alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects macOS Gatekeeper bypass via xattr utility
Matching passage: Sigma rule: Detects macOS Gatekeeper bypass via xattr utility. Logsource: macos / process_creation. Rule: title: Gatekeeper Bypass via Xattr id: f5141b6d-9f42-41c6-a7bf-2a780678b29b status: test description: Detects macOS Gatekeeper bypass via xattr utility references: - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md - https://www.loobins.io/binaries/xattr/ author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2024-04-18 tags: - attack.defense-impairment - attack.t1553.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /xattr CommandLine|contains|all: - -d - com.apple.quarantine condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects command execution via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect Command Execution id: 076ebe48-cc05-4d8f-9d41-89245cd93a14 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects command execution via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 200 Data|contains: Executed command of length condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Query: rule covering Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Matching passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.. Logsource: windows / process_creation. Rule: title: Proxy Execution Via Wuauclt.EXE id: af77cf95-c469-471c-b6a0-946c685c4798 related: - id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0 type: obsolete - id: d7825193-b70a-48a4-b992-8b5b3015cc11 type: obsolete status: test description: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution. references: - https://dtm.uk/wuauclt/ - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team date: 2020-10-12 modified: 2023-11-11 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wuauclt.exe - OriginalFileName: wuauclt.exe selection_cli: CommandLine|contains|all: - UpdateDeploymentProvider - RunHandlerComServer filter_main_generic: CommandLine|contains: ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll ' filter_main_wuaueng: CommandLine|contains: ' wuaueng.dll ' filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to MEGA sharing website. Logsource: windows / dns_query. Rule: title: DNS Query To MEGA Hosting Website id: 613c03ba-0779-4a53-8a1f-47f914a4ded3 related: - id: 66474410-b883-415f-9f8d-75345a0a66a6 type: similar status: test description: Detects DNS queries for subdomains related to MEGA sharing website references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ author: Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-26 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: dns_query detection: selection: QueryName|contains: userstorage.mega.co.nz condition: selection falsepositives: - Legitimate DNS queries and usage of Mega level: medium
Query: CVE similar to CVE-2015-9279
Matching passage: CVE-2015-9279. CWE: CWE-79. CVSS: 6.099999904632568. MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.
Near-miss passage: CVE-2015-1979. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Error dialog in IBM Case Manager 5.2.1 before 5.2.1.2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input to the (1) addressability or (2) comments component.
Query: describe CVE-2015-1900
Matching passage: CVE-2015-1900. CWE: CWE-264. CVSS: 7.199999809265137. IBM InfoSphere DataStage 8.1, 8.5, 8.7, 9.1, and 11.3 through 11.3.1.2 on UNIX allows local users to write to executable files, and consequently obtain root privileges, via unspecified vectors.
Near-miss passage: CVE-2015-7052. CWE: CWE-264. CVSS: 7.199999809265137. kext tools in Apple OS X before 10.11.2 mishandles kernel-extension loading, which allows local users to gain privileges via unspecified vectors.
Query: detect Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume in logs
Matching passage: Sigma rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume. Logsource: windows / process_creation. Rule: title: Wlrmdr.EXE Uncommon Argument Or Child Process id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb status: experimental description: 'Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry. ' references: - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/ author: frack113, manasmbellani date: 2022-02-16 modified: 2025-10-31 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \wlrmdr.exe selection_child_img: - Image|endswith: \wlrmdr.exe - OriginalFileName: WLRMNDR.EXE selection_child_cli_flags_s: CommandLine|contains|windash: '-s ' selection_child_cli_flags_f: CommandLine|contains|windash: '-f ' selection_child_cli_flags_t: CommandLine|contains|windash: '-t ' selection_child_cli_flags_m: CommandLine|contains|windash: '-m ' selection_child_cli_flags_a: CommandLine|contains|windash: '-a ' selection_child_cli_flags_u: CommandLine|contains|windash: '-u ' filter_main_winlogon: ParentImage: C:\Windows\System32\winlogon.exe filter_main_empty: ParentImage: - '' - '-' filter_main_null: ParentImage: null condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with m. Logsource: fortigate / event. Rule: title: FortiGate - New VPN SSL Web Portal Added id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2 status: experimental description: 'Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: vpn.ssl.web.portal condition: selection falsepositives: - A VPN SSL Web Portal can be added for legitimate purposes. level: medium
Query: risk of The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtai
Matching passage: CVE-2015-7931. CWE: CWE-20. CVSS: 8.699999809265137. The Java client in Adcon Telemetry A840 Telemetry Gateway Base Station does not authenticate the station device, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information by reading cleartext packet data, related to the lack of SSL support.
Near-miss passage: CVE-2015-4992. CWE: CWE-20. CVSS: 3.5. IBM Sterling B2B Integrator 5.2 before 5020500_8 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors.
Query: mitigate Disable or Modify Tools
Matching passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Near-miss passage: T1685.002 Disable or Modify Cloud Log. Tactics: defense impairment. Description: An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities. For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity. They may alternatively tamper with logging functionality, for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Cloud Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the Set-MailboxAuditBypassAssociation cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading)
Query: detect Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines in logs
Matching passage: Sigma rule: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines. Logsource: windows / process_creation. Rule: title: Suspicious Obfuscated PowerShell Code id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35 status: test description: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines references: - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/ author: Florian Roth (Nextron Systems) date: 2022-07-11 modified: 2023-02-14 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IAAtAGIAeABvAHIAIAAwAHgA - AALQBiAHgAbwByACAAMAB4A - gAC0AYgB4AG8AcgAgADAAeA - AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg - AuAEkAbgB2AG8AawBlACgAKQAgAHwAI - ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC - AHsAMQB9AHsAMAB9ACIAIAAtAGYAI - B7ADEAfQB7ADAAfQAiACAALQBmAC - AewAxAH0AewAwAH0AIgAgAC0AZgAg - AHsAMAB9AHsAMwB9ACIAIAAtAGYAI - B7ADAAfQB7ADMAfQAiACAALQBmAC - AewAwAH0AewAzAH0AIgAgAC0AZgAg - AHsAMgB9AHsAMAB9ACIAIAAtAGYAI - B7ADIAfQB7ADAAfQAiACAALQBmAC - AewAyAH0AewAwAH0AIgAgAC0AZgAg - AHsAMQB9AHsAMAB9ACcAIAAtAGYAI - B7ADEAfQB7ADAAfQAnACAALQBmAC - AewAxAH0AewAwAH0AJwAgAC0AZgAg - AHsAMAB9AHsAMwB9ACcAIAAtAGYAI - B7ADAAfQB7ADMAfQAnACAALQBmAC - AewAwAH0AewAzAH0AJwAgAC0AZgAg - AHsAMgB9AHsAMAB9ACcAIAAtAGYAI - B7ADIAfQB7ADAAfQAnACAALQBmAC - AewAyAH0AewAwAH0AJwAgAC0AZgAg condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / ps_script. Rule: title: Abuse of Service Permissions to Hide Services Via Set-Service - PS id: 953945c5-22fe-4a92-9f8a-a9edc1e522da related: - id: 514e4c3a-c77d-4cde-a00f-046425e2301e type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Set-Service ' - DCLCWPDTSD ScriptBlockText|contains: - '-SecurityDescriptorSddl ' - '-sd ' condition: selection falsepositives: - Rare intended use of hidden services - Rare FP could occur due to the non linearity of the ScriptBlockText log level: high
Query: detect Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. T in logs
Matching passage: Sigma rule: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. T. Logsource: windows / process_creation. Rule: title: File Decoded From Base64/Hex Via Certutil.EXE id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7 status: test description: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/JohnLaTwC/status/835149808817991680 - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2023-02-15 modified: 2025-06-04 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: - '-decode ' - '-decodehex ' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml
Near-miss passage: Sigma rule: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts. Logsource: windows / ps_script. Rule: title: AMSI Bypass Pattern Assembly GetType id: e0d6c087-2d1c-47fd-8799-3904103c5a98 status: test description: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts references: - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA author: Florian Roth (Nextron Systems) date: 2022-11-09 tags: - attack.defense-impairment - attack.t1685 - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-3840
Matching passage: CVE-2015-3840. CWE: CWE-284. CVSS: 5.5. The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS" permission.
Near-miss passage: CVE-2015-0929. CWE: CWE-284. CVSS: 10.0. time.htm in the web interface on SerVision HVG Video Gateway devices with firmware before 2.2.26a78 allows remote attackers to bypass authentication and obtain administrative access by leveraging a cookie received in an HTTP response.
Query: exploit Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows 
Matching passage: CVE-2015-5335. CWE: CWE-200. CVSS: 4.300000190734863. Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
Near-miss passage: CVE-2015-5825. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.
Query: describe CVE-2015-1773
Matching passage: CVE-2015-1773. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in asdoc/templates/index.html in Apache Flex before 4.14.1 allows remote attackers to inject arbitrary web script or HTML by providing a crafted URI to JavaScript code generated by the asdoc component.
Near-miss passage: CVE-2015-6416. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Email Interaction Manager and Unified Web Interaction Manager 11.0(1) allows remote attackers to inject arbitrary web script or HTML a crafted URL, aka Bug ID CSCuw24479.
Query: hunt for Control Panel activity
Matching passage: T1218.002 Control Panel. Tactics: stealth. Description: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a <code>CPlApplet</code> function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</code>. Even when these registered DLLs do not comply with the CPL file specification and do not export <code>CPlApplet</code> functions, they are loaded and executed through its <code>DllEntryPoint</code> when Control Panel is executed. CPL files not exporting <code>CPlApplet</code> are not directly executable.(Citation: ESET InvisiMole June 2020)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: exploit Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot do
Matching passage: CVE-2015-4425. CWE: CWE-22. CVSS: 4.900000095367432. Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Near-miss passage: CVE-2015-6914. CWE: CWE-22. CVSS: 7.800000190734863. Absolute path traversal vulnerability in SiteFactory CMS 5.5.9 allows remote attackers to read arbitrary files via a full pathname in the file parameter to assets/download.aspx.
Query: describe CVE-2015-7516
Matching passage: CVE-2015-7516. CWE: CWE-476. CVSS: 7.5. ONOS before 1.5.0 when using the ifwd app allows remote attackers to cause a denial of service (NULL pointer dereference and switch disconnect) by sending two Ethernet frames with ether_type Jumbo Frame (0x8870).
Near-miss passage: CVE-2015-9072. CWE: CWE-476. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.