alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: EDR alert: possible Launchctl (T1569.001)
Matching passage: T1569.001 Launchctl. Tactics: execution. Description: Adversaries may abuse launchctl to execute commands or programs. Launchctl interfaces with launchd, the service management framework for macOS. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.(Citation: Launchctl Man) Adversaries use launchctl to execute commands and programs as [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s. Common subcommands include: <code>launchctl load</code>,<code>launchctl unload</code>, and <code>launchctl start</code>. Adversaries can use scripts or manually run the commands <code>launchctl load -w "%s/Library/LaunchAgents/%s"</code> or <code>/bin/launchctl load</code> to execute [Launch Agent](https://attack.mitre.org/techniques/T1543/001)s or [Launch Daemon](https://attack.mitre.org/techniques/T1543/004)s.(Citation: Sofacy Komplex Trojan)(Citation: 20 macOS Common Tools and Techniques)
Near-miss passage: T1569.003 Systemctl. Tactics: execution. Description: Adversaries may abuse systemctl to execute commands or programs. Systemctl is the primary interface for systemd, the Linux init system and service manager. Typically invoked from a shell, Systemctl can also be integrated into scripts or applications. Adversaries may use systemctl to execute commands or programs as [Systemd Service](https://attack.mitre.org/techniques/T1543/002)s. Common subcommands include: `systemctl start`, `systemctl stop`, `systemctl enable`, `systemctl disable`, and `systemctl status`.(Citation: Red Hat Systemctl 2022)
Query: patch priority for CVE-2015-6331
Matching passage: CVE-2015-6331. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the web framework in Cisco Prime Collaboration Assurance 10.5(1) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCus39887.
Near-miss passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: detect Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val in logs
Matching passage: Sigma rule: Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use val. Logsource: windows / process_creation. Rule: title: New Remote Desktop Connection Initiated Via Mstsc.EXE id: 954f0af7-62dd-418f-b3df-a84bc2c7a774 status: test description: 'Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server. Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc author: frack113 date: 2022-01-07 modified: 2024-06-04 tags: - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mstsc.exe - OriginalFileName: mstsc.exe selection_cli: CommandLine|contains|windash: ' /v:' filter_optional_wsl: ParentImage: C:\Windows\System32\lxss\wslhost.exe CommandLine|contains: C:\ProgramData\Microsoft\WSL\wslg.rdp condition: all of selection_* and not 1 of filter_optional_* falsepositives: - WSL (Windows Sub System For Linux) level: medium
Near-miss passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Loading unsigned image (DLL, EXE) into LSASS process. Logsource: windows / image_load. Rule: title: Unsigned Image Loaded Into LSASS Process id: 857c8db3-c89b-42fb-882b-f681c7cf4da2 status: test description: Loading unsigned image (DLL, EXE) into LSASS process references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \lsass.exe Signed: 'false' condition: selection falsepositives: - Valid user connecting using RDP level: medium
Near-miss passage: Sigma rule: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting at. Logsource: linux / vsftpd. Rule: title: Suspicious VSFTPD Error Messages id: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe status: test description: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/dagwieers/vsftpd/ author: Florian Roth (Nextron Systems) date: 2017-07-05 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: vsftpd detection: keywords: - 'Connection refused: too many sessions for this address.' - 'Connection refused: tcp_wrappers denial.' - Bad HTTP verb. - port and pasv both active - pasv and port both active - Transfer done (but failed to open directory). - Could not set file modification time. - 'bug: pid active in ptrace_sandbox_free' - PTRACE_SETOPTIONS failure - 'weird status:' - couldn't handle sandbox event - syscall * out of bounds - 'syscall not permitted:' - 'syscall validate failed:' - Input line too long. - poor buffer accounting in str_netfd_alloc - vsf_sysutil_read_loop condition: keywords falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-9170
Matching passage: CVE-2015-9170. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, incorrect offset check in wv_dash_core_refresh_keys() may lead to a buffer overread.
Near-miss passage: CVE-2015-1733. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2389 and CVE-2015-2411.
Query: vulnerability: The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Matching passage: CVE-2015-1049. CWE: CWE-20. CVSS: 6.800000190734863. The web server on Siemens SCALANCE X-200IRT switches with firmware before 5.2.0 allows remote attackers to hijack sessions via unspecified vectors.
Near-miss passage: CVE-2015-2460. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Query: vulnerability: php-fpm allows local users to write to or create arbitrary files via a symlink attack.
Matching passage: CVE-2015-3211. CWE: CWE-59. CVSS: 5.5. php-fpm allows local users to write to or create arbitrary files via a symlink attack.
Near-miss passage: CVE-2015-6240. CWE: CWE-59. CVSS: 7.800000190734863. The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Query: secure coding against Improper Authorization in Handler for Custom URL Scheme
Matching passage: CWE-939 Improper Authorization in Handler for Custom URL Scheme. The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
Near-miss passage: CWE-1079 Parent Class without Virtual Destructor Method. A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
Query: detection rule: Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj
Matching passage: Sigma rule: Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj. Logsource: windows / ps_script. Rule: title: Potential WinAPI Calls Via PowerShell Scripts id: 03d83090-8cba-44a0-b02f-0b756a050306 related: - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 type: similar status: test description: 'Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1 - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community date: 2020-10-06 modified: 2026-04-29 tags: - attack.execution - attack.t1059.001 - attack.t1106 - attack.stealth - attack.t1620 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_injection: ScriptBlockText|contains|all: - VirtualAlloc - OpenProcess - WriteProcessMemory - CreateRemoteThread selection_token_steal: ScriptBlockText|contains|all: - OpenProcessToken - LookupPrivilegeValue - AdjustTokenPrivileges selection_duplicate_token: ScriptBlockText|contains|all: - OpenProcessToken - DuplicateTokenEx - CloseHandle selection_process_write_read: ScriptBlockText|contains|all: - WriteProcessMemory - VirtualAlloc - ReadProcessMemory - VirtualFree selection_local_shellcode_injection: ScriptBlockText|contains|all: - VirtualAlloc - GetDelegateForFunctionPointer - Marshal.Copy condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service. Logsource: windows / smbclient-security. Rule: title: Suspicious Rejected SMB Guest Logon From IP id: 71886b70-d7b4-4dbf-acce-87d2ca135262 status: test description: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service references: - https://twitter.com/KevTheHermit/status/1410203844064301056 - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/ - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w date: 2021-06-30 modified: 2023-01-02 tags: - attack.credential-access - attack.t1110.001 logsource: product: windows service: smbclient-security detection: selection: EventID: 31017 UserName: '' ServerName|startswith: \1 condition: selection falsepositives: - Account fallback reasons (after failed login with specific account) level: medium
Query: patch priority for CVE-2015-5866
Matching passage: CVE-2015-5866. CWE: CWE-119. CVSS: 9.300000190734863. IOHIDFamily in Apple OS X before 10.11 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Near-miss passage: CVE-2015-3134. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3117, CVE-2015-3123, CVE-2015-3130, CVE-2015-3133, and CVE-2015-4431.
Query: describe CVE-2015-6847
Matching passage: CVE-2015-6847. CWE: CWE-200. CVSS: 2.0999999046325684. The default configuration of EMC VPLEX GeoSynchrony 5.4 SP1 before P3 stores cleartext NAVISPHERE GUI passwords in a log file, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-0785. CWE: CWE-200. CVSS: 7.5. com.novell.zenworks.inventory.rtr.actionclasses.wcreports in Novell ZENworks Configuration Management (ZCM) allows remote attackers to read arbitrary folders via the dirname variable.
Query: risk of Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a 
Matching passage: CVE-2015-8080. CWE: CWE-190. CVSS: 7.5. Integer overflow in the getnum function in lua_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent attackers with permission to run Lua code in a Redis session to cause a denial of service (memory corruption and application crash) or possibly bypass intended sandbox restrictions via a large number, which triggers a stack-based buffer overflow.
Near-miss passage: CVE-2015-5707. CWE: CWE-190. CVSS: 4.599999904632568. Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.
Query: describe CVE-2015-1137
Matching passage: CVE-2015-1137. CWE: UNKNOWN. CVSS: 7.199999809265137. The NVIDIA graphics driver in Apple OS X before 10.10.3 allows local users to gain privileges or cause a denial of service (NULL pointer dereference) via an unspecified IOService userclient type.
Near-miss passage: CVE-2015-8069. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-4825
Matching passage: CVE-2015-4825. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the PeopleSoft Enterprise FIN Expenses component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Expense Report General.
Near-miss passage: CVE-2015-4777. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Query: rule covering Detects COM object hijacking via TreatAs subkey
Matching passage: Sigma rule: Detects COM object hijacking via TreatAs subkey. Logsource: windows / registry_set. Rule: title: Potential COM Object Hijacking Via TreatAs Subkey - Registry id: 9b0f8a61-91b2-464f-aceb-0527e0a45020 status: test description: Detects COM object hijacking via TreatAs subkey references: - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/ author: Kutepov Anton, oscd.community date: 2019-10-23 modified: 2025-10-26 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - HKU\ - Classes\CLSID\ - \TreatAs filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Maybe some system utilities in rare cases use linking keys for backward compatibility level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_persistence_com_key_linking/info.yml simulation: - type: atomic-red-team name: COM hijacking via TreatAs technique: T1546.015 atomic_guid: 33eacead-f117-4863-8eb0-5c6304fbfaa9
Near-miss passage: Sigma rule: Identifies when an EKS cluster is created or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS EKS Cluster Created or Deleted id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0 status: test description: Identifies when an EKS cluster is created or deleted. references: - https://any-api.com/amazonaws_com/eks/docs/API_Description author: Austin Songer date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: product: aws service: cloudtrail detection: selection: eventSource: eks.amazonaws.com eventName: - CreateCluster - DeleteCluster condition: selection falsepositives: - EKS Cluster being created or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Query: EDR alert: possible Cloud Service Hijacking (T1496.004)
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.002 Bandwidth Hijacking. Tactics: impact. Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024) In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
Query: describe CVE-2015-6828
Matching passage: CVE-2015-6828. CWE: CWE-20. CVSS: 6.800000190734863. The tweet_info function in class/__functions.php in the SecureMoz Security Audit plugin 1.0.5 and earlier for WordPress does not use an HTTPS session for downloading serialized data, which allows man-in-the-middle attackers to conduct PHP object injection attacks and execute arbitrary PHP code by modifying the client-server data stream. NOTE: some of these details are obtained from third party information.
Near-miss passage: CVE-2015-1647. CWE: CWE-20. CVSS: 2.0999999046325684. Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of service (VMM functionality loss) via a crafted application, aka "Windows Hyper-V DoS Vulnerability."
Query: patch priority for CVE-2015-2065
Matching passage: CVE-2015-2065. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery (contus-video-gallery) plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-2849. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in main.ant in the ANTlabs InnGate firmware on IG 3100, InnGate 3.01 E, InnGate 3.10 E, InnGate 3.10 M, SG 4, and SSG 4 devices, when https is used, allows remote attackers to execute arbitrary SQL commands via the ppli parameter.