alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-0339
Matching passage: CVE-2015-0339. CWE: CWE-399. CVSS: 10.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0332, CVE-2015-0333, and CVE-2015-0335.
Near-miss passage: CVE-2015-1745. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1735, CVE-2015-1740, CVE-2015-1744, and CVE-2015-1766.
Query: vulnerability: SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL command
Matching passage: CVE-2015-8334. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in the Operation and Maintenance Unit (OMU) in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request.
Near-miss passage: CVE-2015-10023. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability classified as critical has been found in Fumon trello-octometric. This affects the function main of the file metrics-ui/server/srv.go. The manipulation of the argument num leads to sql injection. The patch is named a1f1754933fbf21e2221fbc671c81a47de6a04ef. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217611.
Query: describe CVE-2015-6470
Matching passage: CVE-2015-6470. CWE: UNKNOWN. CVSS: 5.5. Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors.
Near-miss passage: CVE-2015-0486. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Query: patch priority for CVE-2015-7553
Matching passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Near-miss passage: CVE-2015-0572. CWE: CWE-362. CVSS: 7.0. Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.
Query: risk of Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1623. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0056 and CVE-2015-1626.
Near-miss passage: CVE-2015-2757. CWE: CWE-399. CVSS: 4.0. The ePO extension in McAfee Data Loss Prevention Endpoint (DLPe) before 9.3 Patch 4 Hotfix 16 (9.3.416.4) allows remote authenticated users to cause a denial of service (database lock or license corruption) via unspecified vectors.
Query: patch priority for CVE-2015-5240
Matching passage: CVE-2015-5240. CWE: CWE-362. CVSS: 3.5. Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.
Near-miss passage: CVE-2015-7613. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
Query: exploit The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and
Matching passage: CVE-2015-2963. CWE: CWE-79. CVSS: 4.300000190734863. The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg.
Near-miss passage: CVE-2015-6400. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Emergency Responder 10.5(1a) allow remote attackers to inject arbitrary web script or HTML via unspecified fields, aka Bug ID CSCuv25547.
Query: patch priority for CVE-2015-3705
Matching passage: CVE-2015-3705. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
Near-miss passage: CVE-2015-5133. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.
Query: describe CVE-2015-5282
Matching passage: CVE-2015-5282. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after.
Near-miss passage: CVE-2015-7879. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page.
Query: patch priority for CVE-2015-5248
Matching passage: CVE-2015-5248. CWE: CWE-20. CVSS: 6.5. Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
Near-miss passage: CVE-2015-9212. CWE: CWE-20. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SD 800, lack of input validation while processing TZ_PR_CMD_SAVE_KEY command could lead to a buffer overread.
Query: describe CVE-2015-7258
Matching passage: CVE-2015-7258. CWE: CWE-255. CVSS: 8.800000190734863. ZTE ADSL ZXV10 W300 modems W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection.
Near-miss passage: CVE-2015-3252. CWE: CWE-255. CVSS: 9.800000190734863. Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server.
Query: intelligence brief on T1218.004
Matching passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Near-miss passage: T1218.008 Odbcconf. Tactics: stealth. Description: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Query: vulnerability: In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Matching passage: CVE-2015-9034. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow.
Near-miss passage: CVE-2015-9262. CWE: CWE-119. CVSS: 9.800000190734863. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Query: risk of Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
Matching passage: CVE-2015-2991. CWE: CWE-119. CVSS: 6.800000190734863. Buffer overflow in NScripter before 3.00 allows remote attackers to execute arbitrary code via crafted save data.
Near-miss passage: CVE-2015-4482. CWE: CWE-119. CVSS: 4.599999904632568. mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.
Query: vulnerability: Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (application crash) or pos
Matching passage: CVE-2015-7508. CWE: CWE-787. CVSS: 8.800000190734863. Heap-based buffer overflow in the bmp_decode_rle function in libnsbmp.c in Libnsbmp 0.1.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via the last row of RLE data in a crafted BMP file.
Near-miss passage: CVE-2015-6696. CWE: CWE-787. CVSS: 6.800000190734863. Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6698.
Query: exploit Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" pe
Matching passage: CVE-2015-8233. CWE: CWE-79. CVSS: 2.5999999046325684. Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings.
Near-miss passage: CVE-2015-2976. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Research Artisan Lite before 1.18 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted HTML document or (2) a crafted URL that is mishandled during access-log analysis.
Query: write Sigma for Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.
Matching passage: Sigma rule: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP IP Pattern id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8 status: test description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-24 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_ip: CommandLine|contains: - ' /i:http://1' - ' /i:http://2' - ' /i:http://3' - ' /i:http://4' - ' /i:http://5' - ' /i:http://6' - ' /i:http://7' - ' /i:http://8' - ' /i:http://9' - ' /i:https://1' - ' /i:https://2' - ' /i:https://3' - ' /i:https://4' - ' /i:https://5' - ' /i:https://6' - ' /i:https://7' - ' /i:https://8' - ' /i:https://9' - ' -i:http://1' - ' -i:http://2' - ' -i:http://3' - ' -i:http://4' - ' -i:http://5' - ' -i:http://6' - ' -i:http://7' - ' -i:http://8' - ' -i:http://9' - ' -i:https://1' - ' -i:https://2' - ' -i:https://3' - ' -i:https://4' - ' -i:https://5' - ' -i:https://6' - ' -i:https://7' - ' -i:https://8' - ' -i:https://9' condition: all of selection_* falsepositives: - FQDNs that start with a number such as "7-Zip" level: high
Near-miss passage: Sigma rule: Detects usage of the 'crontab' utility to remove the current crontab. This is a common occurrence where cryptocurrency m. Logsource: linux / process_creation. Rule: title: Remove Scheduled Cron Task/Job id: c2e234de-03a3-41e1-b39a-1e56dc17ba67 status: test description: 'Detects usage of the ''crontab'' utility to remove the current crontab. This is a common occurrence where cryptocurrency miners compete against each other by removing traces of other miners to hijack the maximum amount of resources possible ' references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.stealth logsource: category: process_creation product: linux detection: selection: Image|endswith: crontab CommandLine|contains: ' -r' condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-6053
Matching passage: CVE-2015-6053. CWE: CWE-200. CVSS: 5.0. Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via crafted parameters in an ArrayBuffer.slice call, aka "Internet Explorer Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-2044. CWE: CWE-200. CVSS: 2.0999999046325684. The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a 
Matching passage: CVE-2015-2315. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the target parameter in a reminder_popup action to the default URI.
Near-miss passage: CVE-2015-0513. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging privileged access to set crafted values of unspecified fields.
Query: describe CVE-2015-7602
Matching passage: CVE-2015-7602. CWE: CWE-22. CVSS: 7.800000190734863. Directory traversal vulnerability in BisonWare BisonFTP 3.5 allows remote attackers to read arbitrary files via a ../ (dot dot slash) in a RETR command.
Near-miss passage: CVE-2015-5322. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to list directory contents and read arbitrary files in the Jenkins servlet resources via directory traversal sequences in a request to jnlpJars/.
Query: risk of Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID C
Matching passage: CVE-2015-0751. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
Near-miss passage: CVE-2015-4393. CWE: CWE-20. CVSS: 6.0. The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
Query: describe CVE-2015-7881
Matching passage: CVE-2015-7881. CWE: CWE-284. CVSS: 3.5. The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment.
Near-miss passage: CVE-2015-0660. CWE: CWE-284. CVSS: 7.199999809265137. Cisco Virtual TelePresence Server Software does not properly restrict use of the serial port, which allows local users to execute arbitrary OS commands as root by leveraging vSphere controller administrative privileges, aka Bug ID CSCus61123.
Query: rule covering Detects potentially suspicious child processes of "GoogleUpdate.exe"
Matching passage: Sigma rule: Detects potentially suspicious child processes of "GoogleUpdate.exe". Logsource: windows / process_creation. Rule: title: Potentially Suspicious GoogleUpdate Child Process id: 84b1ecf9-6eff-4004-bafb-bae5c0e251b2 related: - id: bdbab15a-3826-48fa-a1b7-723cd8f32fcc type: derived status: test description: Detects potentially suspicious child processes of "GoogleUpdate.exe" references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-05-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \GoogleUpdate.exe filter_main_known_legit: - Image|contains: \Google - Image|endswith: - \setup.exe - chrome_updater.exe - chrome_installer.exe filter_main_image_null: Image: null condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects disabling Windows Defender Tamper Protection. Logsource: windows / registry_set. Rule: title: Disable Tamper Protection on Windows Defender id: 93d298a1-d28f-47f1-a468-d971e7796679 status: test description: Detects disabling Windows Defender Tamper Protection references: - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Features\TamperProtection Details: DWORD (0x00000000) filter_msmpeng_client: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_msmpeng_domain_controller: Image: C:\Program Files\Windows Defender\MsMpEng.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Query: telemetry for T1613
Matching passage: T1613 Container and Resource Discovery. Tactics: discovery. Description: Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Near-miss passage: T1124 System Time Discovery. Tactics: discovery. Description: An adversary may gather the system time and/or time zone settings from a local or remote system. The system time is set and stored by services, such as the Windows Time Service on Windows or <code>systemsetup</code> on macOS.(Citation: MSDN System Time)(Citation: Technet Windows Time Service)(Citation: systemsetup mac time) These time settings may also be synchronized between systems and services in an enterprise network, typically accomplished with a network time server within a domain.(Citation: Mac Time Sync)(Citation: linux system time) System time information may be gathered in a number of ways, such as with [Net](https://attack.mitre.org/software/S0039) on Windows by performing <code>net time \\hostname</code> to gather the system time on a remote system. The victim's time zone may also be inferred from the current system time or gathered by using <code>w32tm /tz</code>.(Citation: Technet Windows Time Service) In addition, adversaries can discover device uptime through functions such as <code>GetTickCount()</code> to determine how long it has been since the system booted up.(Citation: Virtualization/Sandbox Evasion) On network devices, [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as `show clock detail` can be used to see the current time configuration.(Citation: show_clock_detail_cisco_cmd) On ESXi servers, `esxcli system clock get` can be used for the same purpose. In addition, system calls – such as <code>time()</code> – have been used to collect the current time on Linux devices.(Citation: MAGNET GOBLIN) On macOS systems, adversaries may use commands such as <code>systemsetup -gettimezone</code> or <code>timeIntervalSinceNow</code> to gather current time zone information or current date and time.(Citation: System Information Discovery Technique)(Citation: ESET DazzleSpy Jan 2022) This information could be useful for performing other techniques, such as executing a file with a [Scheduled Task/Job](https://attack.mitre.org
Query: weakness Incorrect Chaining or Granularity of Debug Components
Matching passage: CWE-1296 Incorrect Chaining or Granularity of Debug Components. The product's debug components contain incorrect chaining or granularity of debug components.
Near-miss passage: CWE-157 Failure to Sanitize Paired Delimiters. The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.