alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc in logs
Matching passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / process_creation. Rule: title: System Network Connections Discovery Via Net.EXE id: 1c67a717-32ba-409b-a45d-0fb704a73a81 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery author: frack113 date: 2021-12-10 modified: 2023-02-21 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: - CommandLine|endswith: - ' use' - ' sessions' - CommandLine|contains: - ' use ' - ' sessions ' condition: all of selection_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using New-ComplianceSearchAction id: 6897cd82-6664-11ed-9022-0242ac120002 related: - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 type: similar status: test description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud. references: - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps author: Nikita Khalimonenkov date: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter Payload|contains|all: - New-ComplianceSearchAction - Export - pst condition: selection falsepositives: - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored. level: medium
Query: risk of Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a sy
Matching passage: CVE-2015-3627. CWE: CWE-59. CVSS: 7.199999809265137. Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
Near-miss passage: CVE-2015-3759. CWE: CWE-59. CVSS: 4.599999904632568. Location Framework in Apple iOS before 8.4.1 allows local users to bypass intended restrictions on filesystem modification via a symlink.
Query: risk of Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML v
Matching passage: CVE-2015-3615. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack.
Near-miss passage: CVE-2015-9397. CWE: CWE-79. CVSS: 5.400000095367432. The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.
Query: write Sigma for Detects the removal of Sysmon, which could be a potential attempt at defense evasion
Matching passage: Sigma rule: Detects the removal of Sysmon, which could be a potential attempt at defense evasion. Logsource: windows / process_creation. Rule: title: Uninstall Sysinternals Sysmon id: 6a5f68d1-c4b5-46b9-94ee-5324892ea939 status: test description: Detects the removal of Sysmon, which could be a potential attempt at defense evasion references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon author: frack113 date: 2022-01-12 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -u condition: all of selection_* falsepositives: - Legitimate administrators might use this command to remove Sysmon for debugging purposes level: high
Near-miss passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed to Zero id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b related: - id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c type: similar - id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. ' references: - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services author: Samir Bousseaden, David ANDRE, Roberto Rodriguez @Cyb3rWard0g, Nasreddine Bencherchali date: 2022-09-29 modified: 2022-11-26 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \fDenyTSConnections - \fSingleSessionPerUser - \UserAuthentication Details: DWORD (0x00000000) condition: selection falsepositives: - Some of the keys mentioned here could be modified by an administrator while setting group policy (it should be investigated either way) level: medium
Query: CVE similar to CVE-2015-9184
Matching passage: CVE-2015-9184. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, and SD 835, lack of length checking in wv_dash_core_load_keys_v8() could lead to a buffer overflow vulnerability.
Near-miss passage: CVE-2015-0100. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Query: risk of The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Matching passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Near-miss passage: CVE-2015-4695. CWE: CWE-119. CVSS: 5.0. meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.
Query: risk of Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not prope
Matching passage: CVE-2015-2730. CWE: CWE-310. CVSS: 4.300000190734863. Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.
Near-miss passage: CVE-2015-1672. CWE: CWE-310. CVSS: 5.0. Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2 allows remote attackers to cause a denial of service (recursion and performance degradation) via crafted encrypted data in an XML document, aka ".NET XML Decryption Denial of Service Vulnerability."
Query: incident response steps for SIEM correlation: defense impairment activity consistent with Cloud Firewall
Matching passage: Playbook for T1686.001 Cloud Firewall. 1) Validate alert telemetry against T1686.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources. Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols. An adversary with appropriate permissions may introduce new firewall rules or policies to allo
Near-miss passage: Playbook for T1686 Disable or Modify System Firewall. Different response path focused on defense impairment.
Query: patch priority for CVE-2015-2007
Matching passage: CVE-2015-2007. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in IBM Security QRadar SIEM 7.2.x before 7.2.5 Patch 6 allows remote authenticated users to read arbitrary files via a crafted URL.
Near-miss passage: CVE-2015-0911. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to read arbitrary files via vectors related to attachment handling.
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 
Matching passage: CVE-2015-5117. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-4430.
Near-miss passage: CVE-2015-3132. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
Query: weakness Class with Excessively Deep Inheritance
Matching passage: CWE-1074 Class with Excessively Deep Inheritance. A class has an inheritance level that is too high, i.e., it has a large number of parent classes.
Near-miss passage: CWE-291 Reliance on IP Address for Authentication. The product uses an IP address for authentication.
Query: detect Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe. in logs
Matching passage: Sigma rule: Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.. Logsource: windows / process_creation. Rule: title: Direct Autorun Keys Modification id: 24357373-078f-44ed-9ac4-6d334a668a11 status: test description: Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-10-25 modified: 2026-01-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_add: CommandLine|contains: add selection_cli_keys: CommandLine|contains: - \software\Microsoft\Windows\CurrentVersion\Run - \software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run - \software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit - \software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell - \software\Microsoft\Windows NT\CurrentVersion\Windows - \system\CurrentControlSet\Control\SafeBoot\AlternateShell condition: all of selection_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reasons. - Legitimate administrator sets up autorun keys for legitimate reasons. - Discord level: medium
Near-miss passage: Sigma rule: Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files o. Logsource: windows / process_creation. Rule: title: JScript Compiler Execution id: 52788a70-f1da-40dd-8fbd-73b5865d6568 status: test description: 'Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Jsc/ - https://www.phpied.com/make-your-javascript-a-windows-exe/ - https://twitter.com/DissectMalware/status/998797808907046913 author: frack113 date: 2022-05-02 modified: 2024-04-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \jsc.exe - OriginalFileName: jsc.exe condition: selection falsepositives: - Legitimate use to compile JScript by developers. level: low
Query: risk of Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1
Matching passage: CVE-2015-5255. CWE: CWE-20. CVSS: 4.300000190734863. Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.354180, 4.5.x before 4.5.1.354177, 4.6.2.x before 4.6.2.354178, and 4.7.x before 4.7.0.354178, allows remote attackers to send HTTP traffic to intranet servers via a crafted XML document, related to a Server-Side Request Forgery (SSRF) issue.
Near-miss passage: CVE-2015-4534. CWE: CWE-20. CVSS: 9.0. Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02 allows remote authenticated users to execute arbitrary code by forging a signature for a query string that lacks the method_verb parameter.
Query: alert when Detects CLR DLL being loaded by an Office Product
Matching passage: Sigma rule: Detects CLR DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: CLR DLL Loaded Via Office Applications id: d13c43f0-f66b-4279-8b2c-5912077c1780 status: test description: Detects CLR DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-03-29 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \outlook.exe - \onenote.exe - \onenoteim.exe - \powerpnt.exe - \winword.exe ImageLoaded|contains: \clr.dll condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell core DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded Via Office Application id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a status: test description: Detects PowerShell core DLL being loaded by an Office Product references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-01 tags: - attack.stealth logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \outlook.exe - \onenote.exe - \onenoteim.exe - \powerpnt.exe - \winword.exe ImageLoaded|contains: - \System.Management.Automation.Dll - \System.Management.Automation.ni.Dll condition: selection falsepositives: - Unknown level: medium
Query: risk of object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to b
Matching passage: CVE-2015-1304. CWE: CWE-284. CVSS: 7.5. object-observe.js in Google V8, as used in Google Chrome before 45.0.2454.101, does not properly restrict method calls on access-checked objects, which allows remote attackers to bypass the Same Origin Policy via a (1) observe or (2) getNotifier call.
Near-miss passage: CVE-2015-6366. CWE: CWE-284. CVSS: 5.0. Cisco IOS 15.2(04)M6 and 15.4(03)S lets physical-interface ACLs supersede tunnel-interface ACLs, which allows remote attackers to bypass intended network-traffic restrictions in opportunistic circumstances by using a tunnel, aka Bug ID CSCur01042.
Query: exploit Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Matching passage: CVE-2015-3110. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Photoshop CC before 16.0 (aka 2015.0.0) and Adobe Bridge CC before 6.11 allows attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-3087. CWE: CWE-189. CVSS: 10.0. Integer overflow in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.
Query: describe CVE-2015-1414
Matching passage: CVE-2015-1414. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Near-miss passage: CVE-2015-8413. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: describe CVE-2015-6634
Matching passage: CVE-2015-6634. CWE: CWE-119. CVSS: 9.300000190734863. The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261.
Near-miss passage: CVE-2015-7202. CWE: CWE-119. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: CVE similar to CVE-2015-5950
Matching passage: CVE-2015-5950. CWE: CWE-119. CVSS: 6.900000095367432. The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.
Near-miss passage: CVE-2015-2377. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: risk of The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users t
Matching passage: CVE-2015-7884. CWE: CWE-200. CVSS: 2.299999952316284. The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
Near-miss passage: CVE-2015-5853. CWE: CWE-200. CVSS: 3.299999952316284. AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors.
Query: vulnerability: Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attac
Matching passage: CVE-2015-2191. CWE: CWE-189. CVSS: 5.0. Integer overflow in the dissect_tnef function in epan/dissectors/packet-tnef.c in the TNEF dissector in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted length field in a packet.
Near-miss passage: CVE-2015-4022. CWE: CWE-189. CVSS: 7.5. Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.