOnce application.. Logsource: windows / image_load. Rule: title: Unsigned Module Loaded by ClickOnce Application id: 060d5ad4-3153-47bb-8382-43e5e29eda92 status: test description: Detects unsigned module load by ClickOnce application. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: '@SerkinValery' date: 2023-06-08 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_path: Image|contains: \AppData\Local\Apps\2.0\ selection_sig_status: - Signed: 'false' - SignatureStatus: Expired condition: all of selection_* falsepositives: - Unlikely level: medium
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Near-miss passage: Sigma rule: Detects Bitsadmin connections to IP addresses instead of FQDN names. Logsource: proxy. Rule: title: Bitsadmin to Uncommon IP Server Address id: 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 status: test description: Detects Bitsadmin connections to IP addresses instead of FQDN names references: - https://isc.sans.edu/diary/Microsoft+BITS+Used+to+Download+Payloads/21027 author: Florian Roth (Nextron Systems) date: 2022-06-10 modified: 2022-08-24 tags: - attack.command-and-control - attack.execution - attack.stealth - attack.t1071.001 - attack.persistence - attack.t1197 - attack.s0190 logsource: category: proxy detection: selection: c-useragent|startswith: Microsoft BITS/ cs-host|endswith: - '1' - '2' - '3' - '4' - '5' - '6' - '7' - '8' - '9' condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-4460
Matching passage: CVE-2015-4460. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.
Near-miss passage: CVE-2015-9432. CWE: CWE-352. CVSS: 6.5. The alpine-photo-tile-for-instagram plugin before 1.2.7.6 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings tab parameter.
Query: CVE similar to CVE-2015-4284
Matching passage: CVE-2015-4284. CWE: CWE-20. CVSS: 5.0. The Concurrent Data Management Replication process in Cisco IOS XR 5.3.0 on ASR 9000 devices allows remote attackers to cause a denial of service (BGP process reload) via malformed BGPv4 packets, aka Bug ID CSCur70670.
Near-miss passage: CVE-2015-9039. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages.
Query: risk of A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads 
Matching passage: CVE-2015-10024. CWE: CWE-22. CVSS: 9.800000190734863. A vulnerability classified as critical was found in hoffie larasync. This vulnerability affects unknown code of the file repository/content/file_storage.go. The manipulation leads to path traversal. The name of the patch is 776bad422f4bd4930d09491711246bbeb1be9ba5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217612.
Near-miss passage: CVE-2015-4074. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a ticket.download_attachment task.
Query: exploit A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPoo
Matching passage: CVE-2015-10067. CWE: CWE-366. CVSS: 8.100000381469727. A vulnerability was found in oznetmaster SSharpSmartThreadPool. It has been classified as problematic. This affects an unknown part of the file SSharpSmartThreadPool/SmartThreadPool.cs. The manipulation leads to race condition within a thread. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 0e58073c831093aad75e077962e9fb55cad0dc5f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218463.
Near-miss passage: CVE-2015-6547. CWE: CWE-77. CVSS: 8.300000190734863. The management console on Symantec Web Gateway (SWG) appliances with software before 5.2.2 DB 5.0.0.1277 allows remote authenticated users to execute arbitrary commands at boot time via unspecified vectors.
Query: CVE similar to CVE-2015-3320
Matching passage: CVE-2015-3320. CWE: CWE-200. CVSS: 2.0999999046325684. Lenovo USB Enhanced Performance Keyboard software before 2.0.2.2 includes active debugging code in SKHOOKS.DLL, which allows local users to obtain keypress information by accessing debug output.
Near-miss passage: CVE-2015-4503. CWE: CWE-200. CVSS: 5.0. The TCP Socket API implementation in Mozilla Firefox before 41.0 mishandles array boundaries that were established with a navigator.mozTCPSocket.open method call and send method calls, which allows remote TCP servers to obtain sensitive information from process memory by reading packet data, as demonstrated by availability of this API in a Firefox OS application.
Query: describe CVE-2015-8229
Matching passage: CVE-2015-8229. CWE: CWE-20. CVSS: 4.0. Huawei eSpace U2980 unified gateway with software before V100R001C10 and U2990 with software before V200R001C10 allow remote authenticated users to cause a denial of service via crafted signaling packets from a registered device.
Near-miss passage: CVE-2015-2291. CWE: CWE-20. CVSS: 7.800000190734863. (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Query: alert when Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be
Matching passage: Sigma rule: Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be. Logsource: windows / process_creation. Rule: title: Registry Export of Third-Party Credentials id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 related: - id: 87a476dc-0079-4583-a985-dee7a20a03de type: similar status: experimental description: 'Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry. ' references: - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_save: CommandLine|contains: - save - export selection_cli_path: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure. Logsource: windows / process_creation. Rule: title: PUA - DefenderCheck Execution id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7 status: test description: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion. references: - https://github.com/matterpreter/DefenderCheck author: Florian Roth (Nextron Systems) date: 2022-08-30 modified: 2023-02-04 tags: - attack.stealth - attack.t1027.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \DefenderCheck.exe - Description: DefenderCheck condition: selection falsepositives: - Unlikely level: high
Query: write Sigma for Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.
Matching passage: Sigma rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.. Logsource: windows / file_event. Rule: title: .RDP File Created By Uncommon Application id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: derived status: test description: 'Detects creation of a file with an ".rdp" extension by an application that doesn''t commonly create such files. ' references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 modified: 2024-11-01 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .rdp Image|endswith: - \brave.exe - \CCleaner Browser\Application\CCleanerBrowser.exe - \chromium.exe - \firefox.exe - \Google\Chrome\Application\chrome.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \Opera.exe - \Vivaldi.exe - \Whale.exe - \olk.exe - \Outlook.exe - \RuntimeBroker.exe - \Thunderbird.exe - \Discord.exe - \Keybase.exe - \msteams.exe - \Slack.exe - \teams.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration. Logsource: windows / firewall-as. Rule: title: All Rules Have Been Deleted From The Windows Firewall Configuration id: 79609c82-a488-426e-abcf-9f341a39365d status: test description: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-17 modified: 2024-01-22 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2033 - 2059 filter_main_svchost: ModifyingApplication|endswith: :\Windows\System32\svchost.exe filter_optional_msmpeng: ModifyingApplication|contains|all: - :\ProgramData\Microsoft\Windows Defender\Platform\ - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: high
Query: exploit GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Matching passage: CVE-2015-7496. CWE: CWE-264. CVSS: 7.199999809265137. GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Near-miss passage: CVE-2015-3082. CWE: CWE-264. CVSS: 6.400000095367432. Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3083 and CVE-2015-3085.
Query: detect Attackers may leverage fsutil to enumerated connected drives. in logs
Matching passage: Sigma rule: Attackers may leverage fsutil to enumerated connected drives.. Logsource: windows / process_creation. Rule: title: Fsutil Drive Enumeration id: 63de06b9-a385-40b5-8b32-73f2b9ef84b6 status: test description: Attackers may leverage fsutil to enumerated connected drives. references: - Turla has used fsutil fsinfo drives to list connected drives. - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2022-03-29 modified: 2022-07-14 tags: - attack.discovery - attack.t1120 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \fsutil.exe - OriginalFileName: fsutil.exe selection_cli: CommandLine|contains: drives condition: all of selection_* falsepositives: - Certain software or administrative tasks may trigger false positives. level: low
Near-miss passage: Sigma rule: Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.. Logsource: windows / image_load. Rule: title: VBA DLL Loaded Via Office Application id: e6ce8457-68b1-485b-9bdd-3c2b5d679aa9 status: test description: Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros. references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-02-10 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|endswith: - \VBE7.DLL - \VBEUI.DLL - \VBE7INTL.DLL condition: selection falsepositives: - Legitimate macro usage. Add the appropriate filter according to your environment level: high
Query: exploit Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote attackers to cause a denial of se
Matching passage: CVE-2015-8664. CWE: CWE-189. CVSS: 8.800000190734863. Integer overflow in the WebCursor::Deserialize function in content/common/cursors/webcursor.cc in Google Chrome before 47.0.2526.106 allows remote attackers to cause a denial of service or possibly have unspecified other impact via an RGBA pixel array with crafted dimensions, a different vulnerability than CVE-2015-6792.
Near-miss passage: CVE-2015-3808. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Query: patch priority for CVE-2015-6495
Matching passage: CVE-2015-6495. CWE: CWE-200. CVSS: 7.5. There is Sensitive Information in Cloudera Manager before 5.4.6 Diagnostic Support Bundles.
Near-miss passage: CVE-2015-3184. CWE: CWE-200. CVSS: 5.0. mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
Query: exploit modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_
Matching passage: CVE-2015-0794. CWE: CWE-59. CVSS: 3.5999999046325684. modules.d/90crypt/module-setup.sh in the dracut package before 037-17.30.1 in openSUSE 13.2 allows local users to have unspecified impact via a symlink attack on /tmp/dracut_block_uuid.map.
Near-miss passage: CVE-2015-6927. CWE: CWE-59. CVSS: 3.5999999046325684. vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
Query: exploit Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-0339. CWE: CWE-399. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0335.
Near-miss passage: CVE-2015-1745. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1766.
Query: CVE similar to CVE-2015-5885
Matching passage: CVE-2015-5885. CWE: CWE-200. CVSS: 5.0. The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level domain.
Near-miss passage: CVE-2015-6161. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Browser ASLR Bypass."