alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extensi
Matching passage: CVE-2015-0769. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XR 4.0.1 through 4.2.0 for CRS-3 Carrier Routing System allows remote attackers to cause a denial of service (NPU ASIC scan and line-card reload) via crafted IPv6 extension headers, aka Bug ID CSCtx03546.
Near-miss passage: CVE-2015-7813. CWE: CWE-399. CVSS: 2.0999999046325684. Xen 4.4.x, 4.5.x, and 4.6.x does not limit the number of printk console messages when reporting unimplemented hypercalls, which allows local guests to cause a denial of service via a sequence of (1) HYPERVISOR_physdev_op hypercalls, which are not properly handled in the do_physdev_op function in arch/arm/physdev.c, or (2) HYPERVISOR_hvm_op hypercalls, which are not properly handled in the do_hvm_op function in arch/arm/hvm.c.
Query: detect Detects the removal of Sysmon, which could be a potential attempt at defense evasion in logs
Matching passage: Sigma rule: Detects the removal of Sysmon, which could be a potential attempt at defense evasion. Logsource: windows / process_creation. Rule: title: Uninstall Sysinternals Sysmon id: 6a5f68d1-c4b5-46b9-94ee-5324892ea939 status: test description: Detects the removal of Sysmon, which could be a potential attempt at defense evasion references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon author: frack113 date: 2022-01-12 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -u condition: all of selection_* falsepositives: - Legitimate administrators might use this command to remove Sysmon for debugging purposes level: high
Near-miss passage: Sigma rule: Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlati. Logsource: bitbucket / audit. Rule: title: Bitbucket User Login Failure Via SSH id: d3f90469-fb05-42ce-b67d-0fded91bbef3 status: test description: 'Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field. ' references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html - https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.lateral-movement - attack.credential-access - attack.t1021.004 - attack.t1110 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Authentication auditType.action: User login failed(SSH) condition: selection falsepositives: - Legitimate user wrong password attempts. level: medium
Query: patch priority for CVE-2015-7309
Matching passage: CVE-2015-7309. CWE: CWE-74. CVSS: 6.5. The theme editor in Bolt before 2.2.5 does not check the file extension when renaming files, which allows remote authenticated users to execute arbitrary code by renaming a crafted file and then directly accessing it.
Near-miss passage: CVE-2015-5841. CWE: CWE-74. CVSS: 5.0. The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT request, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Query: CVE similar to CVE-2015-6468
Matching passage: CVE-2015-6468. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Query: Persistence mechanism resembling Hypervisor CLI
Matching passage: T1059.012 Hypervisor CLI. Tactics: execution. Description: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).
Near-miss passage: T1059.013 Container CLI/API. Tactics: execution. Description: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.(Citation: Docker Desktop CLI) Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Build Image on Host](https://attack.mitre.org/techniques/T1612)), run containers (i.e., [Deploy Container](https://attack.mitre.org/techniques/T1610)), or execute commands inside running containers (i.e., [Container Administration Command](https://attack.mitre.org/techniques/T1609)). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads.(Citation: Intezer) Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., [Container and Resource Discovery](https://attack.mitre.org/techniques/T1613)).(Citation: Cisco Talos Blog)(Citation: aquasec) Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` o
Query: CVE similar to CVE-2015-5781
Matching passage: CVE-2015-5781. CWE: CWE-200. CVSS: 4.300000190734863. ImageIO in Apple iOS before 8.4.1 and OS X before 10.10.5 does not properly initialize an unspecified data structure, which allows remote attackers to obtain sensitive information from process memory via a crafted PNG image.
Near-miss passage: CVE-2015-2413. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to determine the existence of local files via a crafted module-resource request, aka "Internet Explorer Information Disclosure Vulnerability."
Query: exploit Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arb
Matching passage: CVE-2015-2931. CWE: CWE-79. CVSS: 4.300000190734863. Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.
Near-miss passage: CVE-2015-0212. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
Query: containment actions for Encoded PowerShell / command-line abuse matching Domains
Matching passage: Playbook for T1583.001 Domains. 1) Validate alert telemetry against T1583.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniq
Near-miss passage: Playbook for T1583.004 Server. Different response path focused on resource development.
Query: common weakness: Product Released in Non-Release Configuration
Matching passage: CWE-1269 Product Released in Non-Release Configuration. The product released to market is released in pre-production or manufacturing configuration.
Near-miss passage: CWE-1121 Excessive McCabe Cyclomatic Complexity. The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.
Query: CVE similar to CVE-2015-2909
Matching passage: CVE-2015-2909. CWE: CWE-269. CVSS: 9.800000190734863. Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, and DS2 devices rely on a GUI warning to help ensure that the administrator configures login credentials, which makes it easier for remote attackers to obtain access by leveraging situations in which this warning was not heeded. NOTE: the vendor states "The user is presented with clear warnings on the GUI that they should set usernames and passwords."
Near-miss passage: CVE-2015-4446. CWE: CWE-269. CVSS: 7.5. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition from Low Integrity to Medium Integrity via unspecified vectors, a different vulnerability than CVE-2015-5090 and CVE-2015-5106.
Query: exploit The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Matching passage: CVE-2015-5227. CWE: CWE-74. CVSS: 8.800000190734863. The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.
Near-miss passage: CVE-2015-3154. CWE: CWE-74. CVSS: 6.099999904632568. CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Query: describe CVE-2015-6678
Matching passage: CVE-2015-6678. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6676.
Near-miss passage: CVE-2015-3955. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in Hospira LifeCare PCA Infusion System 5.0 and earlier, and possibly other versions, allows remote attackers to execute arbitrary code via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Command Execution Via FTP.EXE id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e status: test description: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Ftp/ author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2024-04-23 tags: - attack.execution - attack.stealth - attack.t1059 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \ftp.exe selection_child_img: - Image|endswith: \ftp.exe - OriginalFileName: ftp.exe selection_child_cli: CommandLine|contains|windash: '-s:' condition: selection_parent or all of selection_child_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default loc. Logsource: windows / process_creation. Rule: title: Wab Execution From Non Default Location id: 395907ee-96e5-4666-af2e-2ca91688e151 status: test description: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \wab.exe - \wabmig.exe filter: Image|startswith: - C:\Windows\WinSxS\ - C:\Program Files\Windows Mail\ - C:\Program Files (x86)\Windows Mail\ condition: selection and not filter falsepositives: - Unknown level: high
Query: Sigma rule for Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook conf
Matching passage: Sigma rule: Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook conf. Logsource: kubernetes / audit. Rule: title: Kubernetes Admission Controller Modification id: eed82177-38f5-4299-8a76-098d50d225ab related: - id: 6ad91e31-53df-4826-bd27-0166171c8040 type: similar status: test description: 'Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://security.padok.fr/en/blog/kubernetes-webhook-attackers author: kelnage date: 2024-07-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.credential-access - attack.t1552 - attack.t1552.007 logsource: product: kubernetes service: audit detection: selection: objectRef.apiGroup: admissionregistration.k8s.io objectRef.resource: - mutatingwebhookconfigurations - validatingwebhookconfigurations verb: - create - delete - patch - replace - update condition: selection falsepositives: - Modifying the Kubernetes Admission Controller may need to be done by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Near-miss passage: Sigma rule: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec. Logsource: windows / process_creation. Rule: title: Disabled IE Security Features id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424 status: test description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features references: - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ author: Florian Roth (Nextron Systems) date: 2020-06-19 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - ' -name IEHarden ' - ' -value 0 ' selection2: CommandLine|contains|all: - ' -name DEPOff ' - ' -value 1 ' selection3: CommandLine|contains|all: - ' -name DisableFirstRunCustomize ' - ' -value 2 ' condition: 1 of selection* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-2366
Matching passage: CVE-2015-2366. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-8577. CWE: CWE-264. CVSS: 2.5999999046325684. The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.
Query: CVE similar to CVE-2015-8504
Matching passage: CVE-2015-8504. CWE: CWE-369. CVSS: 6.5. Qemu, when built with VNC display driver support, allows remote attackers to cause a denial of service (arithmetic exception and application crash) via crafted SetPixelFormat messages from a client.
Near-miss passage: CVE-2015-7513. CWE: CWE-369. CVSS: 6.5. arch/x86/kvm/x86.c in the Linux kernel before 4.4 does not reset the PIT counter values during state restoration, which allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via a zero value, related to the kvm_vm_ioctl_set_pit and kvm_vm_ioctl_set_pit2 functions.
Query: exploit Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, whi
Matching passage: CVE-2015-2917. CWE: CWE-20. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M unintentionally omit the X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site that contains a (1) FRAME, (2) IFRAME, or (3) OBJECT element.
Near-miss passage: CVE-2015-1379. CWE: CWE-20. CVSS: 7.5. The signal handler implementations in socat before 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).
Query: exploit Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual para
Matching passage: CVE-2015-4337. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php.
Near-miss passage: CVE-2015-10098. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Broken Link Checker Plugin up to 1.10.5 on WordPress. It has been rated as problematic. Affected by this issue is the function print_module_list/show_warnings_section_notice/status_text/ui_get_action_links. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10.6 is able to address this issue. The name of the patch is f30638869e281461b87548e40b517738b4350e47. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-225152.
Query: exploit Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x b
Matching passage: CVE-2015-4946. CWE: CWE-264. CVSS: 3.299999952316284. Rational LifeCycle Project Administration in Jazz Team Server in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Quality Manager (RQM) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Team Concert (RTC) 3.x before 3.0.1.6 IF7, 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Requirements Composer (RRC) 3.x before 3.0.1.6 IF7 and 4.x before 4.0.7 IF9; Rational DOORS Next Generation (RDNG) 4.x before 4.0.7 IF9, 5.x before 5.0.2 IF9, and 6.x before 6.0.1; Rational Engineering Lifecycle Manager (RELM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; Rational Rhapsody Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1; and Rational Software Architect Design Manager (DM) 4.x through 4.0.7, 5.x through 5.0.2, and 6.x before 6.0.1 allows local users to bypass intended access restrictions via unspecified vectors.
Near-miss passage: CVE-2015-4544. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 7.1P20 and 7.2.x before 7.2P04 does not properly verify authorization for dm_job object access, which allows remote authenticated users to obtain superuser privileges via crafted object operations. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4626.
Query: describe CVE-2015-5756
Matching passage: CVE-2015-5756. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted font file, a different vulnerability than CVE-2015-3804 and CVE-2015-5775.
Near-miss passage: CVE-2015-5590. CWE: CWE-119. CVSS: 7.300000190734863. Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.
Query: CVE similar to CVE-2015-9446
Matching passage: CVE-2015-9446. CWE: CWE-89. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has SQL injection via data[galleryID] to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-7342. CWE: CWE-89. CVSS: 7.199999809265137. JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field.
Query: describe CVE-2015-5599
Matching passage: CVE-2015-5599. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in upload.php in the Powerplay Gallery plugin 3.3 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) albumid or (2) name parameter.
Near-miss passage: CVE-2015-4426. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in pimcore before build 3473 allows remote attackers to execute arbitrary SQL commands via the filter parameter to admin/asset/grid-proxy.