alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging
Matching passage: CVE-2015-2742. CWE: CWE-200. CVSS: 4.300000190734863. Mozilla Firefox before 39.0 on OS X includes native key press information during the logging of crashes, which allows remote attackers to obtain sensitive information by leveraging access to a crash-reporting data stream.
Near-miss passage: CVE-2015-5271. CWE: CWE-200. CVSS: 7.5. The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Query: CVE similar to CVE-2015-7692
Matching passage: CVE-2015-7692. CWE: CWE-20. CVSS: 7.5. The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.
Near-miss passage: CVE-2015-3254. CWE: CWE-20. CVSS: 6.5. The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
Query: detection rule: Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via App
Matching passage: Sigma rule: Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via App. Logsource: windows / process_creation. Rule: title: Potential File Download Via MS-AppInstaller Protocol Handler id: 180c7c5c-d64b-4a63-86e9-68910451bc8b related: - id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a type: derived status: test description: 'Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>" ' references: - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ms-appinstaller://?source= - http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious RDP session redirect using tscon.exe. Logsource: windows / process_creation. Rule: title: Suspicious RDP Redirect Using TSCON id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb status: test description: Detects a suspicious RDP session redirect using tscon.exe references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/ author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2023-05-16 tags: - attack.lateral-movement - attack.t1563.002 - attack.t1021.001 - car.2013-07-002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /dest:rdp-tcp#' condition: selection falsepositives: - Unknown level: high
Query: write Sigma for Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious
Matching passage: Sigma rule: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious. Logsource: windows / process_creation. Rule: title: Execute From Alternate Data Streams id: 7f43c430-5001-4f8b-aaa9-c3b88f18fa5c status: test description: Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: frack113 date: 2021-09-01 modified: 2022-10-09 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection_stream: CommandLine|contains: 'txt:' selection_tools_type: CommandLine|contains|all: - 'type ' - ' > ' selection_tools_makecab: CommandLine|contains|all: - 'makecab ' - .cab selection_tools_reg: CommandLine|contains|all: - 'reg ' - ' export ' selection_tools_regedit: CommandLine|contains|all: - 'regedit ' - ' /E ' selection_tools_esentutl: CommandLine|contains|all: - 'esentutl ' - ' /y ' - ' /d ' - ' /o ' condition: selection_stream and (1 of selection_tools_*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "g. Logsource: windows / file_event. Rule: title: Potential Persistence Via Notepad++ Plugins id: 54127bd4-f541-4ac3-afdb-ea073f63f692 status: test description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence references: - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2025-09-01 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Notepad++\plugins\ TargetFilename|endswith: .dll filter_gup: Image|endswith: \Notepad++\updater\gup.exe filter_install: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Temp\ Image|endswith: - \target.exe - Installer.x64.exe filter_main_installer: Image|contains: \npp. Image|endswith: .exe TargetFilename: - C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll - C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll - C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll - C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll condition: selection and not 1 of filter_* falsepositives: - Possible FPs during first installation of Notepad++ - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities level: medium
Query: describe CVE-2015-8671
Matching passage: CVE-2015-8671. CWE: CWE-264. CVSS: 8.800000190734863. Huawei LogCenter V100R001C10 could allow an authenticated attacker to tamper with requests using a tool and submit a request to the server for privilege escalation, affecting some system functions.
Near-miss passage: CVE-2015-1739. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: exploit OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
Matching passage: CVE-2015-7856. CWE: CWE-255. CVSS: 10.0. OpenNMS has a default password of rtc for the rtc account, which makes it easier for remote attackers to obtain access by leveraging knowledge of the credentials.
Near-miss passage: CVE-2015-4966. CWE: CWE-255. CVSS: 6.5. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
Query: CVE similar to CVE-2015-2600
Matching passage: CVE-2015-2600. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Near-miss passage: CVE-2015-0836. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: CVE similar to CVE-2015-8439
Matching passage: CVE-2015-8439. CWE: UNKNOWN. CVSS: 9.300000190734863. The SharedObject object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code by leveraging an unspecified "type confusion" during a getRemote call, a different vulnerability than CVE-2015-8456.
Near-miss passage: CVE-2015-0471. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to libelfsign.
Query: vulnerability: In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_reque
Matching passage: CVE-2015-9016. CWE: CWE-264. CVSS: 7.0. In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.
Near-miss passage: CVE-2015-6335. CWE: CWE-264. CVSS: 9.0. The policy implementation in Cisco FireSIGHT Management Center 5.3.1.7, 5.4.0.4, and 6.0.0 for VMware allows remote authenticated administrators to bypass intended policy restrictions and execute Linux commands as root via unspecified vectors, aka Bug ID CSCuw12839.
Query: patch priority for CVE-2015-10115
Matching passage: CVE-2015-10115. CWE: CWE-601. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in WooSidebars Sidebar Manager Converter Plugin up to 1.1.1 on WordPress. This affects the function process_request of the file classes/class-woosidebars-sbm-converter.php. The manipulation leads to open redirect. It is possible to initiate the attack remotely. Upgrading to version 1.1.2 is able to address this issue. The patch is named a0efb4ffb9dfe2925b889c1aa5ea40b4abbbda8a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230655.
Near-miss passage: CVE-2015-2749. CWE: CWE-601. CVSS: 6.099999904632568. Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.
Matching passage: CVE-2015-0507. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.
Near-miss passage: CVE-2015-8411. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulner
Matching passage: CVE-2015-4942. CWE: CWE-399. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4943.
Near-miss passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Query: CVE similar to CVE-2015-5290
Matching passage: CVE-2015-5290. CWE: CWE-119. CVSS: 7.5. A Denial of Service vulnerability exists in ircd-ratbox 3.0.9 in the MONITOR Command Handler.
Near-miss passage: CVE-2015-2444. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2442.
Query: risk of WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and appli
Matching passage: CVE-2015-7096. CWE: CWE-119. CVSS: 6.800000190734863. WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7097, CVE-2015-7098, CVE-2015-7099, CVE-2015-7100, CVE-2015-7101, CVE-2015-7102, and CVE-2015-7103.
Near-miss passage: CVE-2015-1714. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: describe CVE-2015-0522
Matching passage: CVE-2015-0522. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in EMC RSA Certificate Manager (RCM) before 6.9 build 558 and RSA Registration Manager (RRM) before 6.9 build 558 allows remote attackers to inject arbitrary web script or HTML via vectors related to the email address parameter.
Near-miss passage: CVE-2015-7348. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter to demo/en/asyncData/getNodesForBigData.php.
Query: describe CVE-2015-4833
Matching passage: CVE-2015-4833. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition.
Near-miss passage: CVE-2015-6664. CWE: UNKNOWN. CVSS: 6.800000190734863. XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data, aka SAP Security Note 2152227.
Query: risk of Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers t
Matching passage: CVE-2015-3039. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0349, CVE-2015-0351, and CVE-2015-0358.
Near-miss passage: CVE-2015-1421. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
Query: explain CWE-759
Matching passage: CWE-759 Use of a One-Way Hash without a Salt. The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
Near-miss passage: CWE-243 Creation of chroot Jail Without Changing Working Directory. The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
Query: explain CWE-115
Matching passage: CWE-115 Misinterpretation of Input. The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
Near-miss passage: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Query: vulnerability: The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote att
Matching passage: CVE-2015-5470. CWE: CWE-399. CVSS: 7.800000190734863. The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.4.5 allows remote attackers to cause a denial of service (CPU consumption or crash) via a request with a long name that refers to itself. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1868.
Near-miss passage: CVE-2015-5362. CWE: CWE-399. CVSS: 9.300000190734863. The BFD daemon in Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before 12.1X46-D35, 12.1X47 before 12.1X47-D25, 12.3 before 12.3R10, 12.3X48 before 12.3X48-D15, 13.2 before 13.2R8, 13.3 before 13.3R6, 14.1 before 14.1R5, 14.1X50 before 14.1X50-D85, 14.1X55 before 14.1X55-D20, 14.2 before 14.2R3, 15.1 before 15.1R1, and 15.1X49 before 15.1X49-D10 allows remote attackers to cause a denial of service (bfdd crash and restart) or execute arbitrary code via a crafted BFD packet.
Query: detect DNS
Matching passage: T1071.004 DNS. Tactics: command and control. Description: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. The DNS protocol serves an administrative function in computer networking and thus may be very common in environments. DNS traffic may also be allowed even before network authentication is completed. DNS packets contain many fields and headers in which data can be concealed. Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.(Citation: PAN DNS Tunneling)(Citation: Medium DnsTunneling) DNS beaconing may be used to send commands to remote systems via DNS queries. A DNS beacon is created by tunneling DNS traffic (i.e. [Protocol Tunneling](https://attack.mitre.org/techniques/T1572)). The commands may be embedded into different DNS records, for example, TXT or A records.(Citation: OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government) DNS beacons may be difficult to detect because the beacons infrequently communicate with infected devices.(Citation: DNS Beacons) Infrequent communication conceals the malicious DNS traffic with normal DNS traffic.
Near-miss passage: T1071.001 Web Protocols. Tactics: command and control. Description: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as HTTP/S(Citation: CrowdStrike Putter Panda) and WebSocket(Citation: Brazking-Websockets) that carry web traffic may be very common in environments. HTTP/S packets have many fields and headers in which data can be concealed. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.
Query: exploit The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL
Matching passage: CVE-2015-6423. CWE: CWE-264. CVSS: 4.300000190734863. The DCERPC Inspection implementation in Cisco Adaptive Security Appliance (ASA) Software 9.4.1 through 9.5.1 allows remote authenticated users to bypass an intended DCERPC-only ACL by sending arbitrary network traffic, aka Bug ID CSCuu67782.
Near-miss passage: CVE-2015-9008. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689.