alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows attacke
Matching passage: CVE-2015-8396. CWE: CWE-189. CVSS: 10.0. Integer overflow in the ImageRegionReader::ReadIntoBuffer function in MediaStorageAndFileFormat/gdcmImageRegionReader.cxx in Grassroots DICOM (aka GDCM) before 2.6.2 allows attackers to execute arbitrary code via crafted header dimensions in a DICOM image file, which triggers a buffer overflow.
Near-miss passage: CVE-2015-4021. CWE: CWE-189. CVSS: 5.0. The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive.
Query: Sigma rule for WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on
Matching passage: Sigma rule: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on. Logsource: windows / process_creation. Rule: title: HackTool - winPEAS Execution id: 98b53e78-ebaf-46f8-be06-421aafd176d9 status: test description: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz references: - https://github.com/carlospolop/PEASS-ng - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation author: Georg Lauenstein (sure[secure]) date: 2022-09-19 modified: 2023-03-23 tags: - attack.privilege-escalation - attack.discovery - attack.t1082 - attack.t1087 - attack.t1046 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: winPEAS.exe - Image|endswith: - \winPEASany_ofs.exe - \winPEASany.exe - \winPEASx64_ofs.exe - \winPEASx64.exe - \winPEASx86_ofs.exe - \winPEASx86.exe selection_cli_option: CommandLine|contains: - ' applicationsinfo' - ' browserinfo' - ' eventsinfo' - ' fileanalysis' - ' filesinfo' - ' processinfo' - ' servicesinfo' - ' windowscreds' selection_cli_dl: CommandLine|contains: https://github.com/carlospolop/PEASS-ng/releases/latest/download/ selection_cli_specific: - ParentCommandLine|endswith: ' -linpeas' - CommandLine|endswith: ' -linpeas' condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of a renamed office binary. Logsource: windows / process_creation. Rule: title: Renamed Office Binary Execution id: 0b0cd537-fc77-4e6e-a973-e53495c1083d status: test description: Detects the execution of a renamed office binary references: - https://infosec.exchange/@sbousseaden/109542254124022664 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-20 modified: 2025-12-09 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: - Excel.exe - MSACCESS.EXE - MSPUB.EXE - OneNote.exe - OneNoteM.exe - OUTLOOK.EXE - POWERPNT.EXE - WinWord.exe - Olk.exe - Description: - Microsoft Access - Microsoft Excel - Microsoft OneNote - Microsoft Outlook - Microsoft PowerPoint - Microsoft Publisher - Microsoft Word - Sent to OneNote Tool filter_main_legit_names: Image|endswith: - \EXCEL.exe - \excelcnv.exe - \MSACCESS.exe - \MSPUB.EXE - \ONENOTE.EXE - \ONENOTEM.EXE - \OUTLOOK.EXE - \POWERPNT.EXE - \WINWORD.exe - \OLK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0240
Matching passage: CVE-2015-0240. CWE: CWE-17. CVSS: 10.0. The Netlogon server implementation in smbd in Samba 3.5.x and 3.6.x before 3.6.25, 4.0.x before 4.0.25, 4.1.x before 4.1.17, and 4.2.x before 4.2.0rc5 performs a free operation on an uninitialized stack pointer, which allows remote attackers to execute arbitrary code via crafted Netlogon packets that use the ServerPasswordSet RPC API, as demonstrated by packets reaching the _netr_ServerPasswordSet function in rpc_server/netlogon/srv_netlog_nt.c.
Near-miss passage: CVE-2015-5605. CWE: CWE-17. CVSS: 5.0. The regular-expression implementation in Google V8, as used in Google Chrome before 44.0.2403.89, mishandles interrupts, which allows remote attackers to cause a denial of service (application crash) via crafted JavaScript code, as demonstrated by an error in garbage collection during allocation of a stack-overflow exception message.
Query: exploit Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attac
Matching passage: CVE-2015-5348. CWE: CWE-19. CVSS: 8.100000381469727. Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Near-miss passage: CVE-2015-4147. CWE: CWE-19. CVSS: 7.5. The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue.
Query: Sigma rule for Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualizati
Matching passage: Sigma rule: Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualizati. Logsource: windows / registry_set. Rule: title: Windows Credential Guard Disabled - Registry id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0 related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://woshub.com/disable-credential-guard-windows/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \Lsa\LsaCfgFlags Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/info.yml
Near-miss passage: Sigma rule: Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be. Logsource: windows / file_access. Rule: title: Access To Windows DPAPI Master Keys By Uncommon Applications id: 46612ae6-86be-4802-bc07-39b59feb1309 status: test description: 'Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function ' references: - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/ - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 modified: 2026-07-28 tags: - attack.credential-access - attack.t1555.004 logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: FileName|contains: - \Microsoft\Protect\S-1-5-18\ - \Microsoft\Protect\S-1-5-21- filter_main_system_folders: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_main_explorer: Image: C:\Windows\explorer.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: exploit A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation o
Matching passage: CVE-2015-10103. CWE: CWE-835. CVSS: 5.5. A vulnerability, which was classified as problematic, was found in InternalError503 Forget It up to 1.3. This affects an unknown part of the file js/settings.js. The manipulation of the argument setForgetTime with the input 0 leads to infinite loop. It is possible to launch the attack on the local host. Upgrading to version 1.4 is able to address this issue. The patch is named adf0c7fd59b9c935b4fd675c556265620124999c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-226119.
Near-miss passage: CVE-2015-7850. CWE: CWE-835. CVSS: 6.5. ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote authenticated users to cause a denial of service (infinite loop or crash) by pointing the key file at the log file.
Query: CVE similar to CVE-2015-1429
Matching passage: CVE-2015-1429. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 32-bit and 64-bit allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.
Near-miss passage: CVE-2015-1396. CWE: CWE-22. CVSS: 7.5. A Directory Traversal vulnerability exists in the GNU patch before 2.7.4. A remote attacker can write to arbitrary files via a symlink attack in a patch file. NOTE: this issue exists because of an incomplete fix for CVE-2015-1196.
Query: patch priority for CVE-2015-6042
Matching passage: CVE-2015-6042. CWE: CWE-416. CVSS: 9.300000190734863. Use-after-free vulnerability in the CWindow object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-5114. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5113.
Query: exploit Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
Matching passage: CVE-2015-5948. CWE: CWE-362. CVSS: 8.100000381469727. Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.
Near-miss passage: CVE-2015-5189. CWE: CWE-362. CVSS: 4.900000095367432. Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.
Query: vulnerability: The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Matching passage: CVE-2015-9445. CWE: CWE-352. CVSS: 8.800000190734863. The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin-ajax.php in a unitegallery_ajax_action operation.
Near-miss passage: CVE-2015-2905. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows remote attackers to hijack the authentication or intranet connectivity of arbitrary users.
Query: Suspicious Make and Impersonate Token execution detected on endpoint
Matching passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Near-miss passage: T1134.002 Create Process with Token. Tactics: stealth, privilege escalation. Description: Adversaries may create a new process with an existing token to escalate privileges and bypass access controls. Processes can be created with the token and resulting security context of another user using features such as <code>CreateProcessWithTokenW</code> and <code>runas</code>.(Citation: Microsoft RunAs) Creating processes with a token not associated with the current user may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used. For example, the token could be duplicated via [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) or created via [Make and Impersonate Token](https://attack.mitre.org/techniques/T1134/003) before being used to create a process. While this technique is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001), the techniques can be used in conjunction where a token is duplicated and then used to create a new process.
Query: patch priority for CVE-2015-1545
Matching passage: CVE-2015-1545. CWE: UNKNOWN. CVSS: 5.0. The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request.
Near-miss passage: CVE-2015-2600. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Siebel Core - Server OM Svcs component in Oracle Siebel CRM 8.1.1, 8.2.2, and 15.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
Query: detection engineering for Domains
Matching passage: T1583.001 Domains. Tactics: resource development. Description: Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresses. They can be purchased or, in some cases, acquired for free. Adversaries may use acquired domains for a variety of purposes, including for [Phishing](https://attack.mitre.org/techniques/T1566), [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), and Command and Control.(Citation: CISA MSS Sep 2020) Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).(Citation: FireEye APT28)(Citation: PaypalScam) Typosquatting may be used to aid in delivery of payloads via [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). Adversaries may also use internationalized domain names (IDNs) and different character sets (e.g. Cyrillic, Greek, etc.) to execute "IDN homograph attacks," creating visually similar lookalike domains used to deliver malware to victim machines.(Citation: CISA IDN ST05-016)(Citation: tt_httrack_fake_domains)(Citation: tt_obliqueRAT)(Citation: httrack_unhcr)(Citation: lazgroup_idn_phishing) Different URIs/URLs may also be dynamically generated to uniquely serve malicious content to victims (including one-time, single use domain names).(Citation: iOS URL Scheme)(Citation: URI)(Citation: URI Use)(Citation: URI Unique) Adversaries may also acquire and repurpose expired domains, which may be potentially already allowlisted/trusted by defenders based on an existing reputation/history.(Citation: Categorisation_not_boundary)(Citation: Domain_Steal_CC)(Citation: Redirectors_Domain_Fronting)(Citation: bypass_webproxy_filtering) Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain. Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain. Adversaries may use such pr
Near-miss passage: T1583.002 DNS Server. Tactics: resource development. Description: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations. By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic ([DNS](https://attack.mitre.org/techniques/T1071/004)). With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.(Citation: Unit42 DNS Mar 2019)
Query: secure coding against Client-Side Enforcement of Server-Side Security
Matching passage: CWE-602 Client-Side Enforcement of Server-Side Security. The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Near-miss passage: CWE-1086 Class with Excessive Number of Child Classes. A class contains an unnecessarily large number of children.
Query: CVE similar to CVE-2015-1929
Matching passage: CVE-2015-1929. CWE: CWE-119. CVSS: 7.800000190734863. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12 allows remote attackers to cause a denial of service (daemon crash) via unspecified vectors, a different vulnerability than CVE-2015-1924, CVE-2015-1925, CVE-2015-1930, CVE-2015-1948, CVE-2015-1953, CVE-2015-1954, CVE-2015-1962, CVE-2015-1963, CVE-2015-1964, and CVE-2015-1965.
Near-miss passage: CVE-2015-8221. CWE: CWE-119. CVSS: 10.0. Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb image, which triggers a heap-based buffer overflow.
Query: describe CVE-2015-0427
Matching passage: CVE-2015-0427. CWE: UNKNOWN. CVSS: 3.200000047683716. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.3.20 allows local users to affect integrity and availability via vectors related to VMSVGA virtual graphics device, a different vulnerability than CVE-2014-6588, CVE-2014-6589, CVE-2014-6590, and CVE-2014-6595.
Near-miss passage: CVE-2015-5417. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2876.
Query: detection engineering for Fallback Channels
Matching passage: T1008 Fallback Channels. Tactics: command and control. Description: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
Near-miss passage: T1001 Data Obfuscation. Tactics: command and control. Description: Adversaries may obfuscate command and control traffic to make it more difficult to detect.(Citation: Bitdefender FunnyDream Campaign November 2020) Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Query: exploit Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related
Matching passage: CVE-2015-0389. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via vectors related to SAML, a different vulnerability than CVE-2014-6592.
Near-miss passage: CVE-2015-3233. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Query: risk of Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Matching passage: CVE-2015-4619. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in Spina before commit bfe44f289e336f80b6593032679300c493735e75.
Near-miss passage: CVE-2015-9429. CWE: CWE-352. CVSS: 6.5. The yith-maintenance-mode plugin before 1.2.0 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=yith-maintenance-mode panel_page parameter.
Query: describe CVE-2015-5298
Matching passage: CVE-2015-5298. CWE: CWE-287. CVSS: 6.5. The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
Near-miss passage: CVE-2015-7871. CWE: CWE-287. CVSS: 9.800000190734863. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Query: CVE similar to CVE-2015-4885
Matching passage: CVE-2015-4885. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 allows remote attackers to affect confidentiality via vectors related to Agent Next Gen.
Near-miss passage: CVE-2015-2651. CWE: UNKNOWN. CVSS: 3.799999952316284. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect availability via vectors related to Kernel Zones virtualized NIC driver.