alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a memory management routine.
Matching passage: CVE-2015-9055. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an assertion was potentially reachable in a memory management routine.
Near-miss passage: CVE-2015-8740. CWE: CWE-20. CVSS: 5.300000190734863. The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number of columns, which allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) via a crafted packet.
Query: campaign using Revert Cloud Instance
Matching passage: T1578.004 Revert Cloud Instance. Tactics: defense impairment. Description: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence. In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs. Another variation of this technique is to utilize temporary storage attached to the compute instance. Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.(Citation: Tech Republic - Restore AWS Snapshots)(Citation: Google - Restore Cloud Snapshot)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: CVE similar to CVE-2015-0362
Matching passage: CVE-2015-0362. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7 allows remote attackers to affect confidentiality via unknown vectors related to BI Publisher Security.
Near-miss passage: CVE-2015-4952. CWE: UNKNOWN. CVSS: 8.800000190734863. The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary code via unspecified vectors. IBM X-Force ID: 105196.
Query: patch priority for CVE-2015-4109
Matching passage: CVE-2015-4109. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in the ratings module in the Users Ultra plugin before 1.5.16 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) data_target or (2) data_vote parameter in a rating_vote (wp_ajax_nopriv_rating_vote) action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-4342. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving a cdef id.
Query: CVE similar to CVE-2015-0861
Matching passage: CVE-2015-0861. CWE: CWE-264. CVSS: 4.300000190734863. model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.
Near-miss passage: CVE-2015-8660. CWE: CWE-264. CVSS: 6.699999809265137. The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
Query: detection rule: Detects when storage bucket is enumerated in Google Cloud.
Matching passage: Sigma rule: Detects when storage bucket is enumerated in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Storage Buckets Enumeration id: e2feb918-4e77-4608-9697-990a1aaf74c3 status: test description: Detects when storage bucket is enumerated in Google Cloud. references: - https://cloud.google.com/storage/docs/json_api/v1/buckets author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.discovery logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - storage.buckets.list - storage.buckets.listChannels condition: selection falsepositives: - Storage Buckets being enumerated may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Storage Buckets enumerated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indic. Logsource: linux / file_event. Rule: title: Persistence Via Sudoers.d Files id: ddb26b76-4447-4807-871f-1b035b2bfa5d status: test description: 'Detects the creation or modification of files within the "sudoers.d" directory on Linux systems. Such activity may indicate an attempt to establish or maintain privilege escalation by granting specific users elevated permissions. Unauthorized changes to sudoers files are a common technique used by attackers to persist administrative access. ' references: - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2026-03-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1548.003 logsource: product: linux category: file_event detection: selection: TargetFilename|startswith: /etc/sudoers.d/ filter_main_dpkg: Image|endswith: /usr/bin/dpkg TargetFilename: /etc/sudoers.d/README.dpkg-new condition: selection and not 1 of filter_main_* falsepositives: - Creation of legitimate files in sudoers.d folder as part of administrator work level: medium
Query: detect Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120 in logs
Matching passage: Sigma rule: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120. Logsource: windows / process_creation. Rule: title: HackTool - SysmonEOP Execution id: 8a7e90c5-fe6e-45dc-889e-057fe4378bd9 status: test description: Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120 references: - https://github.com/Wh04m1001/SysmonEoP author: Florian Roth (Nextron Systems) date: 2022-12-04 modified: 2024-11-23 tags: - cve.2022-41120 - attack.t1068 - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \SysmonEOP.exe selection_hash: Hashes|contains: - IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5 - IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC condition: 1 of selection_* falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate admin. Logsource: windows / process_creation. Rule: title: Renamed PsExec Service Execution id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4 status: test description: Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.youtube.com/watch?v=ro2QuZTIMBM author: Florian Roth (Nextron Systems) date: 2022-07-21 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: OriginalFileName: psexesvc.exe filter: Image: C:\Windows\PSEXESVC.exe condition: selection and not filter falsepositives: - Legitimate administrative tasks level: high
Query: exploit SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL command
Matching passage: CVE-2015-1364. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
Near-miss passage: CVE-2015-3934. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.
Query: describe CVE-2015-6351
Matching passage: CVE-2015-6351. CWE: CWE-20. CVSS: 5.0. Cisco ASR 5500 System Architecture Evolution (SAE) Gateway devices with software 19.1.0.61559 and 19.2.0 allow remote attackers to cause a denial of service (BGP process restart) via a crafted header in a BGP packet, aka Bug ID CSCuw65781.
Near-miss passage: CVE-2015-8373. CWE: CWE-20. CVSS: 6.800000190734863. The kea-dhcp4 and kea-dhcp6 servers 0.9.2 and 1.0.0-beta in ISC Kea, when certain debugging settings are used, allow remote attackers to cause a denial of service (daemon crash) via a malformed packet.
Query: patch priority for CVE-2015-4739
Matching passage: CVE-2015-4739. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2 allows remote authenticated users to affect integrity via unknown vectors related to Help screens.
Near-miss passage: CVE-2015-3175. CWE: UNKNOWN. CVSS: 5.800000190734863. Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
Query: rule covering Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.
Matching passage: Sigma rule: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.. Logsource: azure / auditlogs. Rule: title: PIM Approvals And Deny Elevation id: 039a7469-0296-4450-84c0-f6966b16dc6d status: test description: Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Request Approved/Denied condition: selection falsepositives: - Actual admin using PIM. level: high
Near-miss passage: Sigma rule: Detects suspicious connections from Microsoft Sync Center to non-private IPs.. Logsource: windows / network_connection. Rule: title: Microsoft Sync Center Suspicious Network Connections id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b status: test description: Detects suspicious connections from Microsoft Sync Center to non-private IPs. references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2024-03-12 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: network_connection detection: selection: Image|endswith: \mobsync.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: campaign using Modify Authentication Process
Matching passage: T1556 Modify Authentication Process. Tactics: defense impairment, persistence, credential access. Description: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials. By modifying an authentication process, an adversary may be able to authenticate to a service or system without using [Valid Accounts](https://attack.mitre.org/techniques/T1078). Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms. Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.
Near-miss passage: T1556.006 Multi-Factor Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts. Once adversaries have gained access to a network by either compromising an account lacking MFA or by employing an MFA bypass method such as [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621), adversaries may leverage their access to modify or completely disable MFA defenses. This can be accomplished by abusing legitimate features, such as excluding users from Azure AD Conditional Access Policies, registering a new yet vulnerable/adversary-controlled MFA method, or by manually patching MFA programs and configuration files to bypass expected functionality.(Citation: Mandiant APT42)(Citation: Azure AD Conditional Access Exclusions) For example, modifying the Windows hosts file (`C:\windows\system32\drivers\etc\hosts`) to redirect MFA calls to localhost instead of an MFA server may cause the MFA process to fail. If a "fail open" policy is in place, any otherwise successful authentication attempt may be granted access without enforcing MFA. (Citation: Russians Exploit Default MFA Protocol - CISA March 2022) Depending on the scope, goals, and privileges of the adversary, MFA defenses may be disabled for individual accounts or for all accounts tied to a larger group, such as all domain accounts in a victim's network environment.(Citation: Russians Exploit Default MFA Protocol - CISA March 2022)
Query: exploit Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements 
Matching passage: CVE-2015-8224. CWE: CWE-200. CVSS: 3.700000047683716. Huawei P8 before GRA-CL00C92B210, before GRA-L09C432B200, before GRA-TL00C01B210, and before GRA-UL00C00B210 allows remote attackers to obtain user equipment (aka UE) measurements of signal strengths.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: CWE for Declaration of Throws for Generic Exception
Matching passage: CWE-397 Declaration of Throws for Generic Exception. The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.
Near-miss passage: CWE-1127 Compilation with Insufficient Warnings or Errors. The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.
Query: explain CWE-782
Matching passage: CWE-782 Exposed IOCTL with Insufficient Access Control. The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce access control for the IOCTL.
Near-miss passage: CWE-364 Signal Handler Race Condition. The product uses a signal handler that introduces a race condition.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Tools module before 7.x-1.4 for Drupal allow remote authenticated users to inject arbitrary web script or HTML v
Matching passage: CVE-2015-3387. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy Tools module before 7.x-1.4 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via a (1) node or (2) taxonomy term title.
Near-miss passage: CVE-2015-5494. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit The ANStartApproval method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acr
Matching passage: CVE-2015-6708. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANStartApproval method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-0429. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect integrity and availability via vectors related to RPC Utility.
Query: common weakness: Declaration of Throws for Generic Exception
Matching passage: CWE-397 Declaration of Throws for Generic Exception. The product throws or raises an overly broad exceptions that can hide important details and produce inappropriate responses to certain conditions.
Near-miss passage: CWE-220 Storage of File With Sensitive Data Under FTP Root. The product stores sensitive data under the FTP server root with insufficient access control, which might make it accessible to untrusted parties.
Query: patch priority for CVE-2015-4738
Matching passage: CVE-2015-4738. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise HCM Candidate Gateway component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-4438. CWE: UNKNOWN. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-4452, CVE-2015-5085, and CVE-2015-5086.
Query: CVE similar to CVE-2015-9253
Matching passage: CVE-2015-9253. CWE: CWE-400. CVSS: 6.5. An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Near-miss passage: CVE-2015-3248. CWE: CWE-400. CVSS: 4.699999809265137. openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
Query: describe CVE-2015-3796
Matching passage: CVE-2015-3796. CWE: CWE-119. CVSS: 7.5. The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3797 and CVE-2015-3798.
Near-miss passage: CVE-2015-3695. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, CVE-2015-3701, and CVE-2015-3702.
Query: describe CVE-2015-8275
Matching passage: CVE-2015-8275. CWE: CWE-284. CVSS: 5.5. LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.
Near-miss passage: CVE-2015-3295. CWE: CWE-284. CVSS: 5.300000190734863. markdown-it before 4.1.0 does not block data: URLs.