alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: risk of SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL command
Matching passage: CVE-2015-1364. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the getProfile function in system/profile.functions.php in Free Reprintables ArticleFR 3.0.5 allows remote attackers to execute arbitrary SQL commands via the username parameter to register/.
Near-miss passage: CVE-2015-3934. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Fiyo CMS 2.0_1.9.1 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to apps/app_article/controller/rating.php or (2) user parameter to user/login.
Query: CVE similar to CVE-2015-6087
Matching passage: CVE-2015-6087. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6066, CVE-2015-6070, CVE-2015-6071, CVE-2015-6074, and CVE-2015-6076.
Near-miss passage: CVE-2015-8843. CWE: CWE-119. CVSS: 7.400000095367432. The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the Cloud plugin is available, allows local users to gain privileges by writing crafted data to a shared memory region, which triggers memory corruption.
Query: CVE similar to CVE-2015-8375
Matching passage: CVE-2015-8375. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in PHP-Fusion 9.
Near-miss passage: CVE-2015-0734. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities on the Cisco Email Security Appliance (ESA) 8.5.6-106 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCut87743.
Query: describe CVE-2015-0925
Matching passage: CVE-2015-0925. CWE: CWE-94. CVSS: 9.0. The client in iPass Open Mobile before 2.4.5 on Windows allows remote authenticated users to execute arbitrary code via a DLL pathname in a crafted Unicode string that is improperly handled by a subprocess reached through a named pipe, as demonstrated by a UNC share pathname.
Near-miss passage: CVE-2015-0898. CWE: CWE-94. CVSS: 7.5. futomi CGI Cafe MP Form Mail CGI eCommerce before 2.0.12 on Windows allows remote attackers to execute arbitrary Perl code via unspecified vectors.
Query: describe CVE-2015-1422
Matching passage: CVE-2015-1422. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) jak_img, (11) jak_javascript, (12) jak_lcontent, (13) jak_name, (14) jak_password, (15) jak_showcontact, (16) jak_tags, (17) jak_title, (18) jak_url, (19) jak_username, (20) real_hook_id[], (21) sp, (22) sreal_plugin_id[], (23) ssp, or (24) sssp parameter to admin/index.php or the (25) editor, (26) field_id, (27) fldr, (28) lang, (29) popup, (30) subfolder, or (31) type parameter to js/editor/plugins/filemanager/dialog.php.
Near-miss passage: CVE-2015-2934. CWE: CWE-79. CVSS: 4.300000190734863. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Query: vulnerability: The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allow
Matching passage: CVE-2015-7408. CWE: CWE-264. CVSS: 3.700000047683716. The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
Near-miss passage: CVE-2015-5323. CWE: CWE-264. CVSS: 6.5. Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Query: rule covering Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Matching passage: Sigma rule: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.. Logsource: windows / ps_script. Rule: title: NTFS Alternate Data Stream id: 8c521530-5169-495d-a199-0a3a881ad24e status: test description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging. references: - https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: Sami Ruohonen date: 2018-07-24 modified: 2022-12-25 tags: - attack.stealth - attack.t1564.004 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_content: ScriptBlockText|contains: - set-content - add-content selection_stream: ScriptBlockText|contains: -stream condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry. Logsource: windows / registry_set. Rule: title: Windows Defender Service Disabled - Registry id: e1aa95de-610a-427d-b9e7-9b46cfafbe6a status: test description: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali date: 2022-08-01 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Services\WinDefend\Start Details: DWORD (0x00000004) condition: selection falsepositives: - Administrator actions level: high
Query: vulnerability: Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbi
Matching passage: CVE-2015-4492. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the XMLHttpRequest::Open implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 might allow remote attackers to execute arbitrary code via a SharedWorker object that makes recursive calls to the open method of an XMLHttpRequest object.
Near-miss passage: CVE-2015-4554. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in TIBCO Spotfire Client and Spotfire Web Player Client in Spotfire Analyst before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Analytics Platform for AWS 6.5 and 7.0.x before 7.0.1; Spotfire Automation Services before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Deployment Kit before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Desktop before 6.5.2 and 7.0.x before 7.0.1; Spotfire Desktop Language Packs 7.0.x before 7.0.1; Spotfire Professional before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; Spotfire Web Player before 5.5.2, 6.0.x before 6.0.3, 6.5.x before 6.5.3, and 7.0.x before 7.0.1; and Silver Fabric Enabler for Spotfire Web Player before 2.1.1 allow remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.
Query: risk of SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Matching passage: CVE-2015-3964. CWE: UNKNOWN. CVSS: 10.0. SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Near-miss passage: CVE-2015-8322. CWE: UNKNOWN. CVSS: 8.800000190734863. NetApp OnCommand System Manager 8.3.x before 8.3.2 allows remote authenticated users to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-0425
Matching passage: CVE-2015-0425. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Enterprise Asset Management component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Siebel Core - Unix/Windows.
Near-miss passage: CVE-2015-0340. CWE: UNKNOWN. CVSS: 5.0. Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows remote attackers to bypass intended file-upload restrictions via unspecified vectors.
Query: exploit Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject a
Matching passage: CVE-2015-5733. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the refreshAdvancedAccessibilityOfItem function in wp-admin/js/nav-menu.js in WordPress before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via an accessibility-helper title.
Near-miss passage: CVE-2015-9305. CWE: CWE-79. CVSS: 6.099999904632568. The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.
Query: CVE similar to CVE-2015-7787
Matching passage: CVE-2015-7787. CWE: CWE-200. CVSS: 4.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.
Near-miss passage: CVE-2015-8020. CWE: CWE-200. CVSS: 3.700000047683716. Clustered Data ONTAP versions 8.0, 8.3.1, and 8.3.2 contain a default privileged account which under certain conditions can be used for unauthorized information disclosure.
Query: secure coding against Improper Lock Behavior After Power State Transition
Matching passage: CWE-1232 Improper Lock Behavior After Power State Transition. Register lock bit protection disables changes to system configuration once the bit is set. Some of the protected registers or lock bits become programmable after power state transitions (e.g., Entry and wake from low power sleep modes) causing the system configuration to be changeable.
Near-miss passage: CWE-333 Improper Handling of Insufficient Entropy in TRNG. True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
Query: CVE similar to CVE-2015-7244
Matching passage: CVE-2015-7244. CWE: CWE-284. CVSS: 7.5. The default configuration of the server in MobaXterm before 8.3 has a disabled Access Control setting and consequently does not require authentication for X11 connections, which allows remote attackers to execute arbitrary commands or obtain sensitive information via X11 packets.
Near-miss passage: CVE-2015-1959. CWE: CWE-284. CVSS: 4.599999904632568. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action.
Query: vulnerability: upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Matching passage: CVE-2015-5682. CWE: CWE-264. CVSS: 7.5. upload.php in the Powerplay Gallery plugin 3.3 for WordPress allows remote attackers to create arbitrary directories via vectors related to the targetDir variable.
Near-miss passage: CVE-2015-1448. CWE: CWE-264. CVSS: 10.0. The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
Query: vulnerability: The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalSt
Matching passage: CVE-2015-6759. CWE: CWE-200. CVSS: 5.0. The shouldTreatAsUniqueOrigin function in platform/weborigin/SecurityOrigin.cpp in Blink, as used in Google Chrome before 46.0.2490.71, does not ensure that the origin of a LocalStorage resource is considered unique, which allows remote attackers to obtain sensitive information via vectors involving a blob: URL.
Near-miss passage: CVE-2015-1996. CWE: CWE-200. CVSS: 2.0999999046325684. IBM Security QRadar Incident Forensics 7.2.x before 7.2.5 Patch 5 does not prevent caching of HTTPS responses, which allows physically proximate attackers to obtain sensitive local-cache information by leveraging an unattended workstation.
Query: CVE similar to CVE-2015-1551
Matching passage: CVE-2015-1551. CWE: CWE-264. CVSS: 4.0. Directory traversal vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) before 6.4.4 allows remote administrators to read arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-7031. CWE: CWE-264. CVSS: 5.0. The Web Service component in Apple OS X Server before 5.0.15 omits an unspecified HTTP header configuration, which allows remote attackers to bypass intended access restrictions via unknown vectors.
Query: patch priority for CVE-2015-8636
Matching passage: CVE-2015-8636. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8460, and CVE-2015-8645.
Near-miss passage: CVE-2015-7061. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Query: SOC alert related to Match Legitimate Resource Name or Location
Matching passage: T1036.005 Match Legitimate Resource Name or Location. Tactics: stealth. Description: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: `svchost.exe`). Alternatively, a Windows Registry key may be given a close approximation to a key used by a legitimate program. In containerized environments, a threat actor may create a resource in a trusted namespace or one that matches the naming convention of a container pod or cluster.(Citation: Aquasec Kubernetes Backdoor 2023)
Near-miss passage: T1036.010 Masquerade Account Name. Tactics: stealth. Description: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023) Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management.(Citation: Elastic CUBA Ransomware 2022)(Citation: Aquasec Kubernetes Attack 2023) They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.”(Citation: Invictus IR Cloud Ransomware 2024) Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to [Account Discovery](https://attack.mitre.org/techniques/T1087). Note that this is distinct from [Impersonation](https://attack.mitre.org/techniques/T1684/001), which describes impersonating specific trusted individuals or organizations, rather than user or service account names.
Query: detection rule: Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommo
Matching passage: Sigma rule: Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommo. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Potentially Suspicious Child Process id: b6676963-0353-4f88-90f5-36c20d443c6a status: test description: 'Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others. ' references: - Internal Research - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86') date: 2023-05-15 modified: 2024-01-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wscript.exe - \cscript.exe selection_cli_script_main: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe selection_cli_script_option_mshta: CommandLine|contains|all: - mshta - http selection_cli_script_option_other: CommandLine|contains: - rundll32 - regsvr32 - msiexec selection_cli_standalone: Image|endswith: \rundll32.exe filter_main_rundll32_known_exports: Image|endswith: \rundll32.exe CommandLine|contains: - UpdatePerUserSystemParameters - PrintUIEntry - ClearMyTracksByProcess condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_* falsepositives: - Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects the use of Windows Credential Editor (WCE). Logsource: windows / registry_event. Rule: title: Windows Credential Editor Registry id: a6b33c02-8305-488f-8585-03cb2a7763f2 status: test description: Detects the use of Windows Credential Editor (WCE) references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: Services\WCESERVICE\Start condition: selection falsepositives: - Unknown level: critical
Query: vulnerability: Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks.
Matching passage: CVE-2015-2988. CWE: CWE-295. CVSS: 7.400000095367432. Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks.
Near-miss passage: CVE-2015-5263. CWE: CWE-295. CVSS: 8.100000381469727. pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename. Logsource: windows / process_creation. Rule: title: PUA - Potential PE Metadata Tamper Using Rcedit id: 0c92f2e6-f08f-4b73-9216-ecb0ca634689 status: test description: Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion. references: - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915 - https://github.com/electron/rcedit author: Micah Babinski date: 2022-12-11 modified: 2023-03-05 tags: - attack.stealth - attack.t1036.003 - attack.t1036 - attack.t1027.005 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rcedit-x64.exe - \rcedit-x86.exe - Description: Edit resources of exe - Product: rcedit selection_flags: CommandLine|contains: --set- selection_attributes: CommandLine|contains: - OriginalFileName - CompanyName - FileDescription - ProductName - ProductVersion - LegalCopyright condition: all of selection_* falsepositives: - Legitimate use of the tool by administrators or users to update metadata of a binary level: medium
Near-miss passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high