alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possib
Matching passage: CVE-2015-8684. CWE: CWE-79. CVSS: 6.099999904632568. Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.
Near-miss passage: CVE-2015-6255. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Web and E-Mail Interaction Manager 9.0(2) allows remote attackers to inject arbitrary web script or HTML via a crafted chat message, aka Bug ID CSCuo89051.
Query: write Sigma for Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode
Matching passage: Sigma rule: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode. Logsource: windows / system. Rule: title: Local Privilege Escalation Indicator TabTip id: bc2e25ed-b92b-4daa-b074-b502bdd1982b status: test description: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode references: - https://github.com/antonioCoco/JuicyPotatoNG author: Florian Roth (Nextron Systems) date: 2022-10-07 modified: 2023-04-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-DistributedCOM EventID: 10001 param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe param2: 2147943140 param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Masquerading as System Processes id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab status: experimental description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1036.004 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains|windash: ' /create ' CommandLine|contains: - ' audiodg' - ' conhost' - ' dwm.exe' - ' explorer' - ' lsass' - ' lsm' - ' mmc' - ' msiexec' - ' regsvr32' - ' rundll32' - ' services' - ' spoolsv' - ' svchost' - ' taskeng' - ' taskhost' - ' wininit' - ' winlogon' condition: all of selection_* falsepositives: - Legitimate system administration tasks scheduling trusted system processes. level: high
Query: explain CWE-799
Matching passage: CWE-799 Improper Control of Interaction Frequency. The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
Near-miss passage: CWE-1287 Improper Validation of Specified Type of Input. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
Query: risk of SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands 
Matching passage: CVE-2015-6811. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Sophos Cyberoam CR500iNG-XP firewall appliance with CyberoamOS 10.6.2 MR-1 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to login.xml.
Near-miss passage: CVE-2015-9400. CWE: CWE-89. CVSS: 8.800000190734863. The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection.
Query: describe CVE-2015-0466
Matching passage: CVE-2015-0466. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Retail Back Office component in Oracle Retail Applications 12.0, 12.0IN, 13.0, 13.1, 13.2, 13.3, 13.4, 14.0, and 14.1 allows remote attackers to affect integrity via unknown vectors.
Near-miss passage: CVE-2015-4798. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener, a different vulnerability than CVE-2015-4839.
Query: patch priority for CVE-2015-5841
Matching passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Near-miss passage: CVE-2015-0116. CWE: CWE-74. CVSS: 3.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Query: Multiple failed authentications followed by Purchase Technical Data
Matching passage: T1597.002 Purchase Technical Data. Tactics: reconnaissance. Description: Adversaries may purchase technical information about victims that can be used during targeting. Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services. Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets. Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches. Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.(Citation: ZDNET Selling Data) Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Valid Accounts](https://attack.mitre.org/techniques/T1078)).
Near-miss passage: T1597.001 Threat Intel Vendors. Tactics: reconnaissance. Description: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.(Citation: D3Secutrity CTI Feeds) Adversaries may search in private threat intelligence vendor data to gather actionable information. If a threat actor is searching for information on their own activities, that falls under [Search Threat Vendor Data](https://attack.mitre.org/techniques/T1681). Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190) or [External Remote Services](https://attack.mitre.org/techniques/T1133)).
Query: intelligence brief on T1653
Matching passage: T1653 Power Settings. Tactics: persistence. Description: Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate) Adversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux) For example, `powercfg` controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users) Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER: The Evasive Downloader Malware) Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign) Aware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries)
Near-miss passage: T1546.005 Trap. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an atta. Logsource: aws / cloudtrail. Rule: title: Ingress/Egress Security Group Modification id: 6fb77778-040f-4015-9440-572aa9b6b580 status: test description: 'Detects when an account makes changes to the ingress or egress rules of a security group. This can indicate that an attacker is attempting to open up new attack vectors in the account, that they are trying to exfiltrate data over the network, or that they are trying to allow machines in that VPC/Subnet to contact a C&C server. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: - AuthorizeSecurityGroupEgress - AuthorizeSecurityGroupIngress - RevokeSecurityGroupEgress - RevokeSecurityGroupIngress condition: selection falsepositives: - New VPCs and Subnets being setup requiring a different security profile to those already defined - A single port being opened for a new service that is known to be deploying - Administrators closing unused ports to reduce the attack surface level: medium
Near-miss passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / ps_script. Rule: title: Root Certificate Installed - PowerShell id: 42821614-9264-4761-acfc-5772c3286f76 status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-10 modified: 2022-12-02 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains|all: - Move-Item - Cert:\LocalMachine\Root selection2: ScriptBlockText|contains|all: - Import-Certificate - Cert:\LocalMachine\Root condition: 1 of selection* falsepositives: - Help Desk or IT may need to manually add a corporate Root CA on occasion. Need to test if GPO push doesn't trigger FP level: medium
Query: CVE similar to CVE-2015-7179
Matching passage: CVE-2015-7179. CWE: CWE-119. CVSS: 7.5. The VertexBufferInterface::reserveVertexSpace function in libGLES in ANGLE, as used in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows, incorrectly allocates memory for shader attribute arrays, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via crafted (1) OpenGL or (2) WebGL content.
Near-miss passage: CVE-2015-5791. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: describe CVE-2015-0360
Matching passage: CVE-2015-0360. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-4753. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the RDBMS Support Tools component in Oracle Database Server 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows local users to affect confidentiality via unknown vectors.
Query: patch priority for CVE-2015-5125
Matching passage: CVE-2015-5125. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to cause a denial of service (vector-length corruption) or possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-7117. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7089, CVE-2015-7090, CVE-2015-7091, and CVE-2015-7092.
Query: detection rule: Detects when storage bucket is modified or deleted in Google Cloud.
Matching passage: Sigma rule: Detects when storage bucket is modified or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Modified or Deleted id: 4d9f2ee2-c903-48ab-b9c1-8c0f474913d0 status: test description: Detects when storage bucket is modified or deleted in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.delete - storage.buckets.insert - storage.buckets.update - storage.buckets.patch condition: selection falsepositives: - Storage Buckets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects loaded kernel modules that did not meet the WHQL signing requirements.. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module id: 2f8cd7a0-9d5a-4f62-9f8b-2c951aa0dd1f status: test description: Detects loaded kernel modules that did not meet the WHQL signing requirements. references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 modified: 2023-06-14 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3082 - 3083 filter_optional_vmware: FileNameBuffer: - system32\drivers\vsock.sys - System32\drivers\vmci.sys condition: selection and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-3808
Matching passage: CVE-2015-3808. CWE: CWE-189. CVSS: 7.800000190734863. The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Near-miss passage: CVE-2015-7869. CWE: CWE-189. CVSS: 6.599999904632568. Multiple integer overflows in the kernel mode driver for the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows and R304 before 304.131, R340 before 340.96, R352 before 352.63, and R358 before 358.16 on Linux allow local users to obtain sensitive information, cause a denial of service (crash), or possibly gain privileges via unknown vectors, which trigger uninitialized or out of bounds memory access. NOTE: this identifier has been SPLIT per ADT2 and ADT3 due to different vulnerability type and affected versions. See CVE-2015-8328 for the vulnerability in the NVAPI support layer in NVIDIA drivers for Windows.
Query: exploit Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with
Matching passage: CVE-2015-5513. CWE: CWE-79. CVSS: 2.0999999046325684. Cross-site scripting (XSS) vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login link.
Near-miss passage: CVE-2015-2347. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Huawei SEQ Analyst before V200R002C03LG0001CP0022 allows remote attackers to inject arbitrary web script or HTML via the command XML element in the req parameter to flexdata.action in (1) common/, (2) monitor/, or (3) psnpm/ or the (4) module XML element in the req parameter to flexdata.action in monitor/.
Query: exploit Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a c
Matching passage: CVE-2015-4084. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-3174. CWE: CWE-79. CVSS: 3.5. mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Query: exploit The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *
Matching passage: CVE-2015-8547. CWE: CWE-17. CVSS: 7.5. The CoreUserInputHandler::doMode function in core/coreuserinputhandler.cpp in Quassel 0.10.0 allows remote attackers to cause a denial of service (application crash) via the "/op *" command in a query.
Near-miss passage: CVE-2015-3334. CWE: CWE-17. CVSS: 4.300000190734863. browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited.
Query: vulnerability: The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or caus
Matching passage: CVE-2015-7111. CWE: CWE-119. CVSS: 9.300000190734863. The IOHIDFamily API in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-7112.
Near-miss passage: CVE-2015-2061. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified attribute.
Query: risk of Console: CORS headers set to allow all in Red Hat AMQ.
Matching passage: CVE-2015-5184. CWE: UNKNOWN. CVSS: 7.5. Console: CORS headers set to allow all in Red Hat AMQ.
Near-miss passage: CVE-2015-1775. CWE: UNKNOWN. CVSS: 5.5. Server-side request forgery (SSRF) vulnerability in the proxy endpoint (api/v1/proxy) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
Query: risk of IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Matching passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Near-miss passage: CVE-2015-3721. CWE: CWE-200. CVSS: 4.300000190734863. The kernel in Apple iOS before 8.4 and OS X before 10.10.4 does not properly handle HFS parameters, which allows attackers to obtain sensitive memory-layout information via a crafted app.