alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the start of a non built-in assistive technology applications via "Atbroker.EXE". in logs
Matching passage: Sigma rule: Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".. Logsource: windows / process_creation. Rule: title: Uncommon Assistive Technology Applications Execution Via AtBroker.EXE id: f24bcaea-0cd1-11eb-adc1-0242ac120002 status: test description: Detects the start of a non built-in assistive technology applications via "Atbroker.EXE". references: - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ author: Mateusz Wydra, oscd.community date: 2020-10-12 modified: 2024-03-06 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AtBroker.exe - OriginalFileName: AtBroker.exe selection_cli: CommandLine|contains: start filter_main_builtin: CommandLine|contains: - animations - audiodescription - caretbrowsing - caretwidth - colorfiltering - cursorindicator - cursorscheme - filterkeys - focusborderheight - focusborderwidth - highcontrast - keyboardcues - keyboardpref - livecaptions - magnifierpane - messageduration - minimumhitradius - mousekeys - Narrator - osk - overlappedcontent - showsounds - soundsentry - speechreco - stickykeys - togglekeys - voiceaccess - windowarranging - windowtracking - windowtrackingtimeout - windowtrackingzorder filter_optional_java: CommandLine|contains: Oracle_JavaAccessBridge condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate, non-default assistive technology applications execution level: medium
Near-miss passage: Sigma rule: Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t. Logsource: linux / auditd. Rule: title: Screen Capture with Import Tool id: dbe4b9c5-c254-4258-9688-d6af0b7967fd status: test description: 'Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md - https://linux.die.net/man/1/import - https://imagemagick.org/ author: Pawel Mazur date: 2021-09-21 modified: 2022-10-09 tags: - attack.collection - attack.t1113 logsource: product: linux service: auditd detection: import: type: EXECVE a0: import import_window_root: a1: -window a2: root a3|endswith: - .png - .jpg - .jpeg import_no_window_root: a1|endswith: - .png - .jpg - .jpeg condition: import and (import_window_root or import_no_window_root) falsepositives: - Legitimate use of screenshot utility level: low
Query: describe CVE-2015-8482
Matching passage: CVE-2015-8482. CWE: CWE-264. CVSS: 2.0999999046325684. Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which allows local administrators to unblock categories or disable the agent via unspecified vectors.
Near-miss passage: CVE-2015-5897. CWE: CWE-264. CVSS: 4.599999904632568. The Address Book framework in Apple OS X before 10.11 allows local users to gain privileges by using an environment variable to inject code into processes that rely on this framework.
Query: exploit Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
Matching passage: CVE-2015-0759. CWE: CWE-20. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Cisco Headend Digital Broadband Delivery System allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-1302. CWE: CWE-20. CVSS: 7.5. The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.
Query: threat report mentioning Identify Roles
Matching passage: T1591.004 Identify Roles. Tactics: reconnaissance. Description: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting. Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Phishing](https://attack.mitre.org/techniques/T1566)).
Near-miss passage: T1591.003 Identify Business Tempo. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's business tempo that can be used during targeting. Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week. This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources. Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: [Social Media](https://attack.mitre.org/techniques/T1593/001) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)).(Citation: ThreatPost Broadvoice Leak) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199))
Query: describe CVE-2015-3910
Matching passage: CVE-2015-3910. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google V8 before 4.3.61.21, as used in Google Chrome before 43.0.2357.65, allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Near-miss passage: CVE-2015-1294. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the SkMatrix::invertNonIdentity function in core/SkMatrix.cpp in Skia, as used in Google Chrome before 45.0.2454.85, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering the use of matrix elements that lead to an infinite result during an inversion calculation.
Query: write Sigma for Detects usage of base64 utility to decode arbitrary base64-encoded text
Matching passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: macos / process_creation. Rule: title: Decode Base64 Encoded Text -MacOs id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: macos detection: selection: Image: /usr/bin/base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN i. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By IMEWDBLD.EXE id: 8d7e392e-9b28-49e1-831d-5949c6281228 related: - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af type: derived status: test description: 'Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: frack113 date: 2022-01-22 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \IMEWDBLD.exe condition: selection falsepositives: - Unknown level: high
Query: risk of Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML vi
Matching passage: CVE-2015-2840. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in help/rt/large_search.html in Citrix NetScaler before 10.5 build 52.3nc allows remote attackers to inject arbitrary web script or HTML via the searchQuery parameter.
Near-miss passage: CVE-2015-3275. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
Query: exploit Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HT
Matching passage: CVE-2015-3429. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in example.html in Genericons before 3.3.1, as used in WordPress before 4.2.2, allows remote attackers to inject arbitrary web script or HTML via a fragment identifier.
Near-miss passage: CVE-2015-2681. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) next_page, (2) group_id, (3) action_script, or (4) flag parameter to start_apply.htm.
Query: weakness Acceptance of Extraneous Untrusted Data With Trusted Data
Matching passage: CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data. The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
Near-miss passage: CWE-1290 Incorrect Decoding of Security Identifiers. The product implements a decoding mechanism to decode certain bus-transaction signals to security identifiers. If the decoding is implemented incorrectly, then untrusted agents can now gain unauthorized access to the asset.
Query: patch priority for CVE-2015-0272
Matching passage: CVE-2015-0272. CWE: UNKNOWN. CVSS: 5.0. GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215.
Near-miss passage: CVE-2015-8580. CWE: UNKNOWN. CVSS: 6.800000190734863. Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPDF before 7.2.2 allow remote attackers to execute arbitrary code via a crafted PDF document.
Query: common weakness: Excessively Complex Data Representation
Matching passage: CWE-1093 Excessively Complex Data Representation. The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures.
Near-miss passage: CWE-698 Execution After Redirect (EAR). The web application sends a redirect to another location, but instead of exiting, it executes additional code.
Query: exfiltration using Exfiltration Over Other Network Medium
Matching passage: T1011 Exfiltration Over Other Network Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Near-miss passage: T1011.001 Exfiltration Over Bluetooth. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Query: CVE similar to CVE-2015-2344
Matching passage: CVE-2015-2344. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in VMware vRealize Automation 6.x before 6.2.4 on Linux allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0917. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the backend in Kajona before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via the action parameter to index.php.
Query: detection rule: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See refer
Matching passage: Sigma rule: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See refer. Logsource: windows / registry_set. Rule: title: Potential Attachment Manager Settings Associations Tamper id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47 status: test description: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information) references: - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738 - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-08-17 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\ selection_value_default_file_type_rsik: TargetObject|endswith: \DefaultFileTypeRisk Details: DWORD (0x00006152) selection_value_low_risk_filetypes: TargetObject|endswith: \LowRiskFileTypes Details|contains: - .zip; - .rar; - .exe; - .bat; - .com; - .cmd; - .reg; - .msi; - .htm; - .html; condition: selection_main and 1 of selection_value_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines. Logsource: windows / process_creation. Rule: title: Suspicious Obfuscated PowerShell Code id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35 status: test description: Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines references: - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/ author: Florian Roth (Nextron Systems) date: 2022-07-11 modified: 2023-02-14 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IAAtAGIAeABvAHIAIAAwAHgA - AALQBiAHgAbwByACAAMAB4A - gAC0AYgB4AG8AcgAgADAAeA - AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg - AuAEkAbgB2AG8AawBlACgAKQAgAHwAI - ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC - AHsAMQB9AHsAMAB9ACIAIAAtAGYAI - B7ADEAfQB7ADAAfQAiACAALQBmAC - AewAxAH0AewAwAH0AIgAgAC0AZgAg - AHsAMAB9AHsAMwB9ACIAIAAtAGYAI - B7ADAAfQB7ADMAfQAiACAALQBmAC - AewAwAH0AewAzAH0AIgAgAC0AZgAg - AHsAMgB9AHsAMAB9ACIAIAAtAGYAI - B7ADIAfQB7ADAAfQAiACAALQBmAC - AewAyAH0AewAwAH0AIgAgAC0AZgAg - AHsAMQB9AHsAMAB9ACcAIAAtAGYAI - B7ADEAfQB7ADAAfQAnACAALQBmAC - AewAxAH0AewAwAH0AJwAgAC0AZgAg - AHsAMAB9AHsAMwB9ACcAIAAtAGYAI - B7ADAAfQB7ADMAfQAnACAALQBmAC - AewAwAH0AewAzAH0AJwAgAC0AZgAg - AHsAMgB9AHsAMAB9ACcAIAAtAGYAI - B7ADIAfQB7ADAAfQAnACAALQBmAC - AewAyAH0AewAwAH0AJwAgAC0AZgAg condition: selection falsepositives: - Unknown level: high
Query: campaign using Steganography
Matching passage: T1027.003 Steganography. Tactics: stealth. Description: Adversaries may use steganography techniques in order to prevent the detection of hidden information. Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files. [Duqu](https://attack.mitre.org/software/S0038) was an early example of malware that used steganography. It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.(Citation: Wikipedia Duqu) By the end of 2017, a threat group used <code>Invoke-PSImage</code> to hide [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands in an image file (.png) and execute the code on a victim's system. In this particular case the [PowerShell](https://attack.mitre.org/techniques/T1059/001) code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.(Citation: McAfee Malicious Doc Targets Pyeongchang Olympics)
Near-miss passage: T1027.010 Command Obfuscation. Tactics: stealth. Description: Adversaries may obfuscate content during command execution to impede detection. Command-line obfuscation is a method of making strings and patterns within commands and scripts more difficult to signature and analyze. This type of obfuscation can be included within commands executed by delivered payloads (e.g., [Phishing](https://attack.mitre.org/techniques/T1566) and [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)) or interactively via [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: Akamai JS)(Citation: Malware Monday VBE) For example, adversaries may abuse syntax that utilizes various symbols and escape characters (such as spacing, `^`, `+`. `$`, and `%`) to make commands difficult to analyze while maintaining the same intended functionality.(Citation: RC PowerShell) Many languages support built-in obfuscation in the form of base64 or URL encoding.(Citation: Microsoft PowerShellB64) Adversaries may also manually implement command obfuscation via string splitting (`“Wor”+“d.Application”`), order and casing of characters (`rev <<<'dwssap/cte/ tac'`), globing (`mkdir -p '/tmp/:&$NiA'`), as well as various tricks involving passing strings through tokens/environment variables/input streams.(Citation: Bashfuscator Command Obfuscators)(Citation: FireEye Obfuscation June 2017) Adversaries may also use tricks such as directory traversals to obfuscate references to the binary being invoked by a command (`C:\voi\pcw\..\..\Windows\tei\qs\k\..\..\..\system32\erool\..\wbem\wg\je\..\..\wmic.exe shadowcopy delete`).(Citation: Twitter Richard WMIC) Tools such as <code>Invoke-Obfuscation</code> and <code>Invoke-DOSfucation</code> have also been used to obfuscate commands.(Citation: Invoke-DOSfuscation)(Citation: Invoke-Obfuscation)
Query: risk of The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
Matching passage: CVE-2015-7704. CWE: CWE-20. CVSS: 7.5. The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages.
Near-miss passage: CVE-2015-2081. CWE: CWE-20. CVSS: 9.800000190734863. Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Query: CVE similar to CVE-2015-8852
Matching passage: CVE-2015-8852. CWE: UNKNOWN. CVSS: 7.5. Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: exploit The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB
Matching passage: CVE-2015-5647. CWE: CWE-94. CVSS: 8.5. The RSS Reader component in Cybozu Garoon 3.x through 3.7.5 and 4.x through 4.0.3 allows remote authenticated users to execute arbitrary PHP code via unspecified vectors, aka CyVDB-866.
Near-miss passage: CVE-2015-1645. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."
Query: exploit Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.
Matching passage: CVE-2015-5130. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
Near-miss passage: CVE-2015-4849. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/IspPunchInServlet.