alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: containment actions for Outbound C2 pattern associated with Code Repositories
Matching passage: Playbook for T1593.003 Code Repositories. 1) Validate alert telemetry against T1593.003. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search public code repositories for information about victims that can be used during targeting. Victims may store code in repositories on various third-party websites such as GitHub, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git. Adversaries may search various public code reposito
Near-miss passage: Playbook for T1593 Search Open Websites/Domains. Different response path focused on reconnaissance.
Query: exploit Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (
Matching passage: CVE-2015-2897. CWE: CWE-200. CVSS: 10.0. Sierra Wireless ALEOS before 4.4.2 on AirLink ES, GX, and LS devices has hardcoded root accounts, which makes it easier for remote attackers to obtain administrative access via a (1) SSH or (2) TELNET session.
Near-miss passage: CVE-2015-7514. CWE: CWE-200. CVSS: 6.5. OpenStack Ironic 4.2.0 through 4.2.1 does not "clean" the disk after use, which allows remote authenticated users to obtain sensitive information.
Query: CVE similar to CVE-2015-2784
Matching passage: CVE-2015-2784. CWE: CWE-20. CVSS: 9.800000190734863. The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
Near-miss passage: CVE-2015-0676. CWE: CWE-20. CVSS: 7.099999904632568. The DNS implementation in Cisco Adaptive Security Appliance (ASA) Software 7.2 before 7.2(5.16), 8.2 before 8.2(5.57), 8.3 before 8.3(2.44), 8.4 before 8.4(7.28), 8.5 before 8.5(1.24), 8.6 before 8.6(1.17), 8.7 before 8.7(1.16), 9.0 before 9.0(4.33), 9.1 before 9.1(6.1), 9.2 before 9.2(3.4), and 9.3 before 9.3(3) allows man-in-the-middle attackers to cause a denial of service (memory consumption or device outage) by triggering outbound DNS queries and then sending crafted responses to these queries, aka Bug ID CSCuq77655.
Query: secure coding against Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
Matching passage: CWE-1043 Data Element Aggregating an Excessively Large Number of Non-Primitive Elements. The product uses a data element that has an excessively large number of sub-elements with non-primitive data types such as structures or aggregated objects.
Near-miss passage: CWE-406 Insufficient Control of Network Message Volume (Network Amplification). The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
Query: secure coding against Expression is Always True
Matching passage: CWE-571 Expression is Always True. The product contains an expression that will always evaluate to true.
Near-miss passage: CWE-198 Use of Incorrect Byte Ordering. The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.
Query: write Sigma for Files with well-known filenames (sensitive files with credential data) copying
Matching passage: Sigma rule: Files with well-known filenames (sensitive files with credential data) copying. Logsource: windows / process_creation. Rule: title: Copying Sensitive Files with Credential Data id: e7be6119-fc37-43f0-ad4f-1f3f99be2f9f status: test description: Files with well-known filenames (sensitive files with credential data) copying references: - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/ - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/ - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2019-10-22 modified: 2024-06-04 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 - car.2013-07-001 - attack.s0404 logsource: category: process_creation product: windows detection: selection_esent_img: - Image|endswith: \esentutl.exe - OriginalFileName: \esentutl.exe selection_esent_cli: CommandLine|contains|windash: - vss - ' /m ' - ' /y ' selection_susp_paths: CommandLine|contains: - \config\RegBack\sam - \config\RegBack\security - \config\RegBack\system - \config\sam - \config\security - '\config\system ' - \repair\sam - \repair\security - \repair\system - \windows\ntds\ntds.dit condition: all of selection_esent_* or selection_susp_paths falsepositives: - Copying sensitive files for legitimate use (eg. backup) or forensic investigation by legitimate incident responder or forensic investigator. level: high
Near-miss passage: Sigma rule: Detects the use of the Dinject PowerShell cradle based on the specific flags. Logsource: windows / process_creation. Rule: title: HackTool - DInjector PowerShell Cradle Execution id: d78b5d61-187d-44b6-bf02-93486a80de5a status: test description: Detects the use of the Dinject PowerShell cradle based on the specific flags references: - https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector author: Florian Roth (Nextron Systems) date: 2021-12-07 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' /am51' - ' /password' condition: selection falsepositives: - Unlikely level: critical
Query: telemetry for T1059.012
Matching passage: T1059.012 Hypervisor CLI. Tactics: execution. Description: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).
Near-miss passage: T1059.011 Lua. Tactics: execution. Description: Adversaries may abuse Lua commands and scripts for execution. Lua is a cross-platform scripting and programming language primarily designed for embedded use in applications. Lua can be executed on the command-line (through the stand-alone lua interpreter), via scripts (<code>.lua</code>), or from Lua-embedded programs (through the <code>struct lua_State</code>).(Citation: Lua main page)(Citation: Lua state) Lua scripts may be executed by adversaries for malicious purposes. Adversaries may incorporate, abuse, or replace existing Lua interpreters to allow for malicious Lua command execution at runtime.(Citation: PoetRat Lua)(Citation: Lua Proofpoint Sunseed)(Citation: Cyphort EvilBunny)(Citation: Kaspersky Lua)
Query: CVE similar to CVE-2015-2548
Matching passage: CVE-2015-2548. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Tablet Input Band in Windows Shell in Microsoft Windows Vista SP2 and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka "Microsoft Tablet Input Band Use After Free Vulnerability."
Near-miss passage: CVE-2015-8069. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: describe CVE-2015-2335
Matching passage: CVE-2015-2335. CWE: CWE-200. CVSS: 5.0. A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors.
Near-miss passage: CVE-2015-0517. CWE: CWE-200. CVSS: 4.0. The D2-API component in EMC Documentum D2 3.1 through SP1, 4.0 and 4.1 before 4.1 P22, and 4.2 before P11 places the MD5 hash of an encryption passphrase in log files, which allows remote authenticated users to obtain sensitive information by reading a file.
Query: patch priority for CVE-2015-6077
Matching passage: CVE-2015-6077. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Near-miss passage: CVE-2015-1802. CWE: CWE-119. CVSS: 8.5. The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.
Query: exploit Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct 
Matching passage: CVE-2015-2750. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
Near-miss passage: CVE-2015-10102. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as critical, has been found in Freshdesk Plugin 1.7 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to open redirect. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 2aaecd4e0c7c6c1dc4e6a593163d5f7aa0fa5d5b. It is recommended to upgrade the affected component. VDB-226118 is the identifier assigned to this vulnerability.
Query: describe CVE-2015-8727
Matching passage: CVE-2015-8727. CWE: CWE-20. CVSS: 5.5. The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
Near-miss passage: CVE-2015-2291. CWE: CWE-20. CVSS: 7.800000190734863. (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
Query: patch priority for CVE-2015-1116
Matching passage: CVE-2015-1116. CWE: CWE-200. CVSS: 2.0999999046325684. The UIKit View component in Apple iOS before 8.3 displays unblurred application snapshots in the Task Switcher, which makes it easier for physically proximate attackers to obtain sensitive information by reading the device screen.
Near-miss passage: CVE-2015-0143. CWE: CWE-200. CVSS: 4.0. IBM OpenPages GRC Platform 6.2 before IF7, 6.2.1 before 6.2.1.1 IF5, 7.0 before FP4, and 7.1 before FP1 allows remote authenticated users to obtain sensitive information by reading error messages.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web sc
Matching passage: CVE-2015-6402. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to inject arbitrary web script or HTML via an unspecified value, aka Bug ID CSCux24935.
Near-miss passage: CVE-2015-1373. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ferretCMS 1.0.4-alpha allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter in a search request, (2) username in a login request, which is not properly handled when logging the event, or (3) page title in an insert action.
Query: describe CVE-2015-1627
Matching passage: CVE-2015-1627. CWE: CWE-264. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4533. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization after creation of an object, which allows remote authenticated users to execute arbitrary code with super-user privileges via a custom script. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2513.
Query: exploit TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Matching passage: CVE-2015-3454. CWE: CWE-200. CVSS: 7.5. TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.
Near-miss passage: CVE-2015-4171. CWE: CWE-200. CVSS: 2.5999999046325684. strongSwan 4.3.0 through 5.x before 5.3.2 and strongSwan VPN Client before 1.4.6, when using EAP or pre-shared keys for authenticating an IKEv2 connection, does not enforce server authentication restrictions until the entire authentication process is complete, which allows remote servers to obtain credentials by using a valid certificate and then reading the responses.
Query: CVE similar to CVE-2015-3771
Matching passage: CVE-2015-3771. CWE: CWE-119. CVSS: 7.199999809265137. IOFireWireFamily in Apple OS X before 10.10.5 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3769 and CVE-2015-3772.
Near-miss passage: CVE-2015-9206. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, during XML encoding of a message in the Playready module, a buffer overread may occur if the message passed is large.
Query: patch priority for CVE-2015-3038
Matching passage: CVE-2015-3038. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Near-miss passage: CVE-2015-4840. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 7u85 and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via unknown vectors related to 2D.
Query: risk of Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via t
Matching passage: CVE-2015-1385. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Blubrry PowerPress Podcasting plugin before 6.0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a powerpress-editcategoryfeed action in the powerpressadmin_categoryfeeds.php page to wp-admin/admin.php.
Near-miss passage: CVE-2015-0344. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the web app in Adobe Connect before 9.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detect Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of in logs
Matching passage: Sigma rule: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of. Logsource: windows / image_load. Rule: title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d status: experimental description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File. references: - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/ - https://x.com/Threatlabz/status/1879956781360976155 author: X__Junior date: 2025-01-20 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: \clfs.sys selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ - Image|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet. Logsource: windows / process_creation. Rule: title: Suspicious Desktopimgdownldr Command id: bb58aa4a-b80b-415a-a2c0-2f65a4c81009 status: test description: Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet references: - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/ - https://twitter.com/SBousseaden/status/1278977301745741825 author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: ' /lockscreenurl:' selection1_filter: CommandLine|contains: - .jpg - .jpeg - .png selection_reg: CommandLine|contains|all: - reg delete - \PersonalizationCSP condition: ( selection1 and not selection1_filter ) or selection_reg falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Query: SOC runbook when seeing Lateral movement indicators for Dynamic Resolution
Matching passage: Playbook for T1568 Dynamic Resolution. 1) Validate alert telemetry against T1568. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: command and control. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port numbe
Near-miss passage: Playbook for T1568.003 DNS Calculation. Different response path focused on command and control.
Query: describe CVE-2015-8555
Matching passage: CVE-2015-8555. CWE: CWE-200. CVSS: 8.600000381469727. Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage guest extended register state, which allows local guest domains to obtain sensitive information from other domains via unspecified vectors.
Near-miss passage: CVE-2015-5288. CWE: CWE-200. CVSS: 6.400000095367432. The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.
Query: explain CWE-1259
Matching passage: CWE-1259 Improper Restriction of Security Token Assignment. The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.
Near-miss passage: CWE-540 Inclusion of Sensitive Information in Source Code. Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
Query: CVE similar to CVE-2015-7297
Matching passage: CVE-2015-7297. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Joomla! 3.2 before 3.4.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2015-7858.
Near-miss passage: CVE-2015-10055. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in PictureThisWebServer and classified as critical. This issue affects the function router.post of the file routes/user.js. The manipulation of the argument username/password leads to sql injection. The patch is named 68b9dc346e88b494df00d88c7d058e96820e1479. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218399.
Query: risk of Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.5 MR1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCus561
Matching passage: CVE-2015-4281. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco WebEx Meetings Server 2.5 MR1 allows remote attackers to hijack the authentication of arbitrary users, aka Bug IDs CSCus56150 and CSCus56146.
Near-miss passage: CVE-2015-7610. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in the login form in Zimbra Collaboration Suite (aka ZCS) before 8.6.0 Patch 10, 8.7.x before 8.7.11 Patch 2, and 8.8.x before 8.8.8 Patch 1 allows remote attackers to hijack the authentication of unspecified victims by leveraging failure to use a CSRF token.