alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e in logs
Matching passage: Sigma rule: Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS e. Logsource: aws / cloudtrail. Rule: title: AWS IAM Backdoor Users Keys id: 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2 status: test description: 'Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org. ' references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: iam.amazonaws.com eventName: CreateAccessKey filter: userIdentity.arn|contains: responseElements.accessKey.userName condition: selection_source and not filter falsepositives: - Adding user keys to their own accounts (the filter cannot cover all possible variants of user naming) - AWS API keys legitimate exchange workflows level: medium
Near-miss passage: Sigma rule: Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker lev. Logsource: windows / firewall-as. Rule: title: New Firewall Rule Added In Windows Firewall Exception List Via WmiPrvSE.EXE id: eca81e8d-09e1-4d04-8614-c91f44fd0519 status: test description: 'Detects the addition of a new "Allow" firewall rule by the WMI process (WmiPrvSE.EXE). This can occur if an attacker leverages PowerShell cmdlets such as "New-NetFirewallRule", or directly uses WMI CIM classes such as "MSFT_NetFirewallRule". ' references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170 - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 Action: 3 ModifyingApplication|endswith: :\Windows\System32\wbem\WmiPrvSE.exe condition: selection falsepositives: - Administrator scripts or activity. level: medium
Query: vulnerability: The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allow
Matching passage: CVE-2015-3906. CWE: CWE-119. CVSS: 5.0. The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.
Near-miss passage: CVE-2015-6084. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6064 and CVE-2015-6085.
Query: describe CVE-2015-3780
Matching passage: CVE-2015-3780. CWE: CWE-200. CVSS: 4.300000190734863. The Bluetooth subsystem in Apple OS X before 10.10.5 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
Near-miss passage: CVE-2015-0628. CWE: CWE-200. CVSS: 5.0. The proxy engine on Cisco Web Security Appliance (WSA) devices allows remote attackers to bypass intended proxying restrictions via a malformed HTTP method, aka Bug ID CSCus79174.
Query: SOC runbook when seeing Encoded PowerShell / command-line abuse matching Search Open Websites/Domains
Matching passage: Playbook for T1593 Search Open Websites/Domains. 1) Validate alert telemetry against T1593. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting. Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.(Citation: Cyware Social Media)(Citation: SecurityTrails Google Hack
Near-miss passage: Playbook for T1593.001 Social Media. Different response path focused on reconnaissance.
Query: exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allo
Matching passage: CVE-2015-0464. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, and 6.3.6 allows remote attackers to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-0468. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, and 12.1.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: threat report mentioning Hardware Additions
Matching passage: T1200 Hardware Additions. Tactics: initial access. Description: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused. While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
Near-miss passage: T1195.003 Compromise Hardware Supply Chain. Tactics: initial access. Description: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise. By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system. Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.
Query: exploit The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of se
Matching passage: CVE-2015-0593. CWE: CWE-399. CVSS: 7.099999904632568. The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003.
Near-miss passage: CVE-2015-6422. CWE: CWE-399. CVSS: 4.0. The self-service application in Cisco Unified Communications Domain Manager (CUCDM) 10.6(1) allows remote authenticated users to cause a denial of service (subapplication outage) via malformed requests, aka Bug ID CSCuu10981.
Query: patch priority for CVE-2015-2458
Matching passage: CVE-2015-2458. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability," a different vulnerability than CVE-2015-2459 and CVE-2015-2461.
Near-miss passage: CVE-2015-6318. CWE: CWE-20. CVSS: 6.900000095367432. Cisco TelePresence Video Communication Server (VCS) Expressway X8.5.1 and X8.5.2 allows local users to write to arbitrary files via an unspecified symlink attack, aka Bug ID CSCuv11969.
Query: exploit Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML
Matching passage: CVE-2015-1383. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the geo search widget in the Geo Mashup plugin before 1.8.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the search key.
Near-miss passage: CVE-2015-1404. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-1123
Matching passage: CVE-2015-1123. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3 and Apple TV before 7.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-3 and APPLE-SA-2015-04-08-4.
Near-miss passage: CVE-2015-8435. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: CVE similar to CVE-2015-2640
Matching passage: CVE-2015-2640. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4777, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-8049. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted autoSize property value, a different vulnerability than CVE-2015-8048, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode us
Matching passage: CVE-2015-7082. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in Git before 2.5.4, as used in Apple Xcode before 7.2, have unknown impact and attack vectors. NOTE: this CVE is associated only with Xcode use cases.
Near-miss passage: CVE-2015-8616. CWE: UNKNOWN. CVSS: 8.600000381469727. Use-after-free vulnerability in the Collator::sortWithSortKeys function in ext/intl/collator/collator_sort.c in PHP 7.x before 7.0.1 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging the relationships between a key buffer and a destroyed array.
Query: Sigma rule for Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li
Matching passage: Sigma rule: Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory li. Logsource: windows / process_creation. Rule: title: Suspicious Usage of For Loop with Recursive Directory Search in CMD id: 2782fbd8-b662-4eb5-9962-5bfbfb671e7b status: experimental description: 'Detects suspicious usage of the cmd.exe ''for /f'' loop combined with the ''tokens='' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files. ' references: - https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2025-11-12 tags: - attack.execution - attack.stealth - attack.t1059.003 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_tokens: CommandLine|contains|all: - for /f - tokens= - in ( - dir selection_tokens_parent: ParentCommandLine|contains|all: - for /f - tokens= - in ( - dir condition: 1 of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral mo. Logsource: windows / smbserver-connectivity. Rule: title: Unsigned or Unencrypted SMB Connection to Share Established id: 8d91f6e4-9f3b-4c21-ae41-2c5b7d9f7a12 status: experimental description: 'Detects SMB server connections to shares without signing or encryption enabled. This could indicate potential lateral movement activity using unsecured SMB shares. ' author: Mohamed Abdelghani date: 2025-10-19 references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: smbserver-connectivity detection: selection_shares: EventID: 4000 ShareName|contains: - IPC$ - ADMIN$ - C$ selection_status: - SigningUsed: 'false' - EncyptionUsed: 'false' filter_main_local_ips: - ClientAddress|cidr: - 127.0.0.0/8 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 - ClientAddress|contains: - '00000000000000000000000000000001' - FE80000000000000 - FC00000000000000 - 0200????7F - 0200????A9FE condition: all of selection_* and not 1 of filter_main_* falsepositives: - Connections from local or private IP addresses to SMB shares without signing or encryption enabled for older systems or misconfigured environments. Apply additional tuning as needed. level: medium
Query: patch priority for CVE-2015-2541
Matching passage: CVE-2015-2541. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2491.
Near-miss passage: CVE-2015-3776. CWE: CWE-119. CVSS: 9.300000190734863. IOKit in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption and application crash) via a malformed plist.
Query: Sigma rule for Detects the addition of a new user to a privileged group such as "root" or "sudo"
Matching passage: Sigma rule: Detects the addition of a new user to a privileged group such as "root" or "sudo". Logsource: linux. Rule: title: Privileged User Has Been Created id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e status: test description: Detects the addition of a new user to a privileged group such as "root" or "sudo" references: - https://digital.nhs.uk/cyber-alerts/2018/cc-2825 - https://linux.die.net/man/8/useradd - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid author: Pawel Mazur date: 2022-12-21 modified: 2025-01-21 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: linux definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work detection: selection_new_user: - new user selection_uids_gids: - GID=0, - UID=0, - GID=10, - GID=27, condition: all of selection_* falsepositives: - Administrative activity level: high
Near-miss passage: Sigma rule: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious pare. Logsource: windows / process_creation. Rule: title: Suspicious WMIC Execution Via Office Process id: e1693bc8-7168-4eab-8718-cdcaa68a1738 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0 type: obsolete - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5 type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin). references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml author: Vadim Khrykov, Cyb3rEng date: 2021-08-23 modified: 2023-02-14 tags: - attack.stealth - attack.t1204.002 - attack.t1047 - attack.t1218.010 - attack.execution logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.EXE - \EQNEDT32.EXE - \ONENOTE.EXE - \wordpad.exe - \wordview.exe selection_wmic_img: - Image|endswith: \wbem\WMIC.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains|all: - process - create - call CommandLine|contains: - regsvr32 - rundll32 - msiexec - mshta - verclsid - wscript - cscript condition: all of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-6523
Matching passage: CVE-2015-6523. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Portfolio plugin before 1.05 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the instagram-portfolio page in wp-admin/options-general.php.
Near-miss passage: CVE-2015-5991. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in form2WlanSetup.cgi on Philippine Long Distance Telephone (PLDT) SpeedSurf 504AN devices with firmware GAN9.8U26-4-TX-R6B018-PH.EN and Kasda KW58293 devices allows remote attackers to hijack the authentication of administrators for requests that perform setup operations, as demonstrated by modifying network settings.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA617
Matching passage: CVE-2015-9220. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.
Near-miss passage: CVE-2015-9219. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, an integer overflow to buffer overflow can occur in a DRM API.
Query: describe CVE-2015-4759
Matching passage: CVE-2015-4759. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality based on Trillium, a different vulnerability than CVE-2015-0443, CVE-2015-0444, CVE-2015-0445, CVE-2015-0446, CVE-2015-2634, CVE-2015-2635, CVE-2015-2636, and CVE-2015-4758.
Near-miss passage: CVE-2015-0338. CWE: UNKNOWN. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code via unspecified vectors.