alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects potential suspicious applet or osascript executing "osacompile".
Matching passage: Sigma rule: Detects potential suspicious applet or osascript executing "osacompile".. Logsource: macos / process_creation. Rule: title: Osacompile Execution By Potentially Suspicious Applet/Osascript id: a753a6af-3126-426d-8bd0-26ebbcb92254 status: test description: Detects potential suspicious applet or osascript executing "osacompile". references: - https://redcanary.com/blog/mac-application-bundles/ author: Sohan G (D4rkCiph3r), Red Canary (Idea) date: 2023-04-03 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: ParentImage|endswith: - /applet - /osascript CommandLine|contains: osacompile condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-10045
Matching passage: CVE-2015-10045. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in tutrantta project_todolist. Affected is the function getAffectedRows/where/insert/update in the library library/Database.php. The manipulation leads to sql injection. The name of the patch is 194a0411bbe11aa4813f13c66b9e8ea403539141. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218352.
Near-miss passage: CVE-2015-5703. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the public key discovery API call in Open-Xchange OX Guard before 2.0.0-rev8 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: detect Detects enumeration of local network configuration in logs
Matching passage: Sigma rule: Detects enumeration of local network configuration. Logsource: linux / process_creation. Rule: title: System Network Discovery - Linux id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: Ömer Günal and remotephone, oscd.community date: 2020-10-06 modified: 2022-09-15 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /firewall-cmd - /ufw - /iptables - /netstat - /ss - /ip - /ifconfig - /systemd-resolve - /route selection_cli: CommandLine|contains: /etc/resolv.conf condition: 1 of selection_* falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014 references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-12-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_iex: - ScriptBlockText|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ScriptBlockText|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ScriptBlockText|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ScriptBlockText|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ScriptBlockText|re: \*mdr\*\W\s*\)\.Name - ScriptBlockText|re: \$VerbosePreference\.ToString\( condition: selection_iex falsepositives: - Unknown level: high
Query: describe CVE-2015-0005
Matching passage: CVE-2015-0005. CWE: CWE-254. CVSS: 4.300000190734863. The NETLOGON service in Microsoft Windows Server 2003 SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2, when a Domain Controller is configured, allows remote attackers to spoof the computer name of a secure channel's endpoint, and obtain sensitive session information, by running a crafted application and leveraging the ability to sniff network traffic, aka "NETLOGON Spoofing Vulnerability."
Near-miss passage: CVE-2015-1267. CWE: CWE-254. CVSS: 5.0. Blink, as used in Google Chrome before 43.0.2357.130, does not properly restrict the creation context during creation of a DOM wrapper, which allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that uses a Blink public API, related to WebArrayBufferConverter.cpp, WebBlob.cpp, WebDOMError.cpp, and WebDOMFileSystem.cpp.
Query: patch priority for CVE-2015-0321
Matching passage: CVE-2015-0321. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
Near-miss passage: CVE-2015-2573. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Query: CVE similar to CVE-2015-1726
Matching passage: CVE-2015-1726. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Brush Object Use After Free Vulnerability."
Near-miss passage: CVE-2015-5221. CWE: CWE-416. CVSS: 5.5. Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file.
Query: ATT&CK technique for Modify System Image
Matching passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Near-miss passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Query: patch priority for CVE-2015-7687
Matching passage: CVE-2015-7687. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.
Near-miss passage: CVE-2015-0568. CWE: CWE-416. CVSS: 7.800000190734863. Use-after-free vulnerability in the msm_set_crop function in drivers/media/video/msm/msm_camera.c in the MSM-Camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via an application that makes a crafted ioctl call.
Query: patch priority for CVE-2015-8307
Matching passage: CVE-2015-8307. CWE: CWE-284. CVSS: 7.800000190734863. The Graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application with the graphics permission, aka an "interface access control vulnerability," a different vulnerability than CVE-2015-8680.
Near-miss passage: CVE-2015-3062. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: CVE similar to CVE-2015-8284
Matching passage: CVE-2015-8284. CWE: CWE-284. CVSS: 8.800000190734863. SeaWell Networks Spectrum SDC 02.05.00 allows remote viewer users to perform administrative functions.
Near-miss passage: CVE-2015-4649. CWE: CWE-284. CVSS: 7.199999809265137. Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated administrators to gain root privileges via unspecified vectors, a different vulnerability than CVE-2015-3654.
Query: Sigma rule for Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every
Matching passage: Sigma rule: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every. Logsource: windows / registry_event. Rule: title: Office Application Startup - Office Test id: 3d27f6dd-1c74-4687-b4fa-ca849d128d1c status: test description: Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started references: - https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/ author: omkar72 date: 2020-10-25 modified: 2023-11-08 tags: - attack.persistence - attack.t1137.002 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Software\Microsoft\Office test\Special\Perf condition: selection falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-6484
Matching passage: CVE-2015-6484. CWE: UNKNOWN. CVSS: 5.0. 3S-Smart CODESYS Gateway Server before 2.3.9.48 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted (1) GET or (2) POST request.
Near-miss passage: CVE-2015-5465. CWE: UNKNOWN. CVSS: 7.199999809265137. Silicon Integrated Systems WindowsXP Display Manager (aka VGA Driver Manager and VGA Display Manager) 6.14.10.3930 allows local users to gain privileges via a crafted (1) 0x96002400 or (2) 0x96002404 IOCTL call.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-0549. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum D2 before 4.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-8477. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Redmine before 2.6.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving flash message rendering.
Query: CVE similar to CVE-2015-2012
Matching passage: CVE-2015-2012. CWE: CWE-200. CVSS: 4.0. The MQXR service in WMQ Telemetry in IBM WebSphere MQ 7.1 before 7.1.0.7, 7.5 through 7.5.0.5, and 8.0 before 8.0.0.4 uses world-readable permissions for a cleartext file containing the SSL keystore password, which allows local users to obtain sensitive information by reading this file.
Near-miss passage: CVE-2015-8669. CWE: CWE-200. CVSS: 5.300000190734863. libraries/config/messages.inc.php in phpMyAdmin 4.0.x before 4.0.10.12, 4.4.x before 4.4.15.2, and 4.5.x before 4.5.3.1 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Query: risk of The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticate
Matching passage: CVE-2015-1936. CWE: CWE-284. CVSS: 6.0. The administrative console in IBM WebSphere Application Server (WAS) 8.0.0 before 8.0.0.11 and 8.5 before 8.5.5.6, when the Security feature is disabled, allows remote authenticated users to hijack sessions via the JSESSIONID parameter.
Near-miss passage: CVE-2015-6848. CWE: CWE-284. CVSS: 8.5. EMC Isilon OneFS 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, allows remote authenticated AD users to obtain root privileges via unspecified vectors.
Query: CVE similar to CVE-2015-0495
Matching passage: CVE-2015-0495. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Workbench.
Near-miss passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Query: Sigma rule for Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon proces
Matching passage: Sigma rule: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon proces. Logsource: windows / file_event. Rule: title: Windows Terminal Profile Settings Modification By Uncommon Process id: 9b64de98-9db3-4033-bd7a-f51430105f00 status: test description: Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process. references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile - https://twitter.com/nas_bench/status/1550836225652686848 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.015 logsource: product: windows category: file_event detection: selection: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe TargetFilename|endswith: \AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\settings.json condition: selection falsepositives: - Some false positives may occur with admin scripts that set WT settings. level: medium
Near-miss passage: Sigma rule: Detects the load of a revoked kernel driver. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Revoked Kernel Driver Loaded id: 320fccbf-5e32-4101-82b8-2679c5f007c6 status: test description: Detects the load of a revoked kernel driver references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3021 - 3022 condition: selection falsepositives: - Unlikely level: high
Query: detection rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Matching passage: Sigma rule: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy. Logsource: windows / process_creation. Rule: title: Potential Suspicious Activity Using SeCEdit id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb status: test description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy references: - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit author: Janantha Marasinghe date: 2022-11-18 modified: 2022-12-30 tags: - attack.collection - attack.discovery - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1685.001 - attack.t1547.001 - attack.t1505.005 - attack.t1556.002 - attack.t1685 - attack.t1574.007 - attack.t1564.002 - attack.t1546.008 - attack.t1546.007 - attack.t1547.014 - attack.t1547.010 - attack.t1547.002 - attack.t1557 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \secedit.exe - OriginalFileName: SeCEdit selection_flags_discovery: CommandLine|contains|all: - /export - /cfg selection_flags_configure: CommandLine|contains|all: - /configure - /db condition: selection_img and (1 of selection_flags_*) falsepositives: - Legitimate administrative use level: medium
Near-miss passage: Sigma rule: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity. Logsource: proxy. Rule: title: PwnDrp Access id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e status: test description: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity references: - https://breakdev.org/pwndrop/ author: Florian Roth (Nextron Systems) date: 2020-04-15 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.001 - attack.t1102.003 logsource: category: proxy detection: selection: c-uri|contains: /pwndrop/ condition: selection falsepositives: - Unknown level: critical
Query: exploit Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecifi
Matching passage: CVE-2015-1948. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1929, CVE-2015-1930, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-5871. CWE: CWE-119. CVSS: 7.199999809265137. IOGraphics in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5872, CVE-2015-5873, and CVE-2015-5890.