alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Matching passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Near-miss passage: CVE-2015-1763. CWE: CWE-284. CVSS: 8.5. Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."
Query: describe CVE-2015-3912
Matching passage: CVE-2015-3912. CWE: CWE-200. CVSS: 5.0. Huawei E355s Mobile WiFi with firmware before 22.158.45.02.625 and WEBUI before 13.100.04.01.625 allows remote attackers to obtain sensitive configuration information by sniffing the network or sending unspecified commands.
Near-miss passage: CVE-2015-2298. CWE: CWE-200. CVSS: 7.5. node/utils/ExportEtherpad.js in Etherpad 1.5.x before 1.5.2 might allow remote attackers to obtain sensitive information by leveraging an improper substring check when exporting a padID.
Query: alert when Detects when a user tampers with S3 data management in Amazon Web Services.
Matching passage: Sigma rule: Detects when a user tampers with S3 data management in Amazon Web Services.. Logsource: aws / cloudtrail. Rule: title: AWS S3 Data Management Tampering id: 78b3756a-7804-4ef7-8555-7b9024a02e2d status: test description: Detects when a user tampers with S3 data management in Amazon Web Services. references: - https://github.com/elastic/detection-rules/pull/1145/files - https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html - https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html - https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: - PutBucketLogging - PutBucketWebsite - PutEncryptionConfiguration - PutLifecycleConfiguration - PutReplicationConfiguration - ReplicateObject - RestoreObject condition: selection falsepositives: - A S3 configuration change may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. S3 configuration change from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Near-miss passage: Sigma rule: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted lo. Logsource: windows / process_creation. Rule: title: Bypass UAC via CMSTP id: e66779cc-383e-4224-a3a4-267eeb585c40 status: test description: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files references: - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/ author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-08-30 tags: - attack.privilege-escalation - attack.stealth - attack.t1548.002 - attack.t1218.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmstp.exe - OriginalFileName: CMSTP.EXE selection_cli: CommandLine|contains: - /s - -s - /au - -au - /ni - -ni condition: all of selection* falsepositives: - Legitimate use of cmstp.exe utility by legitimate user level: high
Query: Sigma rule for Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistenc
Matching passage: Sigma rule: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistenc. Logsource: windows / registry_set. Rule: title: Potential Persistence Via DLLPathOverride id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8 status: test description: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process references: - https://persistence-info.github.io/Data/naturallanguage6.html - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\ContentIndex\Language\ selection_values: TargetObject|contains: - \StemmerDLLPathOverride - \WBDLLPathOverride - \StemmerClass - \WBreakerClass condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect change of the user account associated with the FAX service to avoid the escalation problem.. Logsource: windows / registry_set. Rule: title: Change User Account Associated with the FAX Service id: e3fdf743-f05b-4051-990a-b66919be1743 status: test description: Detect change of the user account associated with the FAX service to avoid the escalation problem. references: - https://twitter.com/dottor_morte/status/1544652325570191361 - https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf author: frack113 date: 2022-07-17 modified: 2022-12-30 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject: HKLM\System\CurrentControlSet\Services\Fax\ObjectName filter: Details|contains: NetworkService condition: selection and not filter falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-8310
Matching passage: CVE-2015-8310. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
Near-miss passage: CVE-2015-1041. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path in the QUERY_STRING.
Query: detect Detects possible Java payloads in web access logs in logs
Matching passage: Sigma rule: Detects possible Java payloads in web access logs. Logsource: webserver. Rule: title: Java Payload Strings id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c status: test description: Detects possible Java payloads in web access logs references: - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/ - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md - https://twitter.com/httpvoid0x2f/status/1532924261035384832 - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035 author: frack113, Harjot Singh, "@cyb3rjy0t" (update) date: 2022-06-04 modified: 2023-01-19 tags: - cve.2022-26134 - cve.2021-26084 - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - '%24%7B%28%23a%3D%40' - ${(#a=@ - '%24%7B%40java' - ${@java - u0022java - '%2F%24%7B%23' - /${# - new+java. - getRuntime().exec( - getRuntime%28%29.exec%28 condition: keywords falsepositives: - Legitimate apps level: high
Near-miss passage: Sigma rule: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. S. Logsource: linux / process_creation. Rule: title: ESXi VSAN Information Discovery Via ESXCLI id: d54c2f06-aca9-4e2b-81c9-5317858f4b79 status: test description: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: vsan selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Query: CWE for Direct Request ('Forced Browsing')
Matching passage: CWE-425 Direct Request ('Forced Browsing'). The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Near-miss passage: CWE-766 Critical Data Element Declared Public. The product declares a critical variable, field, or member to be public when intended security policy requires it to be private.
Query: common weakness: J2EE Bad Practices: Direct Use of Sockets
Matching passage: CWE-246 J2EE Bad Practices: Direct Use of Sockets. The J2EE application directly uses sockets instead of using framework method calls.
Near-miss passage: CWE-1333 Inefficient Regular Expression Complexity. The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
Query: risk of Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compile
Matching passage: CVE-2015-5548. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5544, CVE-2015-5545, CVE-2015-5546, CVE-2015-5547, CVE-2015-5549, CVE-2015-5552, and CVE-2015-5553.
Near-miss passage: CVE-2015-5290. CWE: CWE-119. CVSS: 7.5. A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
Query: describe CVE-2015-3132
Matching passage: CVE-2015-3132. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Near-miss passage: CVE-2015-0482. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 12.1.2.0 and 12.1.3.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to WLS-WebServices.
Query: patch priority for CVE-2015-2982
Matching passage: CVE-2015-2982. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in jquery.lightbox-0.5.min.js in PHP Kobo Photo Gallery CMS for PC, smartphone and feature phone 1.0.1 Free and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified input to admin.php.
Near-miss passage: CVE-2015-0156. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 7.5.x through 7.5.1.2, 8.0.x through 8.0.1.3, and 8.5.x through 8.5.6.0 and WebSphere Lombardi Edition (WLE) 7.2.x through 7.2.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspecified victims via 
Matching passage: CVE-2015-6468. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Resource Data Management Data Manager before 2.2 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Near-miss passage: CVE-2015-4350. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Spider Catalog module for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete (1) products, (2) ratings, or (3) categories via unspecified vectors.
Query: patch priority for CVE-2015-5301
Matching passage: CVE-2015-5301. CWE: CWE-264. CVSS: 5.5. providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check permissions, which allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).
Near-miss passage: CVE-2015-6850. CWE: CWE-264. CVSS: 8.399999618530273. EMC VPLEX GeoSynchrony 5.4 SP1 before P3 and 5.5 before Patch 1 has a default password for the root account, which allows local users to gain privileges by leveraging a login session.
Query: vulnerability: CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file,
Matching passage: CVE-2015-3686. CWE: CWE-119. CVSS: 6.800000190734863. CoreText in Apple iOS before 8.4 and OS X before 10.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted text file, a different vulnerability than CVE-2015-3685, CVE-2015-3687, CVE-2015-3688, and CVE-2015-3689.
Near-miss passage: CVE-2015-3135. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4432 and CVE-2015-5118.
Query: risk of In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM96
Matching passage: CVE-2015-9119. CWE: CWE-200. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, sensitive information may be returned to the QMI client as a response.
Near-miss passage: CVE-2015-6114. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a different vulnerability than CVE-2015-6165.
Query: exploit IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted a
Matching passage: CVE-2015-3705. CWE: CWE-119. CVSS: 9.300000190734863. IOAcceleratorFamily in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-3706.
Near-miss passage: CVE-2015-5133. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5131 and CVE-2015-5132.
Query: CWE for Inadequate Encryption Strength
Matching passage: CWE-326 Inadequate Encryption Strength. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Near-miss passage: CWE-1279 Cryptographic Operations are run Before Supporting Units are Ready. Performing cryptographic operations without ensuring that the supporting inputs are ready to supply valid data may compromise the cryptographic result.
Query: CWE for Permissive List of Allowed Inputs
Matching passage: CWE-183 Permissive List of Allowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Near-miss passage: CWE-184 Incomplete List of Disallowed Inputs. The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.
Query: patch priority for CVE-2015-4531
Matching passage: CVE-2015-4531. CWE: CWE-264. CVSS: 9.0. EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data access and server actions, via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4622.
Near-miss passage: CVE-2015-3435. CWE: CWE-264. CVSS: 10.0. Samsung Security Manager (SSM) before 1.31 allows remote attackers to execute arbitrary code by uploading a file with an HTTP (1) PUT or (2) MOVE request.
Query: detect Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious acti in logs
Matching passage: Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious acti. Logsource: windows / process_creation. Rule: title: Response File Execution Via Odbcconf.EXE id: 5f03babb-12db-4eec-8c82-7b4cb5580868 related: - id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 type: similar - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-05 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' selection_rsp_ext: CommandLine|contains: .rsp condition: all of selection_* falsepositives: - The rule is looking for any usage of response file, which might generate false positive when this function is used legitimately. Investigate the contents of the ".rsp" file to determine if it is malicious and apply additional filters if necessary. level: medium
Near-miss passage: Sigma rule: Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a clust. Logsource: kubernetes / application / audit. Rule: title: New Kubernetes Service Account Created id: e31bae15-83ed-473e-bf31-faf4f8a17d36 related: - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2 type: derived status: test description: 'Detects creation of new Kubernetes service account, which could indicate an attacker''s attempt to persist within a cluster. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.persistence - attack.t1136 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: serviceaccounts condition: selection falsepositives: - Unknown level: low
Query: describe CVE-2015-2414
Matching passage: CVE-2015-2414. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to obtain sensitive browsing-history information via vectors related to image caching, aka "Internet Explorer Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-1676. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1677, CVE-2015-1678, CVE-2015-1679, and CVE-2015-1680.