alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information D
Matching passage: CVE-2015-1692. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5730. CWE: CWE-200. CVSS: 5.0. The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Query: exploit NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vecto
Matching passage: CVE-2015-7746. CWE: CWE-287. CVSS: 9.800000190734863. NetApp Data ONTAP before 8.2.4, when operating in 7-Mode, allows remote attackers to bypass authentication and (1) obtain sensitive information from or (2) modify volumes via vectors related to UTF-8 in the volume language.
Near-miss passage: CVE-2015-2823. CWE: CWE-287. CVSS: 6.800000190734863. Siemens SIMATIC HMI Basic Panels 2nd Generation before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Comfort Panels before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Advanced before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC WinCC Runtime Professional before WinCC (TIA Portal) 13 SP1 Upd2, SIMATIC HMI Basic Panels 1st Generation (WinCC TIA Portal), SIMATIC HMI Mobile Panel 277 (WinCC TIA Portal), SIMATIC HMI Multi Panels (WinCC TIA Portal), and SIMATIC WinCC 7.x before 7.3 Upd4 allow remote attackers to complete authentication by leveraging knowledge of a password hash without knowledge of the associated password.
Query: describe CVE-2015-6005
Matching passage: CVE-2015-6005. CWE: CWE-79. CVSS: 6.900000095367432. Multiple cross-site scripting (XSS) vulnerabilities in IPSwitch WhatsUp Gold before 16.4 allow remote attackers to inject arbitrary web script or HTML via (1) an SNMP OID object, (2) an SNMP trap message, (3) the View Names field, (4) the Group Names field, (5) the Flow Monitor Credentials field, (6) the Flow Monitor Threshold Name field, (7) the Task Library Name field, (8) the Task Library Description field, (9) the Policy Library Name field, (10) the Policy Library Description field, (11) the Template Library Name field, (12) the Template Library Description field, (13) the System Script Library Name field, (14) the System Script Library Description field, or (15) the CLI Settings Library Description field.
Near-miss passage: CVE-2015-10006. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, has been found in admont28 Ingnovarq. Affected by this issue is some unknown functionality of the file app/controller/insertarSliderAjax.php. The manipulation of the argument imagetitle leads to cross site scripting. The attack may be launched remotely. The name of the patch is 9d18a39944d79dfedacd754a742df38f99d3c0e2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217172.
Query: describe CVE-2015-0988
Matching passage: CVE-2015-0988. CWE: CWE-200. CVSS: 2.0999999046325684. Omron CX-One CX-Programmer before 9.6 uses a reversible format for password storage in project source-code files, which makes it easier for local users to obtain sensitive information by reading a file.
Near-miss passage: CVE-2015-6706. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2015-5583, CVE-2015-6705, and CVE-2015-7624.
Query: risk of The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts 
Matching passage: CVE-2015-4307. CWE: CWE-264. CVSS: 9.0. The web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and create administrative accounts via a crafted URL, aka Bug ID CSCut64111.
Near-miss passage: CVE-2015-5602. CWE: CWE-264. CVSS: 7.199999809265137. sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home/*/*/file.txt."
Query: CVE similar to CVE-2015-4182
Matching passage: CVE-2015-4182. CWE: CWE-264. CVSS: 5.5. The administrative web interface in Cisco Identity Services Engine (ISE) before 1.3 allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information or change settings, via unspecified vectors, aka Bug ID CSCui72087.
Near-miss passage: CVE-2015-7598. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: describe CVE-2015-7386
Matching passage: CVE-2015-7386. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in includes/metaboxes.php in the Gallery - Photo Albums - Portfolio plugin 1.3.47 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) Media Title or (2) Media Subtitle fields.
Near-miss passage: CVE-2015-3365. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the nodeauthor module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a Profile2 field in a provided block.
Query: vulnerability: Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files, which allows local users to cause a denial of service (persistent hang or
Matching passage: CVE-2015-0603. CWE: CWE-264. CVSS: 4.599999904632568. Cisco Unified IP 9900 phones with firmware 9.4(.1) and earlier use weak permissions for unspecified files, which allows local users to cause a denial of service (persistent hang or reboot) by writing to a phone's filesystem, aka Bug ID CSCup90474.
Near-miss passage: CVE-2015-3659. CWE: CWE-264. CVSS: 6.800000190734863. The SQLite authorizer in the Storage functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7, as used in Apple iOS before 8.4 and other products, does not properly restrict access to SQL functions, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted web site.
Query: describe CVE-2015-7330
Matching passage: CVE-2015-7330. CWE: CWE-254. CVSS: 8.800000190734863. Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Near-miss passage: CVE-2015-7863. CWE: CWE-254. CVSS: 5.0. The default configuration of Persistent Accelerite Radia Client Automation (formerly HP Client Automation) 7.9 through 9.1 before 2015-02-19 enables a remote Notify capability without the Extended Notify Security features, which might allow remote attackers to bypass intended access restrictions via unspecified vectors.
Query: describe CVE-2015-9200
Matching passage: CVE-2015-9200. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, and SD 835, in some TrustZone API functions, untrusted pointers can be dereferenced.
Near-miss passage: CVE-2015-7068. CWE: CWE-476. CVSS: 7.800000190734863. IOKit SCSI in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via an app that provides an unspecified userclient type.
Query: describe CVE-2015-6927
Matching passage: CVE-2015-6927. CWE: CWE-59. CVSS: 3.5999999046325684. vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
Near-miss passage: CVE-2015-5700. CWE: CWE-59. CVSS: 6.099999904632568. mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
Query: exploit The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restri
Matching passage: CVE-2015-7545. CWE: CWE-20. CVSS: 9.800000190734863. The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.
Near-miss passage: CVE-2015-6243. CWE: CWE-20. CVSS: 4.300000190734863. The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to the (1) dissector_get_string_handle and (2) dissector_get_default_string_handle functions.
Query: describe CVE-2015-0502
Matching passage: CVE-2015-0502. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1 and 8.2 allows remote attackers to affect integrity via unknown vectors related to Portal Framework.
Near-miss passage: CVE-2015-7663. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-8042, CVE-2015-8043, CVE-2015-8044, and CVE-2015-8046.
Query: CVE similar to CVE-2015-1200
Matching passage: CVE-2015-1200. CWE: CWE-362. CVSS: 2.0999999046325684. Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Near-miss passage: CVE-2015-2234. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
Query: vulnerability: Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8
Matching passage: CVE-2015-7943. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the LABjs module 7.x-1.x before 7.x-1.8 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3233.
Near-miss passage: CVE-2015-4668. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Xsuite 2.4.4.5 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirurl parameter.
Query: exploit The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accep
Matching passage: CVE-2015-6786. CWE: CWE-264. CVSS: 4.300000190734863. The CSPSourceList::matches function in WebKit/Source/core/frame/csp/CSPSourceList.cpp in the Content Security Policy (CSP) implementation in Google Chrome before 47.0.2526.73 accepts a blob:, data:, or filesystem: URL as a match for a * pattern, which allows remote attackers to bypass intended scheme restrictions in opportunistic circumstances by leveraging a policy that relies on this pattern.
Near-miss passage: CVE-2015-6861. CWE: CWE-264. CVSS: 7.5. HPE Helion Eucalyptus 3.4.0 through 4.2.0 allows remote authenticated users to bypass an intended AssumeRole permission requirement and assume an IAM role by leveraging a policy setting for a user's account.
Query: detect Detects logons using NTLM to hosts that are potentially not part of the domain. in logs
Matching passage: Sigma rule: Detects logons using NTLM to hosts that are potentially not part of the domain.. Logsource: windows / ntlm. Rule: title: Potential Remote Desktop Connection to Non-Domain Host id: ce5678bb-b9aa-4fb5-be4b-e57f686256ad status: test description: Detects logons using NTLM to hosts that are potentially not part of the domain. references: - n/a author: James Pemberton date: 2020-05-22 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8001 TargetName|startswith: TERMSRV condition: selection falsepositives: - Host connections to valid domains, exclude these. - Host connections not using host FQDN. - Host connections to external legitimate domains. level: medium
Near-miss passage: Sigma rule: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension. Logsource: windows / process_creation. Rule: title: Chromium Browser Instance Executed With Custom Extension id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 related: - id: 27ba3207-dd30-4812-abbf-5d20c57d474e type: similar status: test description: Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Usage of Chrome Extensions in testing tools such as BurpSuite will trigger this alert level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_load_extension/info.yml
Query: explain T1070.005 Network Share Connection Removal
Matching passage: T1070.005 Network Share Connection Removal. Tactics: stealth. Description: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) connections can be removed when no longer needed. [Net](https://attack.mitre.org/software/S0039) is an example utility that can be used to remove network share connections with the <code>net use \\system\share /delete</code> command. (Citation: Technet Net Use)
Near-miss passage: T1070.010 Relocate Malware. Tactics: stealth. Description: Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with [File Deletion](https://attack.mitre.org/techniques/T1070/004) to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses. For example, adversaries may copy and rename payloads to better blend into the local environment (i.e., [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: DFIR Report Trickbot June 2023) Payloads may also be repositioned to target [File/Path Exclusions](https://attack.mitre.org/techniques/T1564/012) as well as specific locations associated with establishing [Persistence](https://attack.mitre.org/tactics/TA0003).(Citation: Latrodectus APR 2024) Relocating malicious payloads may also hinder defensive analysis, especially to separate these payloads from earlier events (such as [User Execution](https://attack.mitre.org/techniques/T1204) and [Phishing](https://attack.mitre.org/techniques/T1566)) that may have generated alerts or otherwise drawn attention from defenders. Moving payloads into target directories does not alter the Creation timestamp, thereby evading detection logic reliant on modifications to this artifact (i.e., [Timestomp](https://attack.mitre.org/techniques/T1070/006)).
Query: describe CVE-2015-4678
Matching passage: CVE-2015-4678. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
Near-miss passage: CVE-2015-6659. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Query: secure coding against Use of Persistent Cookies Containing Sensitive Information
Matching passage: CWE-539 Use of Persistent Cookies Containing Sensitive Information. The web application uses persistent cookies, but the cookies contain sensitive information.
Near-miss passage: CWE-221 Information Loss or Omission. The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
Query: CVE similar to CVE-2015-0274
Matching passage: CVE-2015-0274. CWE: CWE-19. CVSS: 7.199999809265137. The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
Near-miss passage: CVE-2015-1759. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: write Sigma for Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service
Matching passage: Sigma rule: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service. Logsource: windows / smbclient-security. Rule: title: Suspicious Rejected SMB Guest Logon From IP id: 71886b70-d7b4-4dbf-acce-87d2ca135262 status: test description: Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service references: - https://twitter.com/KevTheHermit/status/1410203844064301056 - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/ - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w date: 2021-06-30 modified: 2023-01-02 tags: - attack.credential-access - attack.t1110.001 logsource: product: windows service: smbclient-security detection: selection: EventID: 31017 UserName: '' ServerName|startswith: \1 condition: selection falsepositives: - Account fallback reasons (after failed login with specific account) level: medium
Near-miss passage: Sigma rule: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location. Logsource: windows / registry_set. Rule: title: Potentially Suspicious ODBC Driver Registered id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4 status: test description: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location references: - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-23 modified: 2023-08-17 tags: - attack.credential-access - attack.persistence - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\ODBC\ODBCINST.INI\ TargetObject|endswith: - \Driver - \Setup Details|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Registration\CRMLog - :\Windows\System32\com\dmp\ - :\Windows\System32\FxsTmp\ - :\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\ - :\Windows\System32\spool\drivers\color\ - :\Windows\System32\spool\PRINTERS\ - :\Windows\System32\spool\SERVERS\ - :\Windows\System32\Tasks_Migrated\ - :\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\SysWOW64\com\dmp\ - :\Windows\SysWOW64\FxsTmp\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\ - :\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\ - :\Windows\Tasks\ - :\Windows\Temp\ - :\Windows\Tracing\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: selection falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-1599
Matching passage: CVE-2015-1599. CWE: CWE-264. CVSS: 2.0999999046325684. The Siemens SPCanywhere application for iOS allows physically proximate attackers to bypass intended access restrictions by leveraging a filesystem architectural error.
Near-miss passage: CVE-2015-1610. CWE: CWE-264. CVSS: 5.300000190734863. hosttracker in OpenDaylight l2switch allows remote attackers to change the host location information by spoofing the MAC address, aka "topology spoofing."
Query: describe CVE-2015-0811
Matching passage: CVE-2015-0811. CWE: CWE-119. CVSS: 6.400000095367432. The QCMS implementation in Mozilla Firefox before 37.0 allows remote attackers to obtain sensitive information from process heap memory or cause a denial of service (out-of-bounds read) via an image that is improperly handled during transformation.
Near-miss passage: CVE-2015-6674. CWE: CWE-119. CVSS: 9.800000190734863. Buffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This issue exists as an additional issue from an incomplete fix of CVE-2012-1836.