alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 201
Matching passage: CVE-2015-2510. CWE: CWE-119. CVSS: 9.300000190734863. Buffer overflow in the Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Lync 2010, Lync 2010 Attendee, Lync 2013 SP1, Lync Basic 2013 SP1, and Live Meeting 2007 Console allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "Graphics Component Buffer Overflow Vulnerability."
Near-miss passage: CVE-2015-2491. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2485 and CVE-2015-2541.
Query: risk of EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malform
Matching passage: CVE-2015-6849. CWE: CWE-20. CVSS: 7.800000190734863. EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malformed RPC authentication messages.
Near-miss passage: CVE-2015-5386. CWE: CWE-20. CVSS: 9.300000190734863. Siemens SICAM MIC devices with firmware before 2404 allow remote attackers to bypass authentication and obtain administrative access via unspecified HTTP requests.
Query: vulnerability: Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 allows remote attackers to hijack the authentication of arbitrary users f
Matching passage: CVE-2015-1894. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM InfoSphere Optim Workload Replay 2.x before 2.1.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Near-miss passage: CVE-2015-0741. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.
Query: detection rule: Detects file being transferred via ScreenConnect RMM
Matching passage: Sigma rule: Detects file being transferred via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect File Transfer id: 5d19eb78-5b5b-4ef2-a9f0-4bfa94d58a13 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects file being transferred via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 201 Data|contains: Transferred files with action condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Near-miss passage: Sigma rule: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process. Logsource: windows / process_creation. Rule: title: Potential LethalHTA Technique Execution id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471 status: test description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process references: - https://codewhitesec.blogspot.com/2018/07/lethalhta.html author: Markus Neis date: 2018-06-07 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mshta.exe condition: selection falsepositives: - Unknown level: high
Query: weakness Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Matching passage: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion'). The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Near-miss passage: CWE-606 Unchecked Input for Loop Condition. The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Query: describe CVE-2015-4802
Matching passage: CVE-2015-4802. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Partition, a different vulnerability than CVE-2015-4792.
Near-miss passage: CVE-2015-2167. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the 3PI Manager in Ericsson Drutt Mobile Service Delivery Platform (MSDP) 4, 5, and 6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to jsp/start-3pi-manager.jsp.
Query: exploit Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B2
Matching passage: CVE-2015-8318. CWE: CWE-119. CVSS: 7.800000190734863. Heap-based buffer overflow in the HIFI driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230, and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows attackers to cause a denial of service (system crash) or gain privileges via a crafted application, a different vulnerability than CVE-2015-8319.
Near-miss passage: CVE-2015-2499. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2486, CVE-2015-2487, CVE-2015-2490, CVE-2015-2492, CVE-2015-2494, and CVE-2015-2498.
Query: detection rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could
Matching passage: Sigma rule: Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could. Logsource: github / audit. Rule: title: GitHub Repository Pages Site Changed to Public id: 0c46d4f4-a2bf-4104-9597-8d653fc2bb55 status: experimental description: 'Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code. ' references: - https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.collection - attack.exfiltration - attack.t1567.001 logsource: product: github service: audit detection: selection: action: repo.pages_public condition: selection falsepositives: - Legitimate publishing of repository pages by authorized users level: low
Near-miss passage: Sigma rule: Detects when a possible suspicious driver is being installed via pnputil.exe lolbin. Logsource: windows / process_creation. Rule: title: Suspicious Driver Install by pnputil.exe id: a2ea3ae7-d3d0-40a0-a55c-25a45c87cac1 status: test description: Detects when a possible suspicious driver is being installed via pnputil.exe lolbin references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax - https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html author: Hai Vaknin @LuxNoBulIshit, Avihay eldad @aloneliassaf, Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - -i - /install - -a - /add-driver - '.inf' Image|endswith: \pnputil.exe condition: selection falsepositives: - Pnputil.exe being used may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Pnputil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: CVE similar to CVE-2015-0995
Matching passage: CVE-2015-0995. CWE: CWE-255. CVSS: 5.0. Inductive Automation Ignition 7.7.2 uses MD5 password hashes, which makes it easier for context-dependent attackers to obtain access via a brute-force attack.
Near-miss passage: CVE-2015-8362. CWE: CWE-255. CVSS: 9.800000190734863. The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, which makes it easier for remote attackers to obtain access via a (1) SSH or (2) HTTP session, a different vulnerability than CVE-2016-1984.
Query: vulnerability: Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing o
Matching passage: CVE-2015-7761. CWE: CWE-200. CVSS: 5.0. Mail in Apple OS X before 10.11 does not properly recognize user preferences, which allows attackers to obtain sensitive information via an unspecified action during the printing of an e-mail message, a different vulnerability than CVE-2015-7760.
Near-miss passage: CVE-2015-7207. CWE: CWE-200. CVSS: 5.0. Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via crafted JavaScript code that leverages history.back and performance.getEntries calls, a related issue to CVE-2015-1300.
Query: write Sigma for Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan
Matching passage: Sigma rule: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan. Logsource: windows / process_creation. Rule: title: Suspicious Chromium Browser Instance Executed With Custom Extension id: 27ba3207-dd30-4812-abbf-5d20c57d474e related: - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 type: similar status: test description: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
Near-miss passage: Sigma rule: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.. Logsource: windows / file_event. Rule: title: Startup Folder File Write id: 2aa0a6b4-a865-495b-ab51-c28249537b75 related: - id: 28208707-fe31-437f-9a7f-4b1108b94d2e type: similar status: test description: A General detection for files being created in the Windows startup directory. This could be an indicator of persistence. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/12 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-12-03 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Microsoft\Windows\Start Menu\Programs\StartUp filter_main_update: - Image: - C:\Windows\System32\wuauclt.exe - C:\Windows\uus\ARM64\wuaucltcore.exe - TargetFilename|startswith: - C:\$WINDOWS.~BT\NewOS\ - C:\$WinREAgent\Scratch\Mount\ filter_optional_onenote: Image|endswith: \ONENOTE.EXE TargetFilename|endswith: \Send to OneNote.lnk condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - FP could be caused by legitimate application writing shortcuts for example. This folder should always be inspected to make sure that all the files in there are legitimate level: medium
Query: exploit Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 a
Matching passage: CVE-2015-2375. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel Viewer 2007 SP3, Excel Services on SharePoint Server 2010 SP2, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to bypass the ASLR protection mechanism via a crafted spreadsheet, aka "Microsoft Excel ASLR Bypass Vulnerability."
Near-miss passage: CVE-2015-5583. CWE: CWE-200. CVSS: 4.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allow attackers to bypass intended sandbox restrictions and obtain sensitive PDF information by launching a print job on a remote printer, a different vulnerability than CVE-2015-6705, CVE-2015-6706, and CVE-2015-7624.
Query: playbook for alert: EDR alert: possible Credential Stuffing (T1110.004)
Matching passage: Playbook for T1110.004 Credential Stuffing. 1) Validate alert telemetry against T1110.004. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: credential access. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap. Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed. The information may be useful to an adversary attempting to compromise accounts by taking advant
Near-miss passage: Playbook for T1110 Brute Force. Different response path focused on credential access.
Query: exploit Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Inform
Matching passage: CVE-2015-2532. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync Server XSS Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-2986. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: write Sigma for Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux
Matching passage: Sigma rule: Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux. Logsource: windows / process_creation. Rule: title: Installation of WSL Kali-Linux id: eca8ae39-5c3c-4321-b538-9e64fe25822e status: experimental description: 'Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes. ' references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_wsl_img: - Image|endswith: \wsl.exe - OriginalFileName: wsl selection_wsl_install: CommandLine|contains: - ' --install ' - ' -i ' selection_wsl_kali: CommandLine|contains: kali condition: all of selection_wsl_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Near-miss passage: Sigma rule: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossibl. Logsource: m365 / threat_management. Rule: title: Microsoft 365 - Impossible Travel Activity id: d7eab125-5f94-43df-8710-795b80fa1189 status: test description: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2020-07-06 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Impossible travel activity status: success condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: CRLF injection vulnerability in Cisco TelePresence TC 6.x before 6.3.4 and 7.x before 7.3.3 on Integrator C SX20 devices allows remote attackers to inject arbitrary HTTP headers an
Matching passage: CVE-2015-0770. CWE: CWE-20. CVSS: 5.0. CRLF injection vulnerability in Cisco TelePresence TC 6.x before 6.3.4 and 7.x before 7.3.3 on Integrator C SX20 devices allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL, aka Bug ID CSCut79341.
Near-miss passage: CVE-2015-8538. CWE: CWE-20. CVSS: 6.5. dwarf_leb.c in libdwarf allows attackers to cause a denial of service (SIGSEGV).
Query: CVE similar to CVE-2015-3388
Matching passage: CVE-2015-3388. CWE: CWE-352. CVSS: 5.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors.
Near-miss passage: CVE-2015-2248. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the user portal in Dell SonicWALL Secure Remote Access (SRA) products with firmware before 7.5.1.0-38sv and 8.x before 8.0.0.1-16sv allows remote attackers to hijack the authentication of users for requests that create bookmarks via a crafted request to cgi-bin/editBookmark.
Query: patch priority for CVE-2015-1949
Matching passage: CVE-2015-1949. CWE: CWE-77. CVSS: 10.0. The server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to execute arbitrary commands with SYSTEM privileges via unspecified vectors.
Near-miss passage: CVE-2015-5080. CWE: CWE-77. CVSS: 9.0. The Management Interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.1 before 10.1.132.8, 10.5 before Build 56.15, and 10.5.e before Build 56.1505.e allows remote authenticated users to execute arbitrary shell commands via shell metacharacters in the filter parameter to rapi/ipsec_logs.
Query: risk of Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING i
Matching passage: CVE-2015-2069. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.2.11 for WordPress allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING in the wc-reports page to wp-admin/admin.php.
Near-miss passage: CVE-2015-10117. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability, which was classified as problematic, was found in Gravity Forms DPS PxPay Plugin up to 1.4.2 on WordPress. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.4.3 is able to address this issue. The name of the patch is 5966a5e6343e3d5610bdfa126a5cfbae95e629b6. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230664.
Query: CVE similar to CVE-2015-3414
Matching passage: CVE-2015-3414. CWE: CWE-908. CVSS: 7.5. SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
Near-miss passage: CVE-2015-8390. CWE: CWE-908. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Query: exploit Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web
Matching passage: CVE-2015-2727. CWE: CWE-20. CVSS: 6.800000190734863. Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a CVE-2015-0821 regression.
Near-miss passage: CVE-2015-6407. CWE: CWE-20. CVSS: 4.0. Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.