alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the image load of VSS DLL by uncommon executables
Matching passage: Sigma rule: Detects the image load of VSS DLL by uncommon executables. Logsource: windows / image_load. Rule: title: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load id: 48bfd177-7cf2-412b-ad77-baf923489e82 related: - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: Detects the image load of VSS DLL by uncommon executables references: - https://github.com/ORCx41/DeleteShadowCopies author: frack113 date: 2023-02-17 modified: 2025-12-03 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vsstrace.dll filter_main_windows: - Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\Temp\{ - C:\Windows\WinSxS\ - C:\ProgramData\Package Cache\{ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_optional_recovery: Image|startswith: C:\$WinREAgent\Scratch\ filter_main_null_image: Image: null filter_optional_avira: Image|contains|all: - \temp\is- - \avira_system_speedup.tmp condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.. Logsource: windows / process_creation. Rule: title: Raccine Uninstall id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc status: test description: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool. references: - https://github.com/Neo23x0/Raccine author: Florian Roth (Nextron Systems) date: 2021-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - 'taskkill ' - RaccineSettings.exe selection2: CommandLine|contains|all: - reg.exe - delete - Raccine Tray selection3: CommandLine|contains|all: - schtasks - /DELETE - Raccine Rules Updater condition: 1 of selection* falsepositives: - Legitimate deinstallation by administrative staff level: high
Query: CVE similar to CVE-2015-1414
Matching passage: CVE-2015-1414. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Near-miss passage: CVE-2015-8413. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: EDR alert: possible Archive Collected Data (T1560)
Matching passage: T1560 Archive Collected Data. Tactics: collection. Description: An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.(Citation: DOJ GRU Indictment Jul 2018) Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender. Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.
Near-miss passage: T1560.001 Archive via Utility. Tactics: collection. Description: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. Some third party utilities may be preinstalled, such as <code>tar</code> on Linux and macOS or <code>zip</code> on Windows systems. On Windows, <code>diantz</code> or <code> makecab</code> may be used to package collected files into a cabinet (.cab) file. <code>diantz</code> may also be used to download and compress files from remote locations (i.e. [Remote Data Staging](https://attack.mitre.org/techniques/T1074/002)).(Citation: diantz.exe_lolbas) <code>xcopy</code> on Windows can copy files and directories with a variety of options. Additionally, adversaries may use [certutil](https://attack.mitre.org/software/S0160) to Base64 encode collected data before exfiltration. Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.(Citation: 7zip Homepage)(Citation: WinRAR Homepage)(Citation: WinZip Homepage)
Query: detection rule: Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this uti
Matching passage: Sigma rule: Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this uti. Logsource: windows / process_creation. Rule: title: Xwizard.EXE Execution From Non-Default Location id: 193d5ccd-6f59-40c6-b5b0-8e32d5ddd3d1 status: test description: 'Detects the execution of Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll". ' references: - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ author: Christian Burkard (Nextron Systems) date: 2021-09-20 modified: 2024-08-15 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \xwizard.exe - OriginalFileName: xwizard.exe filter_main_legit_location: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Windows installed on non-C drive level: high
Near-miss passage: Sigma rule: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware. Logsource: windows / process_creation. Rule: title: RDP Connection Allowed Via Netsh.EXE id: 01aeb693-138d-49d2-9403-c4f52d7d3d62 status: test description: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware references: - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/ author: Sander Wiebing date: 2020-05-23 modified: 2023-12-11 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - 'firewall ' - 'add ' - 'tcp ' - '3389' CommandLine|contains: - portopening - allow condition: all of selection_* falsepositives: - Legitimate administration activity level: high
Query: exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vecto
Matching passage: CVE-2015-0453. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.53 and 8.54 allows remote attackers to affect confidentiality via vectors related to PORTAL.
Near-miss passage: CVE-2015-4732. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-2590.
Query: exploit SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Matching passage: CVE-2015-5893. CWE: CWE-200. CVSS: 2.0999999046325684. SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Near-miss passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Query: alert when An attacker can use the SID history attribute to gain additional privileges.
Matching passage: Sigma rule: An attacker can use the SID history attribute to gain additional privileges.. Logsource: windows / security. Rule: title: Addition of SID History to Active Directory Object id: 2632954e-db1c-49cb-9936-67d1ef1d17d2 status: stable description: An attacker can use the SID history attribute to gain additional privileges. references: - https://adsecurity.org/?p=1772 author: Thomas Patzke, @atc_project (improvements) date: 2017-02-19 tags: - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1134.005 logsource: product: windows service: security detection: selection1: EventID: - 4765 - 4766 selection2: EventID: 4738 selection3: SidHistory: - '-' - '%%1793' filter_null: SidHistory: null condition: selection1 or (selection2 and not selection3 and not filter_null) falsepositives: - Migration of an account into a new domain level: medium
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare. Logsource: windows / process_creation. Rule: title: WSL Child Process Anomaly id: 2267fe65-0681-42ad-9a6d-46553d3f3480 related: - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b type: derived status: test description: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/ - https://twitter.com/nas_bench/status/1535431474429808642 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2023-08-15 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_children_images: Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_children_paths: Image|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - C:\Windows\Temp\ - C:\Temp\ - \Downloads\ - \Desktop\ condition: selection_parent and 1 of selection_children_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-2936
Matching passage: CVE-2015-2936. CWE: CWE-399. CVSS: 7.099999904632568. MediaWiki 1.24.x before 1.24.2, when using PBKDF2 for password hashing, allows remote attackers to cause a denial of service (CPU consumption) via a long password.
Near-miss passage: CVE-2015-5143. CWE: CWE-399. CVSS: 7.800000190734863. The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech. Logsource: windows / process_creation. Rule: title: Sdclt Child Processes id: da2738f2-fadb-4394-afa7-0a0674885afa status: test description: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdclt.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential process patterns related to Cobalt Strike beacon activity. Logsource: windows / process_creation. Rule: title: Potential CobaltStrike Process Patterns id: f35c5d71-b489-4e22-a115-f003df287317 status: test description: Detects potential process patterns related to Cobalt Strike beacon activity references: - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-07-27 modified: 2023-03-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_generic_1: CommandLine|endswith: cmd.exe /C whoami ParentImage|startswith: C:\Temp\ selection_generic_2: ParentImage|endswith: - \runonce.exe - \dllhost.exe CommandLine|contains|all: - cmd.exe /c echo - '> \\\\.\\pipe' selection_conhost_1: ParentCommandLine|contains|all: - cmd.exe /C echo - ' > \\\\.\\pipe' CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 selection_conhost_2: ParentCommandLine|endswith: /C whoami CommandLine|endswith: conhost.exe 0xffffffff -ForceV1 condition: 1 of selection_* falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-7201
Matching passage: CVE-2015-7201. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-8520. CWE: CWE-119. CVSS: 9.800000190734863. Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code via a crafted command, a different vulnerability than CVE-2015-8519, CVE-2015-8521, and CVE-2015-8522.
Query: alert when Show when a monitor or a span/rspan is setup or modified
Matching passage: Sigma rule: Show when a monitor or a span/rspan is setup or modified. Logsource: cisco / aaa. Rule: title: Cisco Sniffing id: b9e1f193-d236-4451-aaae-2f3d2102120d status: test description: Show when a monitor or a span/rspan is setup or modified author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: cisco service: aaa detection: keywords: - monitor capture point - set span - set rspan condition: keywords falsepositives: - Admins may setup new or modify old spans, or use a monitor for troubleshooting level: medium
Near-miss passage: Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Enable Windows Remote Management id: 991a9744-f2f0-44f2-bd33-9092eba17dc3 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Enable-PSRemoting ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) cat
Matching passage: CVE-2015-1475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to (a) board_entry.php or (b) forum_entry.php.
Near-miss passage: CVE-2015-7798. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Cybozu Office 9.0.0 through 10.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2015-7795, CVE-2015-7796, CVE-2015-7797, CVE-2016-1149, and CVE-2016-1150.
Query: alert when Detects non-system users performing privileged operation os the SCM database
Matching passage: Sigma rule: Detects non-system users performing privileged operation os the SCM database. Logsource: windows / security. Rule: title: SCM Database Privileged Operation id: dae8171c-5ec6-4396-b210-8466585b53e9 status: test description: Detects non-system users performing privileged operation os the SCM database references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-08-15 modified: 2022-09-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows service: security detection: selection: EventID: 4674 ObjectType: SC_MANAGER OBJECT ObjectName: servicesactive PrivilegeList: SeTakeOwnershipPrivilege filter: SubjectLogonId: '0x3e4' ProcessName|endswith: :\Windows\System32\services.exe condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe". Logsource: windows / process_creation. Rule: title: Lolbin Unregmp2.exe Use As Proxy id: 727454c0-d851-48b0-8b89-385611ab0704 status: test description: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe" references: - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/ author: frack113 date: 2022-12-29 modified: 2024-06-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \unregmp2.exe - OriginalFileName: unregmp2.exe selection_cmd: CommandLine|contains|windash: ' /HideWMP' condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-6314
Matching passage: CVE-2015-6314. CWE: CWE-287. CVSS: 9.800000190734863. Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors, aka Bug ID CSCuw06153.
Near-miss passage: CVE-2015-7361. CWE: CWE-287. CVSS: 9.300000190734863. FortiOS 5.2.3, when configured to use High Availability (HA) and the dedicated management interface is enabled, does not require authentication for access to the ZebOS shell on the HA dedicated management interface, which allows remote attackers to obtain shell access via unspecified vectors.
Query: CVE similar to CVE-2015-1285
Matching passage: CVE-2015-1285. CWE: CWE-200. CVSS: 5.0. The XSSAuditor::canonicalize function in core/html/parser/XSSAuditor.cpp in the XSS auditor in Blink, as used in Google Chrome before 44.0.2403.89, does not properly choose a truncation point, which makes it easier for remote attackers to obtain sensitive information via an unspecified linear-time attack.
Near-miss passage: CVE-2015-7456. CWE: CWE-200. CVSS: 6.5. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
Query: risk of Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attac
Matching passage: CVE-2015-6273. CWE: CWE-399. CVSS: 7.800000190734863. Cisco IOS XE before 3.1.2S on ASR 1000 devices mishandles the automatic setup of Virtual Fragment Reassembly (VFR) by certain firewall and NAT components, which allows remote attackers to cause a denial of service (Embedded Services Processor crash) via crafted IP packets, aka Bug IDs CSCtf87624, CSCte93229, CSCtd19103, and CSCti63623.
Near-miss passage: CVE-2015-0021. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: exploit Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of servi
Matching passage: CVE-2015-7971. CWE: CWE-19. CVSS: 2.0999999046325684. Xen 3.2.x through 4.6.x does not limit the number of printk console messages when logging certain pmu and profiling hypercalls, which allows local guests to cause a denial of service via a sequence of crafted (1) HYPERCALL_xenoprof_op hypercalls, which are not properly handled in the do_xenoprof_op function in common/xenoprof.c, or (2) HYPERVISOR_xenpmu_op hypercalls, which are not properly handled in the do_xenpmu_op function in arch/x86/cpu/vpmu.c.
Near-miss passage: CVE-2015-8772. CWE: CWE-19. CVSS: 9.100000381469727. McPvDrv.sys 4.6.111.0 in McAfee File Lock 5.x in McAfee Total Protection allows local users to obtain sensitive information from kernel memory or cause a denial of service (system crash) via a large VERIFY_INFORMATION.Length value in an IOCTL_DISK_VERIFY ioctl call.
Query: vulnerability: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Mem
Matching passage: CVE-2015-1718. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1658, CVE-2015-1706, CVE-2015-1711, and CVE-2015-1717.
Near-miss passage: CVE-2015-1521. CWE: CWE-119. CVSS: 7.5. analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.