alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attack
Matching passage: CVE-2015-4630. CWE: CWE-352. CVSS: 8.0. Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for requests that create a user via a request to members/memberentry.pl or (2) give a user superlibrarian permission via a request to members/member-flags.pl or (3) hijack the authentication of arbitrary users for requests that conduct cross-site scripting (XSS) attacks via the addshelf parameter to opac-shelves.pl.
Near-miss passage: CVE-2015-5075. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in X2Engine X2CRM before 5.2 allows remote attackers to hijack the authentication of administrators for requests that create an administrative account via a crafted request to index.php/users/create.
Query: risk of Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple 
Matching passage: CVE-2015-5346. CWE: UNKNOWN. CVSS: 8.100000381469727. Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
Near-miss passage: CVE-2015-1051. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
Query: risk of PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other imp
Matching passage: CVE-2015-8383. CWE: CWE-119. CVSS: 9.800000190734863. PCRE before 8.38 mishandles certain repeated conditional groups, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-5343. CWE: CWE-119. CVSS: 7.599999904632568. Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.
Query: rule covering Looks for potential enumeration of AWS buckets via ListBuckets.
Matching passage: Sigma rule: Looks for potential enumeration of AWS buckets via ListBuckets.. Logsource: aws / cloudtrail. Rule: title: Potential Bucket Enumeration on AWS id: f305fd62-beca-47da-ad95-7690a0620084 related: - id: 4723218f-2048-41f6-bcb0-417f2d784f61 type: similar status: test description: Looks for potential enumeration of AWS buckets via ListBuckets. references: - https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md - https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html - https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2023-01-06 modified: 2024-07-10 tags: - attack.discovery - attack.t1580 - attack.t1619 logsource: product: aws service: cloudtrail detection: selection: eventSource: s3.amazonaws.com eventName: ListBuckets filter: userIdentity.type: AssumedRole condition: selection and not filter falsepositives: - Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity. level: low
Near-miss passage: Sigma rule: Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially su. Logsource: windows / firewall-as. Rule: title: New Firewall Rule Added In Windows Firewall Exception List For Potential Suspicious Application id: 9e2575e7-2cb9-4da1-adc8-ed94221dca5e related: - id: cde0a575-7d3d-4a49-9817-b8004a7bf105 type: derived status: test description: Detects the addition of a new rule to the Windows Firewall exception list for an application located in a potentially suspicious location. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) - https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/# author: frack113 date: 2023-02-26 modified: 2024-05-10 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 ApplicationPath|contains: - :\PerfLogs\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ filter_main_block: Action: 2 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: risk of The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
Matching passage: CVE-2015-8400. CWE: CWE-254. CVSS: 7.400000095367432. The HTTPS fallback implementation in Shell In A Box (aka shellinabox) before 2.19 makes it easier for remote attackers to conduct DNS rebinding attacks via the "/plain" URL.
Near-miss passage: CVE-2015-8857. CWE: CWE-254. CVSS: 9.800000190734863. The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.
Query: Sigma rule for Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Matching passage: Sigma rule: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.. Logsource: windows / process_creation. Rule: title: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE id: d80d5c81-04ba-45b4-84e4-92eba40e0ad3 status: test description: Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/ - https://twitter.com/_felamos/status/1204705548668555264 - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/ author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2025-10-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dotnet.exe - OriginalFileName: .NET Host selection_cli: CommandLine|endswith: - .csproj - .csproj" - .dll - .dll" - .csproj' - .dll' filter_optional_notepadplus_plus: ParentImage: - C:\Program Files (x86)\Notepad++\notepad++.exe - C:\Program Files\Notepad++\notepad++.exe CommandLine|contains|all: - C:\ProgramData\CSScriptNpp\ - '-cscs_path:' - \cs-script\cscs.dll condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrator usage level: medium
Near-miss passage: Sigma rule: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Logsource: windows / process_creation. Rule: title: Use of Scriptrunner.exe id: 64760eef-87f7-4ed3-93fd-655668ea9420 status: test description: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting references: - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ScriptRunner.exe - OriginalFileName: ScriptRunner.exe selection_cli: CommandLine|contains: ' -appvscript ' condition: all of selection* falsepositives: - Legitimate use when App-v is deployed level: medium
Query: risk of Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH key
Matching passage: CVE-2015-7511. CWE: CWE-200. CVSS: 2.0. Libgcrypt before 1.6.5 does not properly perform elliptic-point curve multiplication during decryption, which makes it easier for physically proximate attackers to extract ECDH keys by measuring electromagnetic emanations.
Near-miss passage: CVE-2015-1314. CWE: CWE-200. CVSS: 2.0999999046325684. The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances.
Query: exploit Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Matching passage: CVE-2015-2972. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Sysphonic Thetis before 2.3.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-8153. CWE: CWE-89. CVSS: 8.800000190734863. SQL injection vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: Outbound C2 pattern associated with Hypervisor CLI
Matching passage: T1059.012 Hypervisor CLI. Tactics: execution. Description: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).
Near-miss passage: T1059.001 PowerShell. Tactics: execution. Description: Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems). PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk. A number of PowerShell-based offensive testing tools are available, including [Empire](https://attack.mitre.org/software/S0363), [PowerSploit](https://attack.mitre.org/software/S0194), [PoshC2](https://attack.mitre.org/software/S0378), and PSAttack.(Citation: Github PSAttack) PowerShell commands/scripts can also be executed without directly invoking the <code>powershell.exe</code> binary through interfaces to PowerShell's underlying <code>System.Management.Automation</code> assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).(Citation: Sixdub PowerPick Jan 2016)(Citation: SilentBreak Offensive PS Dec 2015)(Citation: Microsoft PSfromCsharp APR 2014)
Query: exploit Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE)
Matching passage: CVE-2015-0651. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.
Near-miss passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.
Query: CVE similar to CVE-2015-4955
Matching passage: CVE-2015-4955. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8.5.5.0, and 8.5.6 before 8.5.6.0 CF1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-3615. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack.
Query: exploit Actian Matrix 5.1.x through 5.1.2.4 and 5.2.x through 5.2.0.1 allows remote authenticated users to bypass intended write-access restrictions and execute an UPDATE statement by refe
Matching passage: CVE-2015-3993. CWE: CWE-89. CVSS: 6.5. Actian Matrix 5.1.x through 5.1.2.4 and 5.2.x through 5.2.0.1 allows remote authenticated users to bypass intended write-access restrictions and execute an UPDATE statement by referencing a table.
Near-miss passage: CVE-2015-6522. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php.
Query: describe CVE-2015-10010
Matching passage: CVE-2015-10010. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in OpenDNS OpenResolve. It has been rated as problematic. Affected by this issue is the function get of the file resolverapi/endpoints.py of the component API. The manipulation leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The name of the patch is c680170d5583cd9342fe1af43001fe8b2b8004dd. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217196.
Near-miss passage: CVE-2015-2182. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322.
Query: threat report mentioning Local Email Collection
Matching passage: T1114.001 Local Email Collection. Tactics: collection. Description: Adversaries may target user email on local systems to collect sensitive information. Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files. Outlook stores data locally in offline data files with an extension of .ost. Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.(Citation: Outlook File Sizes) IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files. Both types of Outlook data files are typically stored in `C:\Users\<username>\Documents\Outlook Files` or `C:\Users\<username>\AppData\Local\Microsoft\Outlook`.(Citation: Microsoft Outlook Files)
Near-miss passage: T1114.003 Email Forwarding Rule. Tactics: collection. Description: Adversaries may setup email forwarding rules to collect sensitive information. Adversaries may abuse email forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.(Citation: US-CERT TA18-068A 2018) Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.(Citation: Pfammatter - Hidden Inbox Rules) Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient. These rules may be created through a local email application, a web interface, or by command-line interface. Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule. Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.(Citation: Microsoft Tim McMichael Exchange Mail Forwarding 2)(Citation: Mac Forwarding Rules) Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more. Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.(Citation: Pfammatter - Hidden Inbox Rules) In some environments, administrators may be able to enable email forwarding rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsof
Query: detect Detects attempts to create and add an account to the admin group via "dscl" in logs
Matching passage: Sigma rule: Detects attempts to create and add an account to the admin group via "dscl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Dscl id: b743623c-2776-40e0-87b1-682b975d0ca5 related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "dscl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos - https://ss64.com/osx/dscl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /dscl CommandLine|contains|all: - ' -append ' - ' /Groups/admin ' - ' GroupMembership ' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modif. Logsource: windows / security. Rule: title: Windows Default Domain GPO Modification id: e5ac86dd-2da1-454b-be74-05d26c769d7d related: - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294 type: similar status: experimental description: 'Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain. ' references: - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html - https://adsecurity.org/?p=3377 - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ - https://jgspiers.com/audit-group-policy-changes/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-22 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Enable ''Audit Directory Service Changes'' in the Default Domain Controllers Policy under: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success). Additionally, proper SACL needs to be configured on the ''CN=Policies,CN=System,DC=<domain>,DC=<tld>'' container in Active Directory to capture changes to Group Policy Objects. ' detection: selection: EventID: 5136 ObjectClass: groupPolicyContainer ObjectDN|startswith: - CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM - CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM condition: selection falsepositives: - Legitimate modifications to Default Domain or Default Domain Controllers GPOs level: medium