alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: patch priority for CVE-2015-4791
Matching passage: CVE-2015-4791. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.
Query: vulnerability: An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. 
Matching passage: CVE-2015-8546. CWE: CWE-787. CVSS: 9.800000190734863. An issue was discovered on Samsung mobile devices with software through 2015-11-12, affecting the Galaxy S6/S6 Edge, Galaxy S6 Edge+, and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).
Near-miss passage: CVE-2015-5110. CWE: CWE-787. CVSS: 6.800000190734863. Stack-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
Query: alert when Detects the creation of shell scripts under the "profile.d" path.
Matching passage: Sigma rule: Detects the creation of shell scripts under the "profile.d" path.. Logsource: linux / file_event. Rule: title: Potentially Suspicious Shell Script Creation in Profile Folder id: 13f08f54-e705-4498-91fd-cce9d9cee9f1 status: test description: Detects the creation of shell scripts under the "profile.d" path. references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.persistence logsource: product: linux category: file_event detection: selection: TargetFilename|contains: /etc/profile.d/ TargetFilename|endswith: - .csh - .sh condition: selection falsepositives: - Legitimate shell scripts in the "profile.d" directory could be common in your environment. Apply additional filter accordingly via "image", by adding specific filenames you "trust" or by correlating it with other events. - Regular file creation during system update or software installation by the package manager level: low
Near-miss passage: Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: Suspicious Outlook Macro Created id: 117d3d3a-755c-4a61-b23e-9171146d094c related: - id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM filter: Image|endswith: \outlook.exe condition: selection and not filter falsepositives: - Unlikely level: high
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and
Matching passage: CVE-2015-9109. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation inqsee_fuse_write could lead to untrusted pointer dereference.
Near-miss passage: CVE-2015-3194. CWE: CWE-476. CVSS: 7.5. crypto/rsa/rsa_ameth.c in OpenSSL 1.0.1 before 1.0.1q and 1.0.2 before 1.0.2e allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RSA PSS ASN.1 signature that lacks a mask generation function parameter.
Query: risk of A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController
Matching passage: CVE-2015-10084. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in irontec klear-library chloe and classified as critical. Affected by this issue is the function _prepareWhere of the file Controller/Rest/BaseController.php. The manipulation leads to sql injection. Upgrading to version marla is able to address this issue. The name of the patch is b25262de52fdaffde2a4434fc2a84408b304fbc5. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221504.
Near-miss passage: CVE-2015-4611. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in the Smoelenboek (ncgov_smoelenboek) extension before 1.0.9 for TYPO3 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CVE similar to CVE-2015-6260
Matching passage: CVE-2015-6260. CWE: CWE-20. CVSS: 7.5. Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.
Near-miss passage: CVE-2015-5144. CWE: CWE-20. CVSS: 4.300000190734863. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Query: CVE similar to CVE-2015-5240
Matching passage: CVE-2015-5240. CWE: CWE-362. CVSS: 3.5. Race condition in OpenStack Neutron before 2014.2.4 and 2015.1 before 2015.1.2, when using the ML2 plugin or the security groups AMQP API, allows remote authenticated users to bypass IP anti-spoofing controls by changing the device owner of a port to start with network: before the security group rules are applied.
Near-miss passage: CVE-2015-7613. CWE: CWE-362. CVSS: 6.900000095367432. Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.
Query: CVE similar to CVE-2015-2027
Matching passage: CVE-2015-2027. CWE: CWE-264. CVSS: 2.0999999046325684. IBM WebSphere eXtreme Scale 7.1.0 before 7.1.0.3 and 7.1.1 before 7.1.1.1 improperly performs logout actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.
Near-miss passage: CVE-2015-1458. CWE: CWE-264. CVSS: 6.900000095367432. Fortinet FortiAuthenticator 3.0.0 allows local users to bypass intended restrictions and gain privileges by creating /tmp/privexec/dbgcore_enable_shell_access and executing the "shell" command.
Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing website. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Mega.nz id: fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4 status: test description: 'Detects a network connection initiated by a binary to "api.mega.co.nz". Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads. ' references: - https://megatools.megous.com/ - https://www.mandiant.com/resources/russian-targeting-gov-business author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2024-05-31 tags: - attack.exfiltration - attack.t1567.002 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - mega.co.nz - mega.nz condition: selection falsepositives: - Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool. level: low
Near-miss passage: Sigma rule: Detects usage of "IMEWDBLD.exe" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via IMEWDBLD.EXE id: 863218bd-c7d0-4c52-80cd-0a96c09f54af related: - id: 8d7e392e-9b28-49e1-831d-5949c6281228 type: derived status: test description: Detects usage of "IMEWDBLD.exe" to download arbitrary files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IMEWDBLD.exe - OriginalFileName: imewdbld.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated use
Matching passage: CVE-2015-4384. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-6521. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in ATutor LMS version 2.2.
Query: patch priority for CVE-2015-3425
Matching passage: CVE-2015-3425. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter.
Near-miss passage: CVE-2015-10093. CWE: CWE-79. CVSS: 5.400000095367432. A vulnerability was found in Mark User as Spammer Plugin 1.0.0/1.0.1 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function user_row_actions of the file plugin/plugin.php. The manipulation of the argument url leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.0.2 is able to address this issue. The identifier of the patch is e7059727274d2767c240c55c02c163eaa4ba6c62. It is recommended to upgrade the affected component. The identifier VDB-222325 was assigned to this vulnerability.
Query: CVE similar to CVE-2015-7775
Matching passage: CVE-2015-7775. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Cybozu Garoon 4.0.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2016-1197.
Near-miss passage: CVE-2015-4661. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Symphony CMS 2.6.2 allows remote attackers to inject arbitrary web script or HTML via the sort parameter to system/authors.
Query: write Sigma for Detects DLL sideloading of "dbgcore.dll"
Matching passage: Sigma rule: Detects DLL sideloading of "dbgcore.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGCORE.DLL id: 9ca2bf31-0570-44d8-a543-534c47c33ed7 status: test description: Detects DLL sideloading of "dbgcore.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbgcore.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_steam: ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbgcore.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Near-miss passage: Sigma rule: Detects suspicious PowerShell download command. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Download - PoshModule id: de41232e-12e8-49fa-86bc-c05c7e722df9 related: - id: 65531a81-a694-4e31-ae04-f8ba5bc33759 type: derived status: test description: Detects suspicious PowerShell download command references: - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0 - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0 author: Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2023-01-20 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_webclient_: ContextInfo|contains: System.Net.WebClient selection_function: ContextInfo|contains: - .DownloadFile( - .DownloadString( condition: all of selection_* falsepositives: - PowerShell scripts that download content from the Internet level: medium
Query: risk of The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Matching passage: CVE-2015-6736. CWE: CWE-17. CVSS: 5.0. The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Near-miss passage: CVE-2015-4943. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.
Query: detect Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat in logs
Matching passage: Sigma rule: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat. Logsource: windows / process_creation. Rule: title: Suspicious IIS URL GlobalRules Rewrite Via AppCmd id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08 status: test description: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells. references: - https://twitter.com/malmoeb/status/1616702107242971144 - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:system.webServer/rewrite/globalRules - 'commit:' condition: all of selection_* falsepositives: - Legitimate usage of appcmd to add new URL rewrite rules level: medium
Near-miss passage: Sigma rule: Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN i. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By IMEWDBLD.EXE id: 8d7e392e-9b28-49e1-831d-5949c6281228 related: - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af type: derived status: test description: 'Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: frack113 date: 2022-01-22 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \IMEWDBLD.exe condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity
Matching passage: Sigma rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity. Logsource: windows / process_creation. Rule: title: Suspicious Kerberos Ticket Request via CLI id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 related: - id: a861d835-af37-4930-bcd6-5b178bfb54df type: similar status: experimental description: 'Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. ' references: - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_cli: CommandLine|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: all of selection_* falsepositives: - Legitimate command line usage by administrators or security tools. level: high
Near-miss passage: Sigma rule: Detects enumeration of local network configuration. Logsource: linux / process_creation. Rule: title: System Network Discovery - Linux id: e7bd1cfa-b446-4c88-8afb-403bcd79e3fa status: test description: Detects enumeration of local network configuration references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md author: Ömer Günal and remotephone, oscd.community date: 2020-10-06 modified: 2022-09-15 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /firewall-cmd - /ufw - /iptables - /netstat - /ss - /ip - /ifconfig - /systemd-resolve - /route selection_cli: CommandLine|contains: /etc/resolv.conf condition: 1 of selection_* falsepositives: - Legitimate administration activities level: informational
Query: SIEM correlation: command and control activity consistent with Standard Encoding
Matching passage: T1132.001 Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications. Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding) Some data encoding systems may also result in data compression, such as gzip.
Near-miss passage: T1132.002 Non-Standard Encoding. Tactics: command and control. Description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding)(Citation: Wikipedia Character Encoding)
Query: patch priority for CVE-2015-6094
Matching passage: CVE-2015-6094. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2422. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2385, CVE-2015-2390, CVE-2015-2397, CVE-2015-2404, and CVE-2015-2406.
Query: patch priority for CVE-2015-4678
Matching passage: CVE-2015-4678. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in Persian Car CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter to the default URI.
Near-miss passage: CVE-2015-6659. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
Query: vulnerability: The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users 
Matching passage: CVE-2015-3636. CWE: UNKNOWN. CVSS: 4.900000095367432. The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
Near-miss passage: CVE-2015-4908. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 8u60 and JavaFX 2.2.85 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2015-4906 and CVE-2015-4916.