alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: exploit Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or caus
Matching passage: CVE-2015-0314. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0316, CVE-2015-0318, CVE-2015-0321, CVE-2015-0329, and CVE-2015-0330.
Near-miss passage: CVE-2015-5920. CWE: UNKNOWN. CVSS: 4.300000190734863. The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via unspecified vectors.
Query: exploit NETGEAR WNR1000v3 devices with firmware 1.0.2.68 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting tha
Matching passage: CVE-2015-8263. CWE: UNKNOWN. CVSS: 8.600000381469727. NETGEAR WNR1000v3 devices with firmware 1.0.2.68 use the same source port number for every DNS query, which makes it easier for remote attackers to spoof responses by selecting that number for the destination port.
Near-miss passage: CVE-2015-4798. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Listener, a different vulnerability than CVE-2015-4839.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity via vectors related to NDMP Backup Service.
Matching passage: CVE-2015-4920. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity via vectors related to NDMP Backup Service.
Near-miss passage: CVE-2015-0417. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0388.
Query: describe CVE-2015-5603
Matching passage: CVE-2015-5603. CWE: CWE-94. CVSS: 6.5. The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA allows remote authenticated users to execute arbitrary Java code via unspecified vectors, related to "Velocity Template Injection Vulnerability."
Near-miss passage: CVE-2015-0092. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0091, and CVE-2015-0093.
Query: secure coding against Allocation of Resources Without Limits or Throttling
Matching passage: CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Near-miss passage: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer. The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Query: write Sigma for Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be
Matching passage: Sigma rule: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be. Logsource: windows / ps_script. Rule: title: Powershell Local Email Collection id: 2837e152-93c8-43d2-85ba-c3cd3c2ae614 status: test description: 'Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a users local system, such as Outlook storage or cache files. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md author: frack113 date: 2021-07-21 modified: 2022-12-25 tags: - attack.collection - attack.t1114.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Get-Inbox.ps1 - Microsoft.Office.Interop.Outlook - Microsoft.Office.Interop.Outlook.olDefaultFolders - -comobject outlook.application condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.. Logsource: windows / process_creation. Rule: title: Service Startup Type Change Via Wmic.EXE id: c0514f28-fdae-42df-b886-06e2b2bc5b37 status: experimental description: 'Detects changes to service startup type to ''disabled'' or ''manual'' using the WMIC command-line utility. ' references: - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.execution - attack.defense-impairment - attack.t1047 - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - ' service ' - ChangeStartMode CommandLine|contains: - Manual - Disabled condition: all of selection_* falsepositives: - Legitimate administrative changes to service startup types using WMIC, investigate accordingly. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml
Query: alert when Detects Octopus Scanner Malware.
Matching passage: Sigma rule: Detects Octopus Scanner Malware.. Logsource: windows / file_event. Rule: title: Octopus Scanner Malware id: 805c55d9-31e6-4846-9878-c34c75054fe9 status: test description: Detects Octopus Scanner Malware. references: - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain author: NVISO date: 2020-06-09 modified: 2021-11-27 tags: - attack.initial-access - attack.t1195 - attack.t1195.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \AppData\Local\Microsoft\Cache134.dat - \AppData\Local\Microsoft\ExplorerSync.db condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects macOS Gatekeeper bypass via xattr utility. Logsource: macos / process_creation. Rule: title: Gatekeeper Bypass via Xattr id: f5141b6d-9f42-41c6-a7bf-2a780678b29b status: test description: Detects macOS Gatekeeper bypass via xattr utility references: - https://github.com/redcanaryco/atomic-red-team/blob/1fed40dc7e48f16ed44dcdd9c73b9222a70cca85/atomics/T1553.001/T1553.001.md - https://www.loobins.io/binaries/xattr/ author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2024-04-18 tags: - attack.defense-impairment - attack.t1553.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /xattr CommandLine|contains|all: - -d - com.apple.quarantine condition: selection falsepositives: - Legitimate activities level: low
Query: patch priority for CVE-2015-2044
Matching passage: CVE-2015-2044. CWE: CWE-200. CVSS: 2.0999999046325684. The emulation routines for unspecified X86 devices in Xen 3.2.x through 4.5.x does not properly initialize data, which allow local HVM guest users to obtain sensitive information via vectors involving an unsupported access size.
Near-miss passage: CVE-2015-5152. CWE: CWE-200. CVSS: 8.100000381469727. Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Query: secure coding against Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Matching passage: CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection'). The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Near-miss passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Query: explain T1213.006 Databases
Matching passage: T1213.006 Databases. Tactics: collection. Description: Adversaries may leverage databases to mine valuable information. These databases may be hosted on-premises or in the cloud (both in platform-as-a-service and software-as-a-service environments). Examples of databases from which information may be collected include MySQL, PostgreSQL, MongoDB, Amazon Relational Database Service, Azure SQL Database, Google Firebase, and Snowflake. Databases may include a variety of information of interest to adversaries, such as usernames, hashed passwords, personally identifiable information, and financial data. Data collected from databases may be used for [Lateral Movement](https://attack.mitre.org/tactics/TA0008), [Command and Control](https://attack.mitre.org/tactics/TA0011), or [Exfiltration](https://attack.mitre.org/tactics/TA0010). Data exfiltrated from databases may also be used to extort victims or may be sold for profit.(Citation: Google Cloud Threat Intelligence UNC5537 Snowflake 2024)
Near-miss passage: T1213.001 Confluence. Tactics: collection. Description: Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as: * Policies, procedures, and standards * Physical / logical network diagrams * System architecture diagrams * Technical system documentation * Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552)) * Work / project schedules * Source code snippets * Links to network shares and other internal resources
Query: risk of The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Matching passage: CVE-2015-9394. CWE: CWE-352. CVSS: 8.800000190734863. The users-ultra plugin before 1.5.63 for WordPress has CSRF via action=package_add_new to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-1424. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Gecko CMS 2.2 and 2.3 allows remote attackers to hijack the authentication of administrators for requests that add an administrator user via a newuser request to admin/index.php.
Query: patch priority for CVE-2015-4832
Matching passage: CVE-2015-4832. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.7, 11.1.2.2, and 11.1.2.3 allows remote attackers to affect integrity via vectors related to OIM Legacy UI.
Near-miss passage: CVE-2015-6968. CWE: UNKNOWN. CVSS: 6.5. Multiple incomplete blacklist vulnerabilities in the serendipity_isActiveFile function in include/functions_images.inc.php in Serendipity before 2.0.2 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .pht or (2) .phtml extension.
Query: secure coding against Non-exit on Failed Initialization
Matching passage: CWE-455 Non-exit on Failed Initialization. The product does not exit or otherwise modify its operation when security-relevant errors occur during initialization, such as when a configuration file has a format error or a hardware security module (HSM) cannot be activated, which can cause the product to execute in a less secure fashion than intended by the administrator.
Near-miss passage: CWE-556 ASP.NET Misconfiguration: Use of Identity Impersonation. Configuring an ASP.NET application to run with impersonated credentials may give the application unnecessary privileges.
Query: CVE similar to CVE-2015-8746
Matching passage: CVE-2015-8746. CWE: UNKNOWN. CVSS: 7.5. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
Near-miss passage: CVE-2015-0457. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2629.
Query: threat report mentioning Windows Command Shell
Matching passage: T1059.003 Windows Command Shell. Tactics: execution. Description: Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via [Remote Services](https://attack.mitre.org/techniques/T1021) such as [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: SSH in Windows) Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems. Adversaries may leverage [cmd](https://attack.mitre.org/software/S0106) to execute various commands and payloads. Common uses include [cmd](https://attack.mitre.org/software/S0106) to execute a single command, or abusing [cmd](https://attack.mitre.org/software/S0106) interactively with input and output forwarded over a command and control channel.
Near-miss passage: T1059.008 Network Device CLI. Tactics: execution. Description: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads. The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions. CLIs typically contain various permission levels required for different commands. Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS. The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or [SSH](https://attack.mitre.org/techniques/T1021/004). Adversaries can use the network CLI to change how network devices behave and operate. The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.(Citation: Cisco Synful Knock Evolution)
Query: patch priority for CVE-2015-0086
Matching passage: CVE-2015-0086. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 Gold and SP1, Word 2013 RT Gold and SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 Gold and SP1, Web Applications 2010 SP2, and Web Apps Server 2013 Gold and SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-0283. CWE: CWE-399. CVSS: 7.800000190734863. The slapi-nis plug-in before 0.54.2 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for a (1) group with a large number of members or (2) user that belongs to a large number of groups.
Query: exploit Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote at
Matching passage: CVE-2015-1675. CWE: CWE-94. CVSS: 9.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted Journal file, aka "Windows Journal Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-1695, CVE-2015-1696, CVE-2015-1697, CVE-2015-1698, and CVE-2015-1699.
Near-miss passage: CVE-2015-9227. CWE: CWE-94. CVSS: 7.199999809265137. PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.
Query: patch priority for CVE-2015-5826
Matching passage: CVE-2015-5826. CWE: CWE-284. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the text/css content type, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Near-miss passage: CVE-2015-1336. CWE: CWE-284. CVSS: 7.800000190734863. The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use.
Query: how to detect Server
Matching passage: T1583.004 Server. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain physical servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, such as watering hole operations in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), enabling [Phishing](https://attack.mitre.org/techniques/T1566) operations, or facilitating [Command and Control](https://attack.mitre.org/tactics/TA0011). Instead of compromising a third-party [Server](https://attack.mitre.org/techniques/T1584/004) or renting a [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may opt to configure and run their own servers in support of operations. Free trial periods of cloud servers may also be abused.(Citation: Free Trial PurpleUrchin)(Citation: Freejacked) Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure. Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.(Citation: NYTStuxnet)
Near-miss passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Query: threat report mentioning Authentication Package
Matching passage: T1547.002 Authentication Package. Tactics: persistence, privilege escalation. Description: Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating system.(Citation: MSDN Authentication Packages) Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location <code>HKLM\SYSTEM\CurrentControlSet\Control\Lsa\</code> with the key value of <code>"Authentication Packages"=&lt;target binary&gt;</code>. The binary will then be executed by the system when the authentication packages are loaded.
Near-miss passage: T1547 Boot or Logon Autostart Execution. Tactics: persistence, privilege escalation. Description: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. Operating systems may have mechanisms for automatically running a program on system boot or account logon.(Citation: Microsoft Run Key)(Citation: MSDN Authentication Packages)(Citation: Microsoft TimeProvider)(Citation: Cylance Reg Persistence Sept 2013)(Citation: Linux Kernel Programming) These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry. An adversary may achieve the same goal by modifying or extending features of the kernel. Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.
Query: vulnerability: It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified 
Matching passage: CVE-2015-5236. CWE: CWE-345. CVSS: 7.5. It was discovered that the IcedTea-Web used codebase attribute of the <applet> tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase value.
Near-miss passage: CVE-2015-7539. CWE: CWE-345. CVSS: 7.5. The Plugins Manager in Jenkins before 1.640 and LTS before 1.625.2 does not verify checksums for plugin files referenced in update site data, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted plugin.